Run Vardum yourself.

One Compose file, your database, your bucket. MIT licensed.

compose.production.yml

clients              ┌╌ your server ╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┐                       
╭─ app ────────╮     ╎                                                  ╎                       
│ browser      ├──╮  ╎                                                  ╎                       
╰──────────────╯  │  ╎   ╭─ gateway ─────╮     ╭─ api ──────────────╮   ╎    ╭─ your bucket ───╮
                  ├─────>│ nginx  :8080  ├────>│ versions, vards,   ├───────>│ any S3 API      │
╭─ cli ────────╮  │  ╎   ╰───────────────╯     │ signed delivery    │   ╎    │ originals/      │
│ npx vardum   ├──┤  ╎                         ╰──────────┬─────────╯   ╎    │ derived/        │
╰──────────────╯  │  ╎                                    │             ╎    ╰─────────────────╯
                  │  ╎                                    │             ╎          ^       ^    
╭─ mcp ────────╮  │  ╎                                    v             ╎          │       │    
│ agents       ├──┤  ╎   ╭─ worker ──────╮     ╭─ postgres ─────────╮   ╎          │       │    
╰──────────────╯  │  ╎   │ ingest,       │<────┤ row-level security │   ╎          │       │    
                  │  ╎   │ sha-256 check │     │ job queue          │   ╎          │       │    
╭─ site ───────╮  │  ╎   ╰───────┬───────╯     ╰────────────────────╯   ╎          │       │    
│ <img src>    ├──┤  ╎           │                                      ╎          │       │    
╰──────────────╯  │  ╎           ╰─────────────────────────────────────────────────╯       │    
                  │  ╎                                                  ╎                  │    
                  │  └╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┘                  │    
                  │                                                                        │    
                  ╰──────────────────── presigned POST ────────────────────────────────────╯    
                                                                                                
1 request  the API signs an upload              2 upload   bytes skip your server               
3 ingest   the worker checks sha-256            4 deliver  302 to the current version

clients                                 
╭─ app ─╮ ╭─ cli ─╮ ╭─ mcp ─╮ ╭─ site ╮ 
╰───┬───╯ ╰───┬───╯ ╰───┬───╯ ╰───┬───╯ 
    ╰─────────┴────┬────┴─────────┴───╮ 
                   │                  │ 
  ┌╌ your server ╌╌│╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┐  │ 
  ╎                v               ╎  │ 
  ╎  ╭─ gateway ─────────────────╮ ╎  │ 
  ╎  │ nginx  :8080              │ ╎  │ 
  ╎  ╰─────────────┬─────────────╯ ╎  │ 
  ╎                v               ╎  │ 
  ╎  ╭─ api ─────────────────────╮ ╎  │ 
  ╎  │ versions, vards,          │ ╎  │ 
╭────┤ signed delivery           │ ╎  │ 
│ ╎  ╰──────┬────────────────────╯ ╎  │ 
│ ╎         │                      ╎  │ 
│ ╎         v                      ╎  │ 
│ ╎  ╭─ postgres ─╮   ╭─ worker ─╮ ╎  │ 
│ ╎  │ rls, jobs  ├──>│ sha-256  │ ╎  │ 
│ ╎  ╰────────────╯   ╰─────┬────╯ ╎  │ 
│ ╎                         │      ╎  │ 
│ └╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌│╌╌╌╌╌╌┘  │ 
│                           │         │ 
│                           v         │ 
│ ╭─ your bucket ───────────────────╮ │ 
╰>│ any S3 API                      │<╯ 
  │ originals/  derived/            │   
  ╰─────────────────────────────────╯   
                                        
1 request  the API signs an upload      
2 upload   bytes skip your server       
3 ingest   the worker checks sha-256    
4 deliver  302 to the current version

What you need

`Docker`	With Compose
`A bucket`	S3-compatible, with presigned POST and CORS, reachable by browsers. Or the bundled RustFS.
`A proxy`	For TLS. It must pass the original Host header through.
`SMTP`	For email verification, which the default allowlist requires, plus invitations and password recovery.

Quick start

Replace every secret and fill in your bucket first.

$ cp .env.production.example .env.production
$ docker compose --env-file .env.production \
    -f compose.production.yml up -d --build --wait
$ curl --fail http://localhost:8080/ready

Five services and an optional store.

`gateway`	nginx. Serves the app, proxies /api, /w and /v.
`api`	Versions, Vards, signed delivery and transforms.
`worker`	Checks uploads and prunes old delivery events.
`postgres`	Row-level security per workspace, a limited runtime role.
`migrate`	Prepares the schema, then exits.
`rustfs`	Optional bundled object store, behind --profile rustfs.

Configuration

Everything lives in .env.production. The example is written for Hetzner Object Storage and shows Amazon S3 beside it.

`APP_URL`	Public URL of your install
`POSTGRES_PASSWORD`	Administrator and migrator
`POSTGRES_APP_PASSWORD`	Runtime role for the API and worker
`BETTER_AUTH_SECRET`	Signs sessions
`TRANSFORM_SECRET`	Signs variant URLs
`S3_*`	Bucket, region, endpoints and a key scoped to the bucket
`ORGANIZATION_CREATION`	allowlist, open or disabled
`CUSTOM_DOMAIN_TARGET`	The hostname custom domains point at
`SMTP_*`	Your mail provider, if any

Built to be operated.

/health and /ready for your load balancer
Backup, restore and upgrade procedures
Dokploy templates for Traefik setups
A disposable fresh-install smoke test

Point the CLI and agents at it.

vardum init asks for your server URL. The MCP server takes --server or VARDUM_SERVER.

Start with one logo.

Start your own instance, upload it, map it into a repository, and pull.

Get started View on GitHub

npm i -D -E @vardum/cli