For server owners

You’re setting up the server. This page is the rest of the picture once you’ve worked through the Quick start.

What you’ll get

A custom subdomain (yourname.atreo.link) with automatic wildcard HTTPS, or your own custom domain on the Pro plan. A WireGuard tunnel for every member with per-member, per-app access control.

End-to-end encrypted push notifications from any app on your server to phones, browsers, and the in-app inbox, with HTML-formatted bodies for reports and dashboards. The agent ships with a built-in SMTP relay so any self-hosted app that can send email (Synology, Vaultwarden, Pi-hole, your NAS, your router, anything else) can deliver encrypted notifications without bespoke integration.

Architecture in one paragraph

atreoAGENT is a Go daemon that runs in Docker on your server. It owns the WireGuard interface (wg-atreo), serves HTTPS via a built-in reverse proxy (or delegates to your existing Caddy/Traefik/nginx via forward-auth), and maintains a control channel to atreoLINK. Members get provisioned via that control channel. atreoLINK relays signed messages between them and the agent, but the agent does all the verification itself.

If you want the deeper story before installing, read Encryption and Authentication.

Two paths

Use the built-in proxyEasiest. atreoAGENT serves HTTPS for every app on a wildcard cert, with built-in ACL enforcement. Recommended for most setups.

Use my existing reverse proxyAlready running Caddy, Traefik, or nginx? Disable the built-in proxy and use atreoAGENT's forward-auth endpoint for ACL checks.