# Self-hosting

The public workspace contains the standalone Core coordinator, node runtime,
CLI, SDK, DAP adapter, and VS Code extension. Self-hosting does not require the
private hosted website or Authentik integration.

Build the workspace, then start a coordinator with a protected bootstrap
session:

```bash
cargo build --workspace
DISASMER_SELF_HOSTED_SESSION_SECRET="$SELF_HOSTED_SESSION_SECRET" \
DISASMER_SELF_HOSTED_TENANT=my-team \
DISASMER_SELF_HOSTED_PROJECT=my-project \
DISASMER_SELF_HOSTED_USER=me \
  target/debug/disasmer-coordinator --listen 127.0.0.1:7999
```

The coordinator's native JSON-lines transport is deliberately loopback-only and
the server refuses a non-loopback listener. For administration from another
machine, use an authenticated SSH tunnel and connect to its local endpoint:

```bash
ssh -N -L 7999:127.0.0.1:7999 coordinator.example
```

Do not expose plaintext port 7999 to a network. The hosted service is the
reference HTTPS deployment shape: TLS reverse proxy to a loopback HTTP
application endpoint.

Connect a CLI without putting the secret in its process arguments:

```bash
printf '%s\n' "$SELF_HOSTED_SESSION_SECRET" | \
  disasmer auth connect-self-hosted \
    --coordinator 127.0.0.1:7999 \
    --tenant my-team --project-id my-project --user me \
    --session-secret-stdin
```

Create a scoped node enrollment grant, then attach nodes that advertise only the
host capabilities you intend to provide. Linux command/container environments
require rootless Podman on those nodes. Wasmtime execution itself is always part
of the runtime and is not an optional capability.

Configure `DATABASE_URL` for durable identity and project state. Active
processes and tasks are ephemeral in the MVP and end when the coordinator
restarts. Back up Postgres and any user-selected artifact destination; node-local
artifact retention is best effort.