2bef715211
Source commit: 20b59dc46b72103c2f8a516c692b5cc3d54fab19 Public tree identity: sha256:aaa5ac7b58b2a0d23c6b11e5f76324bf3839ca1f62653a83deb736932adcfbd9
49 lines
1.8 KiB
Markdown
49 lines
1.8 KiB
Markdown
# Self-hosting
|
|
|
|
The public workspace contains the standalone Core coordinator, node runtime,
|
|
CLI, SDK, DAP adapter, and VS Code extension. Self-hosting does not require the
|
|
private hosted website or Authentik integration.
|
|
|
|
Build the workspace, then start a coordinator with a protected bootstrap
|
|
session:
|
|
|
|
```bash
|
|
cargo build --workspace
|
|
DISASMER_SELF_HOSTED_SESSION_SECRET="$SELF_HOSTED_SESSION_SECRET" \
|
|
DISASMER_SELF_HOSTED_TENANT=my-team \
|
|
DISASMER_SELF_HOSTED_PROJECT=my-project \
|
|
DISASMER_SELF_HOSTED_USER=me \
|
|
target/debug/disasmer-coordinator --listen 127.0.0.1:7999
|
|
```
|
|
|
|
The coordinator's native JSON-lines transport is deliberately loopback-only and
|
|
the server refuses a non-loopback listener. For administration from another
|
|
machine, use an authenticated SSH tunnel and connect to its local endpoint:
|
|
|
|
```bash
|
|
ssh -N -L 7999:127.0.0.1:7999 coordinator.example
|
|
```
|
|
|
|
Do not expose plaintext port 7999 to a network. The hosted service is the
|
|
reference HTTPS deployment shape: TLS reverse proxy to a loopback HTTP
|
|
application endpoint.
|
|
|
|
Connect a CLI without putting the secret in its process arguments:
|
|
|
|
```bash
|
|
printf '%s\n' "$SELF_HOSTED_SESSION_SECRET" | \
|
|
disasmer auth connect-self-hosted \
|
|
--coordinator 127.0.0.1:7999 \
|
|
--tenant my-team --project-id my-project --user me \
|
|
--session-secret-stdin
|
|
```
|
|
|
|
Create a scoped node enrollment grant, then attach nodes that advertise only the
|
|
host capabilities you intend to provide. Linux command/container environments
|
|
require rootless Podman on those nodes. Wasmtime execution itself is always part
|
|
of the runtime and is not an optional capability.
|
|
|
|
Configure `DATABASE_URL` for durable identity and project state. Active
|
|
processes and tasks are ephemeral in the MVP and end when the coordinator
|
|
restarts. Back up Postgres and any user-selected artifact destination; node-local
|
|
artifact retention is best effort.
|