Deployment

CMDOP follows a two-plane model: a self-hosted open-source edition you run yourself (shipping today), and a managed cloud edition we run for you (planned). See Pricing & editions for the full breakdown.

What deployment options are available?

How do I self-host CMDOP?

Self-hosting is the real, shipping product. You run the open-source server stack on your own infrastructure:

• Docker — Docker Compose (the recommended path)
• Self-Hosted Guide — the open-source stack, env-var config, TLS at your proxy
• Kubernetes — cluster deployment for scale

What you get:

• Data stays on your infrastructure
• Custom network configuration
• No external dependencies — run it air-gapped if you want
• Full control, no enforced caps

What about the managed cloud?

What are the system requirements?

What does a single-node deployment need?

A single box (≤ ~50 agents) runs the whole stack comfortably on:

What database is required?

PostgreSQL 16 (the OSS Compose ships postgres:16-alpine). At scale, move to managed Postgres (RDS / Cloud SQL / Aiven) with connection pooling.

What Redis version is needed?

Redis 7 (the OSS Compose ships redis:7-alpine) for the token cache, brute-force counters, the arq queue, the tunnel registry, and PTY output buffers.

What is the deployment architecture?

The open-source server is a multi-process Python stack sharing one Postgres and one Redis, not a single binary:

• grpc_server (:50051) — the live relay: the bidi agent stream that routes terminal I/O.
• api_server (:8000) — the REST control plane: auth, fleets, members, schedules, tunnels, API keys, session metadata.
• worker — the async queue for cleanup crons and the schedule executor.
• Postgres + Redis — shared state. The agent stream never blocks on Redis.

(A tunnel_server, a ws_gateway for browser realtime push, and an optional jarvis_server round out the full product.)

What ports does CMDOP use?

How is the deployment secured?

How is TLS configured?

The open-source Compose ships plain HTTP / h2c by design. You terminate TLS at a reverse proxy in front of the stack (Caddy, Traefik, or Nginx) — gRPC reaches grpc_server over h2c:// on the upstream while the proxy handles the public TLS. mutual-TLS relay↔agent is not built in. See the self-hosted guide for the Traefik file-provider example.

How does authentication work?

• OAuth / CLI-token login for users (cmdop_<...> tokens)
• Long-lived API keys for SDK/agents (cmdop_apikey_<...>)
• Postgres row-level security (RLS) enforces multi-tenant isolation, CI-gated via audit-rls

What are the network requirements?

• Agents initiate outbound connections only
• No inbound ports on agents
• The server needs reachable public (or VPN-internal) access for api_server and grpc_server

What should I do next?