Deployment

CMDOP follows a two-plane model: a cloud account that provisions a relay for you (the default), and a self-hosted relay plane you run yourself (a scoped option). See Pricing & editions for the full breakdown.

What deployment options are available?

How do I get started with a cloud account?

Creating a free cmdop.com account  provisions your own isolated relay — you don’t run anything beyond installing the signed binary on your machines. This is the default, shipping path.

How do I self-host the relay?

Prefer to run the relay plane yourself? Your cmdop.com account still handles identity and provisioning; you take over operating the relay on your own infrastructure:

• Docker — Docker Compose (the recommended path)
• Self-host the relay — the relay plane, env-var config, TLS at your proxy
• Kubernetes — cluster deployment for scale

What you get:

• The relay plane runs on your infrastructure
• Custom network configuration
• Full control over the data plane

What are the system requirements?

What does a single-node deployment need?

A single box (≤ ~50 agents) runs the whole stack comfortably on:

What database is required?

PostgreSQL 16 (the OSS Compose ships postgres:16-alpine). At scale, move to managed Postgres (RDS / Cloud SQL / Aiven) with connection pooling.

What Redis version is needed?

Redis 7 (the OSS Compose ships redis:7-alpine) for the token cache, brute-force counters, the arq queue, the tunnel registry, and PTY output buffers.

What is the deployment architecture?

The self-hosted server is a multi-process Python stack sharing one Postgres and one Redis, not a single binary:

• grpc_server (:50051) — the live relay: the bidi agent stream that routes terminal I/O.
• api_server (:8000) — the REST control plane: auth, fleets, members, schedules, tunnels, API keys, session metadata.
• worker — the async queue for cleanup crons and the schedule executor.
• Postgres + Redis — shared state. The agent stream never blocks on Redis.

(A tunnel_server, a ws_gateway for browser realtime push, and an optional jarvis_server round out the full product.)

What ports does CMDOP use?

How is the deployment secured?

How is TLS configured?

The self-host Compose ships plain HTTP / h2c by design. You terminate TLS at a reverse proxy in front of the stack (Caddy, Traefik, or Nginx) — gRPC reaches grpc_server over h2c:// on the upstream while the proxy handles the public TLS. mutual-TLS relay↔agent is not built in. See the self-hosted guide for the Traefik file-provider example.

How does authentication work?

• OAuth / CLI-token login for users (cmdop_<...> tokens)
• Long-lived API keys for SDK/agents (cmdop_apikey_<...>)
• Postgres row-level security (RLS) enforces multi-tenant isolation, CI-gated via audit-rls

What are the network requirements?

• Agents initiate outbound connections only
• No inbound ports on agents
• The server needs reachable public (or VPN-internal) access for api_server and grpc_server

What should I do next?