Skip to main content

Installation

Requirements​

Docker. Nothing else to install; Node ≥ 22 and pnpm as well if you work on the code.

Guided install​

git clone https://git.cythin.eu/cythin/kastell.git
cd kastell
sh outils/installer.sh

The script asks the questions whose answer cannot be guessed — port, public address, environment, video conferencing, antivirus scanning, notification relay — writes .env drawing every secret at random, then brings up the composition and waits for the instance to answer.

An existing .env is never overwritten without your say-so: the script offers to keep it as it stands, or to save it alongside before writing a new one. That file may hold the secrets of an instance in service.

Why it calls neither pnpm nor node

The artifact is built inside the image, and migrations are run by the application as it starts. Requiring a Node toolchain on the host to bring up six containers would add a prerequisite the operator would never use afterwards.

The Apple key is not typed at a prompt

The script never asks for the notification relay's .p8 key: typed at a prompt, it would stay in the shell history and in the terminal buffer. It goes into .env, by hand.

Three commands, with pnpm​

git clone https://git.cythin.eu/cythin/kastell.git
cd kastell
pnpm install
pnpm demarrer

pnpm demarrer brings up PostgreSQL, Redis, MinIO, LiveKit, egress and ClamAV, builds the artifact and stamps it with its git revision. It also prepares .env: it creates the file if missing, adds keys that have appeared since, and draws secrets at random — without ever touching a value you have already set.

The interface and the API are served by the same artifact, on the same port: http://localhost:8080.

One port, one origin

The session cookie therefore never has a boundary to cross, and the self-hoster has no reverse proxy to assemble before the application works.

Creating the first account​

  1. On http://localhost:8080, "Create a workspace". Your address, your password — nobody else sees them.
  2. Then, on the command line:
pnpm amorcer-root your@address.com "Bootstrapping the instance."

The root console then appears in the rail.

This step needs the Node toolchain

amorcer-root does not travel inside the image. If you installed through outils/installer.sh with no Node on the host, this one command needs Node ≥ 22 and pnpm.

The order is not arbitrary

amorcer-root does not create an account: it grants a right to an existing one. A script that created the account would have to choose a password, and so write it down somewhere. The root right goes to an account born of the normal sign-up path.

This script only works on a virgin instance. As soon as a root exists, granting goes through the console and leaves a named trace.

Emails do not leave​

In development the transport is console: verification, sign-in, invitation and call-out links are written in clear text to the logs.

pnpm logs

Checking that it works​

pnpm verif

More than six hundred guarantees, run against a dedicated database (…_verif, created as needed) which is never your development one. See Verifying.

Without Docker​

If you already have PostgreSQL, Redis and S3-compatible storage:

cp .env.example .env      # fill in the values
pnpm migrate
pnpm dev                  # API on 8080, interface on 5173 with hot reload