deploy

Guides — Deploy — get authserver running in your environment

Audience: Operators. You already know what an OAuth Authorization Server is; you want uptime, a clean security posture, working observability, predictable rotation, and a backup story. These recipes are the shortest path from "container image" to "production".

What you'll find here

• Recipes, not concepts. Each page has a verifiable [Verify] step and a [What can go wrong] table. Concept context lives in docs/concepts/.
• Verified references. Every env var, YAML key, and CLI flag links to the generated reference under docs/reference/. If a doc and the source disagree, the source wins — file a bug.
• Reproducible artifacts. Compose files live at deploy/; the Helm chart lives at charts/authplane/. Recipes point at those files, not inline copies.

Reading order

1. Configuration — operator prose for the knobs that matter in production. Pick storage, signing-key store, and data-encryption driver here, before you copy a recipe.
2. Pick a deploy target:
   • Docker Compose — single-host, three flavors (SQLite, Postgres+LGTM, Postgres+Vault).
   • systemd — single Linux host, single binary, Caddy/nginx in front.
   • Kubernetes — overview + decision tree (Helm vs raw vs kind).
     • Helm — recommended production path.
     • Raw manifests — for GitOps without Helm.
     • kind — local end-to-end on your laptop.
3. HashiCorp Vault Transit — delegate signing keys (and optionally data-at-rest encryption) to Vault.
4. Observability — Prometheus + OpenTelemetry — scrape config, OTLP, suggested alerts.
5. Backup & purge — authserver purge schedule + DB/keys backup. Day-2 not-optional.
6. Hardened deployment — production-posture knobs (oauth.require_scope, session.fail_closed, …): what each defaults to, the trade-off, and the env var to flip.

Cross-cutting rules

• Issuer URL (server.issuer, env-vars.md#AUTHPLANE_SERVER_ISSUER) must equal the public URL clients reach. No trailing slash. Validation flips when this is not localhost — see configuration.md.
• Admin port (:9001) hosts the Admin API, the Admin UI at /admin/ui/, and /metrics. Never expose it on the public internet. Keep it on loopback, an internal subnet, or behind a separate ingress with an IP allowlist.
• authserver purge is not automatic. Schedule it (systemd timer, CronJob, sidecar). See backup-and-purge.md. Skip this and your DB grows unbounded.
• Health is GET /health on the public port; metrics are GET /metrics on the admin port. Both are documented in http-api.md.

Related

• Operate — day-2 tasks (key rotation, audit log, admin CLI).
• Topologies — named shapes (Side-by-Side AS, Vault-backed AS, HA-Postgres).
• Reference — generated schemas: config, env vars, CLI, HTTP API.