Self-Hosting RunEnv
RunEnv can be self-hosted inside your own infrastructure when you need customer-managed boundaries, regional control, or a non-SaaS deployment model.
Quickstart
From the repository root:
python3 run_deploy.py --self-host-bootstrapPreview the exact steps without executing them:
python3 run_deploy.py --self-host-bootstrap --dry-runUse a public hostname when needed:
python3 run_deploy.py --self-host-bootstrap \
--self-host-domain vault.example.com \
--self-host-admin-email [email protected]The bootstrap flow:
- Generates
.env.self-hostwith secure defaults - Starts PostgreSQL and Redis
- Builds the frontend container from
docker-compose.prod.yml - Runs
npx prisma migrate deploy - Starts the frontend and verifies that
/loginresponds
This path does not use prisma db push in production.
Runtime Requirements
- Docker with
docker compose - A reverse proxy or load balancer for public HTTPS exposure
- Optional SMTP for invite, recovery, and notification flows
Compose Model
services:
db:
image: postgres:16-alpine
redis:
image: redis:7-alpine
frontend:
build:
context: .
dockerfile: runenv-frontend/DockerfileThe generated .env.self-host drives the stack. The compose file exposes the frontend on RUNENV_PORT and expects TLS termination to happen outside the container stack.
Post-Bootstrap Admin Sequence
After the stack is healthy and the first admin signs in:
- Open the organization
Security & KMStab - Review the
Self-Hosted Quickstartreadiness panel - Configure an external KMS provider
- Verify a company domain
- Configure SSO
- Create and validate a SCIM provisioning token
- Generate a compliance evidence export
The checklist describes operational readiness only. It does not claim legal, regulatory, or audit certification.
KMS Options
RunEnv supports:
- AWS KMS with stored access keys
- AWS KMS with attached IAM role or workload identity
- GCP Cloud KMS with uploaded service-account JSON
- GCP Cloud KMS with Application Default Credentials
If an organization is still using only the local master key, secrets remain operational, but the deployment is marked as not compliance-ready.