A VM with Docker Compose

The default target, and the cheapest. The whole stack runs on one Linux server you rent, and the whole security model holds: the internal networks, the read-only containers, the database roles and Cerbos.

Note

The step-by-step guide comes with 0.1. This page describes the design; the changelog says what is built.

What you need

• A Linux VM with Docker Engine 28 or newer, local NVMe and enough memory for your data. What it costs sizes one for your data and questions, and How to deploy names servers that fit.
• A domain name pointing at the server.
• Somewhere off the server for backups, such as a Hetzner Storage Box.

How it will go

1. In your project, mb build builds its images and writes the compose configuration.
2. On the server, docker compose up -d starts the stack. Migrations apply themselves at start.
3. Caddy sits in front of the api and gets a TLS certificate for your domain.
4. Your secrets reach the containers from your secrets provider; secrets.yml names them, and mb secrets set stores them.
5. Merging to main deploys a change; your agent checks production read-only with mb verify.

The end-to-end test runs this path on every change, so it is the best tested of the targets.