offcloud
Turn any server into a secure private cloud.
offcloud builds a private overlay network across the machines you already own — a laptop, a home server, a rented VM — and lets you publish any service running on them under your own domain, with certificates issued and renewed automatically. No public IP, no port forwarding, no router configuration.
Category
Network infrastructure
Stage
Live, free tier
Model
Freemium, self-serve
Interfaces
Web dashboard, public API
The problem
Most genuinely useful services end up running somewhere without a front door. A home server sits behind carrier-grade NAT, so there is no inbound port to open. A residential connection changes address every few days. A machine in an office has an IP that nobody outside the building can route to.
The usual workarounds each cost something. Port forwarding needs a router you control and a static address. Dynamic DNS needs a daemon and still breaks. A VPS in front means paying for a second machine and keeping its certificates alive. And every one of them means deliberately opening a hole in a network that was closed for a reason.
How it works
Each machine joins a private overlay network and holds an outbound connection. Because the tunnel is established from the inside out, nothing has to be reachable from the public internet, and CGNAT stops being an obstacle — there is no inbound connection to block.
Services are then published at the edge. You point a domain at offcloud, map it to a service on one of your machines, and requests are carried down the tunnel to it. TLS terminates at the edge with certificates that are obtained and renewed without you being involved.
The result is a private cloud with a public address: your machines stay unreachable, and only what you explicitly publish is served.
Why we build it
offcloud is the piece of infrastructure the rest of this portfolio stands on. Every site LucidMaze operates — including the one you are reading — reaches the public internet through an offcloud tunnel to a private interface on a machine with no inbound ports open at all.
That is the most demanding test we can give it: if offcloud is down, we are down. It has made us far more careful about the product than any roadmap would have.
Capabilities
What it does
Private overlay mesh
Laptops, servers and cloud instances join one encrypted network and address each other directly, wherever they physically sit.
Your domain, automatic HTTPS
Publish a service under a domain you own. Certificates are issued and renewed for you; there is no cron job to forget.
Works behind CGNAT
Tunnels are established outbound, so a connection with no routable inbound address is not a limitation.
No router configuration
Nothing to forward, no firewall rule to open, no static IP to buy. The network your machines sit on stays closed.
Public API
Networks, machines and published services are all manageable programmatically, so environments can be provisioned rather than clicked.
Free tier
The core of the product is free to use permanently, which is what makes it reasonable for a home lab rather than only a company.
Built with
- WireGuard-based overlay
- Edge reverse proxy
- Automatic ACME certificates
- Public REST API
Next venture
Bestie
Your autonomous agent, on call.