Minimal deployment — single host (docker compose)#

The cheapest way to actually run rackattack: the whole stack on one host via docker compose — the app, a secure single-node CockroachDB, and an edge TLS proxy — with no Kubernetes, no operator, no managed database, no load balancer. It’s a real secure small-prod posture for a homelab, colo, or small cloud, not a throwaway.

This is one of three deploy paths (see the Deployment chooser). The stack lives in deploy/compose/ and is authored in chant (TypeScript → compose.yaml).

Non-goal: host-loss survival. One host is one failure domain — this path protects against restarts, a wiped store, and bad migrations, not the box dying. To survive a node/AZ loss, take the single-region HA path (deploy/k8s/production). Upgrade is additive: same image, same config keys, same migrations — only the substrate changes.

Quick start#

cd deploy/compose
cp .env.example .env          # then set RACKATTACK_DB_PASSWORD + RACKATTACK_AUTH_HS256_SECRET
docker compose -f images.compose.yaml build
docker compose -p rackattack-minimal --env-file .env up -d

docker compose -p rackattack-minimal exec app rackattack fleet new --sites 1

Bring-up sequences itself: generate the CockroachDB CA + certs → start the secure node → create the database and non-root app user → migrate → start the app and Caddy. The web UI is at https://localhost/ui; the gRPC/REST APIs are behind the same edge over TLS.

Posture#

  • Auth on (HS256 shared secret, no IdP); RACKATTACK_ENV=production refuses to boot without auth + TLS.
  • DB over verify-full — the server cert is pinned to the generated CA.
  • Edge TLS via Caddy; the app’s internal ports aren’t published.
  • Least-privilege SQL user — owns its own database, not a cluster admin.

Persistence & backups#

CockroachDB’s store is a named volume, so restarts preserve the fleet. A backup sidecar takes a full BACKUP DATABASE into a separate volume on start and then daily (core BACKUP — no enterprise license). The tested restore drill (DROP DATABASE then RESTORE … FROM LATEST IN … as separate statements) and the full walkthrough are in docs/minimal-deployment.md.

Backward Deployment Observability Forward