Self-Hosting Overview
AnvilBase is built to be self-hosted. The same Docker Compose stack you run locally runs in production (local = cloud), and an experimental Helm chart is provided for Kubernetes. This section is for operators.
Deployment options
| Option | Best for | Guide |
|---|---|---|
| Docker Compose | single-node, small/medium deployments, simplicity, production | Docker Compose |
| Kubernetes (Helm) | Experimental (Labs) — untested, not for production | Kubernetes |
Both run the identical set of services described in Architecture. For a provider-specific walk-through, see Infomaniak Public Cloud.
Before you deploy
- Generate strong, unique secrets for every credential (Configuration).
- Terminate TLS at Traefik and expose only the proxy (Network Security).
- Enable internal mTLS (
ANVILBASE_MTLS_ENABLED=true) once you span more than one host. - Encrypt the data volumes (LUKS / cloud volume encryption) — the platform DB is the crown jewel (Encryption).
- Set up backups (Backups & Restore) and, for tight RPO, PITR.
- Walk the full Production Checklist.
The operational surface
You run AnvilBase through four surfaces:
- The console (
:39004) — the human dashboard (below). - The CLI (
anvilbase) — scripts, CI, and day-to-day ops (CLI Reference). - The Management API (
/api/v1) — everything programmatically (Management API). - Health & metrics (
/health, logs) — Monitoring.
The console
The web console manages all projects on the deployment from one place. Its screens:
- Projects — create, switch between, and manage projects; per-project Overview / API / Auth / Users / Team tabs.
- Tables — visual table editor (CRUD, schema).
- SQL — SQL editor with results, saved queries, and history.
- RLS — visual policy builder with the test sandbox.
- Storage — object browser (upload/download/delete, signed URLs).
- Functions — edge-function editor, deploy, logs.
- Secrets — the per-project secrets vault.
- Users — auth users, sessions, bans.
- Queues — PGMQ inspector.
- Webhooks — endpoints and delivery history.
- Email — SMTP config and template editor.
- eIDAS — EU Digital Identity configuration.
- Audit — searchable audit log with export.
- Backups — backup/restore.
- Health — per-service status dashboard.
Operational day-to-day
| Task | Where |
|---|---|
| Provision a project | console / anvilbase projects create |
| Apply schema changes | Migrations / anvilbase deploy |
| Rotate a compromised key | API Keys → Rotation |
| Take/restore a backup | Backups & Restore |
| Upgrade the platform | Upgrades |
| Investigate an incident | Audit Logs + Monitoring |
| Recover from failure | Disaster Recovery |
| Add capacity | Scaling |
Resource footprint
The built-in REST engine means per-project overhead is tiny (~2–5 MB), so a single modest node can host many projects. Plan capacity around Postgres connections and storage rather than per-project containers — see Scaling.
Next: Docker Compose.