Public release release-b8454b34d38c

Source commit: b8454b34d38cc2ba0bd278e842060db45d091e1c

Public tree identity: sha256:69d6c8143bf6227e1bb07852aa94e8af9c26793eca252bb46788894f728cb6d2

docs/self-hosting.md

@@ -0,0 +1,38 @@
+# Self-hosting
+
+Run the public coordinator and node runtime without the hosted website.
+
+## Start a strict local coordinator
+
+Supply one scoped bootstrap session through protected service configuration:
+
+~~~bash
+CLUSTERFLUX_SELF_HOSTED_SESSION_SECRET="$SELF_HOSTED_SESSION_SECRET" CLUSTERFLUX_SELF_HOSTED_TENANT=my-team CLUSTERFLUX_SELF_HOSTED_PROJECT=my-project CLUSTERFLUX_SELF_HOSTED_USER=me clusterflux-coordinator --listen 127.0.0.1:7999
+~~~
+
+Connect the CLI without placing the secret in a process argument:
+
+~~~bash
+printf '%s\n' "$SELF_HOSTED_SESSION_SECRET" | clusterflux auth connect-self-hosted   --coordinator 127.0.0.1:7999   --tenant my-team   --project-id my-project   --user me   --session-secret-stdin
+~~~
+
+The CLI verifies the scope before writing ".clusterflux/session.json". On Unix,
+the session file uses mode "0600".
+
+## Attach nodes
+
+Use the same enrollment and worker flow described in [Nodes](nodes.md), with
+"--coordinator 127.0.0.1:7999".
+
+## Network boundary
+
+The native coordinator transport is plaintext and refuses non-loopback
+listeners. For another machine, keep the coordinator on loopback and use an
+authenticated SSH tunnel or deploy a trusted TLS reverse proxy that enforces the
+same client boundary. Do not expose the native port directly.
+
+## Administration
+
+Project, node, process, task, log, artifact, debug, quota, and self-hosted admin
+operations remain available through the public CLI/API. Authentik is one hosted
+identity deployment, not a requirement for your coordinator.