DocsSelf-hosting

Self-hosting

Nothing in the architecture assumes our cloud: the chain, the policy engine, tenancy and approvals run from one container against one volume, built on Node builtins. The only outbound calls are the anchors you enable — which is the point of them.

Run it

deploy/self-host
cd deploy/self-host
cp .env.example .env                 # keys, log id, anchors — all commented
openssl rand -hex 32                 # → AUDITANT_API_KEYS
mkdir -p data
openssl ecparam -genkey -name prime256v1 -noout -out data/signing.pem

docker compose up -d --build
curl localhost:4319/health

Point the SDKs' endpoint and the dashboard's AUDITANT_API at it, and terminate TLS with whatever you already run — the container speaks plain HTTP on 4319 and never needs to be public.

What to protect

The volume is the evidence — back it up like the record it is; append-only is enforced by triggers inside SQLite, not process discipline. The signing key must survive restarts — checkpoints signed before a restart can only be extended by the key that signed them. Anchors are what make it evidence to outsiders: RFC 3161 costs nothing and is on by default; the S3 Object Lock copy (a bucket in your account, lock enabled at creation) survives even you.

Verify it behaves like the hosted one

curl -s "localhost:4319/v1/export?log=yourco%2Fprod" -H "authorization: Bearer $KEY" -o bundle.json
node -e "const b=require('./bundle.json');require('fs').writeFileSync('verify.mjs',b.verifier)"
node verify.mjs bundle.json

Upgrades are git pull && docker compose up -d --build. The volume carries the chain across image changes — a deploy replaces the process, never the evidence.