# Self-hosting

Run the repository stack and configure public infrastructure explicitly.


## License and deployment

Everock's original SDK, CLI, dashboard and backend code use Apache 2.0. You can run and modify the platform on your own infrastructure. Third-party packages and reference assets retain their own licenses; see the repository's `LICENSE` and `NOTICE`.

Source availability does not mean the managed service is deployed or included. Self-hosting means operating your own services, storage, backups and updates.

## Components you operate

A self-hosted installation needs the web app, API, worker, PostgreSQL, and Redis. Replay additionally needs configured object storage or a supported local storage directory. The optional hosting/fleet features require their own node agents and infrastructure.

```bash title="Source checkout"
pnpm install
pnpm --filter @everock/web dev
pnpm --filter @everock/api dev
pnpm --filter @everock/worker dev
```

Start PostgreSQL and Redis and apply the repository migrations before expecting API or worker operations to succeed. Use the configuration examples shipped with the repository and your actual service addresses; these commands alone do not provision the database or public DNS.

## Public deployment

Set stable HTTPS web and API origins. Configure `PUBLIC_WEB_URL`, `PUBLIC_API_URL`, database/Redis addresses, and the server authentication/encryption secrets. Browser SDKs must use a collector URL reachable from their users' devices; `localhost` refers to each visitor's own machine.

A temporary tunnel can support development callbacks. It is not a production hosting solution or the same thing as CLI authorization.

## Dashboard authentication

The current web dashboard uses Supabase Auth. Configure `NEXT_PUBLIC_SUPABASE_URL` and `NEXT_PUBLIC_SUPABASE_ANON_KEY` for that auth project, including its permitted sign-in redirect URLs. These public client values are separate from any service-role storage secret used by the API.

The local recovery auth provider is explicitly development-only (`LOCAL_AUTH_ENABLED=1` with a strong `LOCAL_AUTH_SECRET`); it is unavailable when `NODE_ENV=production`. A production self-hosted deployment must configure the supported authentication provider rather than relying on the development session.

## Retention and storage

Production API configuration requires an explicit `EVENT_RETENTION_DAYS` policy. Replay retention defaults to seven days unless configured otherwise. Store backups, test restoration, secure the storage bucket, and preserve the encryption keys required to read saved credentials.

## Optional providers

GitHub App credentials enable repository integration. Resend enables the existing email delivery path. Missing optional providers should be shown as unconfigured, not as working features.

The self-hosted dashboard serves the same installation that its API and worker use. Connecting a separate hosted dashboard to arbitrary private collectors requires deliberate authentication and routing configuration; it is not automatic federation.