michel/clusterflux-public
1
0
Fork 0
Code Issues Pull requests Projects Releases 21 Packages Wiki Activity Actions

Public dry run dryrun-20b59dc46b72

Browse source 
Source commit: 20b59dc46b72103c2f8a516c692b5cc3d54fab19

Public tree identity: sha256:aaa5ac7b58b2a0d23c6b11e5f76324bf3839ca1f62653a83deb736932adcfbd9
This commit is contained in:
Disasmer release dry run 2026-07-14 10:08:15 +02:00
commit 2bef715211
221 changed files with 79792 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

49
docs/self-hosting.md Normal file
View file

@ -0,0 +1,49 @@
# Self-hosting
The public workspace contains the standalone Core coordinator, node runtime,
CLI, SDK, DAP adapter, and VS Code extension. Self-hosting does not require the
private hosted website or Authentik integration.
Build the workspace, then start a coordinator with a protected bootstrap
session:
```bash
cargo build --workspace
DISASMER_SELF_HOSTED_SESSION_SECRET="$SELF_HOSTED_SESSION_SECRET" \
DISASMER_SELF_HOSTED_TENANT=my-team \
DISASMER_SELF_HOSTED_PROJECT=my-project \
DISASMER_SELF_HOSTED_USER=me \
target/debug/disasmer-coordinator --listen 127.0.0.1:7999
```
The coordinator's native JSON-lines transport is deliberately loopback-only and
the server refuses a non-loopback listener. For administration from another
machine, use an authenticated SSH tunnel and connect to its local endpoint:
```bash
ssh -N -L 7999:127.0.0.1:7999 coordinator.example
```
Do not expose plaintext port 7999 to a network. The hosted service is the
reference HTTPS deployment shape: TLS reverse proxy to a loopback HTTP
application endpoint.
Connect a CLI without putting the secret in its process arguments:
```bash
printf '%s\n' "$SELF_HOSTED_SESSION_SECRET" | \
disasmer auth connect-self-hosted \
--coordinator 127.0.0.1:7999 \
--tenant my-team --project-id my-project --user me \
--session-secret-stdin
```
Create a scoped node enrollment grant, then attach nodes that advertise only the
host capabilities you intend to provide. Linux command/container environments
require rootless Podman on those nodes. Wasmtime execution itself is always part
of the runtime and is not an optional capability.
Configure `DATABASE_URL` for durable identity and project state. Active
processes and tasks are ephemeral in the MVP and end when the coordinator
restarts. Back up Postgres and any user-selected artifact destination; node-local
artifact retention is best effort.