Use case · The Modern VPS
A VPS, with
batteries included.
An exe.dev VM is a Linux box you SSH into. It comes with a hostname, a valid TLS cert, key-only SSH, and a private HTTPS front door—so you can stop writing the same nginx + certbot + ufw config you’ve written ten times.
$ ssh exe.dev new myblog
vm myblog ready in 0.8s$ ssh blog.exe.xyz \
'cd /srv && python3 -m http.server 8080'
# served at https://blog.exe.xyz/ — TLS already on, login required.$ ssh exe.dev share set-public blog
blog.exe.xyz is now public.HTTPS, handled.
Each VM gets a hostname at vmname.exe.xyz with a real certificate.
The exe.dev edge terminates TLS and forwards to a port on the VM—by default
the smallest TCP port your Dockerfile exposes, otherwise whatever you set
with share port.
You can also point your own domain at it. No certbot, no ACME challenge, no renewal cron.
- Per-VM hostname under
exe.xyz, or bring your own domain. - HTTP/2, HSTS, modern cipher suites, all at the edge.
X-Forwarded-Proto,X-Forwarded-Host, etc. forwarded intact.- WebSockets, SSE, and long-lived connections supported.
Private by default.
A new VM’s HTTP proxy only answers to accounts you’ve granted access. Anyone
else hitting vmname.exe.xyz gets redirected to exe.dev’s login
page; if they’re not on the share list, the request never reaches your app.
That means you don’t have to put a half-built dashboard, a staging database,
or a debug endpoint behind its own basic-auth or VPN to keep it offline. When
you’re ready, share set-public opens it to the world.
Sensible defaults.
The fresh-VM checklist most ops guides start with—already done.
Key-only SSH
Password auth is disabled. The only way in is a key registered on your exe.dev account.
No exposed ports
The only thing facing the public internet is the exe.dev HTTPS proxy on 443. SSH is brokered through exe.dev.
Real VMs
KVM-isolated, not a shared-kernel container. Each VM has its own kernel and its own disk.
Secrets at the proxy
Integrations inject API keys into outbound HTTP calls. Your app code stays free of credentials.
Maintained images
The default exeuntu image tracks upstream Ubuntu security updates. Or run any Docker image.
SSH-signed API
Every API call is signed by an SSH key. Add a key to rotate, delete one to revoke.
One pool. Many VMs.
Keep your blog, staging site, database, and experiments in separate VMs without buying a server for each. They share one pool of vCPUs and memory that you reserve.
Adding a VM doesn’t increase the pool’s charge. Resizing the pool does. A stopped VM keeps its disk, and the running VMs can use more of the pool’s capacity.
See how pools work and pricing.