clusterflux-public/docs/self-hosting.md

Self-hosting

The public workspace contains the standalone Core coordinator, node runtime, CLI, SDK, DAP adapter, and VS Code extension. Self-hosting does not require the private hosted website or Authentik integration.

Build the workspace, then start a coordinator with a protected bootstrap session:

cargo build --workspace
DISASMER_SELF_HOSTED_SESSION_SECRET="$SELF_HOSTED_SESSION_SECRET" \
DISASMER_SELF_HOSTED_TENANT=my-team \
DISASMER_SELF_HOSTED_PROJECT=my-project \
DISASMER_SELF_HOSTED_USER=me \
  target/debug/disasmer-coordinator --listen 127.0.0.1:7999

The coordinator's native JSON-lines transport is deliberately loopback-only and the server refuses a non-loopback listener. For administration from another machine, use an authenticated SSH tunnel and connect to its local endpoint:

ssh -N -L 7999:127.0.0.1:7999 coordinator.example

Do not expose plaintext port 7999 to a network. The hosted service is the reference HTTPS deployment shape: TLS reverse proxy to a loopback HTTP application endpoint.

Connect a CLI without putting the secret in its process arguments:

printf '%s\n' "$SELF_HOSTED_SESSION_SECRET" | \
  disasmer auth connect-self-hosted \
    --coordinator 127.0.0.1:7999 \
    --tenant my-team --project-id my-project --user me \
    --session-secret-stdin

Create a scoped node enrollment grant, then attach nodes that advertise only the host capabilities you intend to provide. Linux command/container environments require rootless Podman on those nodes. Wasmtime execution itself is always part of the runtime and is not an optional capability.

Configure DATABASE_URL for durable identity and project state. Active processes and tasks are ephemeral in the MVP and end when the coordinator restarts. Back up Postgres and any user-selected artifact destination; node-local artifact retention is best effort.