Self-Hosting RunEnv

RunEnv can be self-hosted inside your own infrastructure when you need customer-managed boundaries, regional control, or a non-SaaS deployment model.

Quickstart

From the repository root:

python3 run_deploy.py --self-host-bootstrap

Preview the exact steps without executing them:

python3 run_deploy.py --self-host-bootstrap --dry-run

Use a public hostname when needed:

python3 run_deploy.py --self-host-bootstrap \
  --self-host-domain vault.example.com \
  --self-host-admin-email [email protected]

The bootstrap flow:

  1. Generates .env.self-host with secure defaults
  2. Starts PostgreSQL and Redis
  3. Builds the frontend container from docker-compose.prod.yml
  4. Runs npx prisma migrate deploy
  5. Starts the frontend and verifies that /login responds

This path does not use prisma db push in production.

Runtime Requirements

  • Docker with docker compose
  • A reverse proxy or load balancer for public HTTPS exposure
  • Optional SMTP for invite, recovery, and notification flows

Compose Model

services:
  db:
    image: postgres:16-alpine
  redis:
    image: redis:7-alpine
  frontend:
    build:
      context: .
      dockerfile: runenv-frontend/Dockerfile

The generated .env.self-host drives the stack. The compose file exposes the frontend on RUNENV_PORT and expects TLS termination to happen outside the container stack.

Post-Bootstrap Admin Sequence

After the stack is healthy and the first admin signs in:

  1. Open the organization Security & KMS tab
  2. Review the Self-Hosted Quickstart readiness panel
  3. Configure an external KMS provider
  4. Verify a company domain
  5. Configure SSO
  6. Create and validate a SCIM provisioning token
  7. Generate a compliance evidence export

The checklist describes operational readiness only. It does not claim legal, regulatory, or audit certification.

KMS Options

RunEnv supports:

  • AWS KMS with stored access keys
  • AWS KMS with attached IAM role or workload identity
  • GCP Cloud KMS with uploaded service-account JSON
  • GCP Cloud KMS with Application Default Credentials

If an organization is still using only the local master key, secrets remain operational, but the deployment is marked as not compliance-ready.