Statio

What is Statio?

Statio ships your Docker image to your own server with a git push. Your GitHub Actions workflow builds and signs the image; a lightweight agent on your server receives it, verifies the signature, and recreates the container.

git push ─▶ CI: build + sign ─▶ statio/action ─▶ agent on your server ─▶ deployed

Tailscale is only the deploy channel

CI reaches the agent over a private Tailscale network — this replaces SSH and means the agent opens no inbound deploy port. statio does not serve your app over Tailscale (no tailscale serve): public traffic to your app goes the normal way, through a reverse proxy (NPMplus) on 80/443, exactly as it would without statio.

No SSH, no deploy port

CI talks to the agent over a private Tailscale network — no SSH, no inbound deploy port. (Your app is still served by your reverse proxy on 80/443.)

Signed deploys only

Only what your CI signed gets deployed — cosign keyless verification before anything runs.

Domain & DNS included

Configure the reverse proxy (NPMplus) and Cloudflare DNS in the same deploy.

Just an Actions step

Drops into GitHub Actions as one step. No brittle deploy scripts.

Install

On the server, a single command:

curl -fsSL https://statio.accentio.dev/install.sh | sudo sh

Then follow the Getting started walkthrough — server setup, the workflow step, and your first git push deploy.