Operate overview

TL;DR — One Go binary, three deployment shapes. Standalone binary for a single Linux host. Docker Compose for single-host with Postgres and a reverse proxy. Kubernetes (Helm) for HA, multi-replica, production. Same binary in every mode; the only real choice is your infrastructure. This page is the picker.

The deployment matrix

Mode	Best for	Storage	Signing keys	HA-ready	Effort
Single binary (`docker run`)	Local dev, demos, evaluating AuthPlane	SQLite (on-disk)	Auto-generated keyfile	No	One command
Standalone binary + systemd	Small VPS, on-prem single host, air-gapped	SQLite or Postgres	Keyfile or Vault Transit	If Postgres	~15 min
Docker Compose	Single host with Postgres, dev/staging, on-prem	SQLite or Postgres	Keyfile	If Postgres	~10 min
Kubernetes (Helm)	Production, multi-replica HA, regulated environments	Postgres (subchart or external)	Vault Transit recommended	✓	Chart + values

Every mode uses the same authplane/authserver:latest container image (or the equivalent binary — the Docker image is a distroless wrapper around the Go binary). Config precedence is identical: defaults → YAML file → env vars.

The 30-second picker

Just trying it out → docker run authplane/authserver:latest serve — SQLite + auto keys, zero config. Not this page’s territory; go to Quickstart.
One Linux server, no Kubernetes → Standalone binary with systemd + reverse proxy.
One Linux server, prefer containers → Docker Compose — SQLite or Postgres, optional Caddy for TLS.
Kubernetes cluster, need HA → Kubernetes (Helm) with the OCI-published chart.
Any of the above but with HSM-grade signing → add HashiCorp Vault Transit — works across all three.

Common requirements across all modes

Regardless of shape, these apply:

Session secret and admin API key — generate with openssl rand -hex 32. Boot fails when server.issuer is not localhost and these are missing.
Public issuer URL over HTTPS — reverse proxy or ingress terminating TLS in front of :9000.
Admin port :9001 not exposed publicly — internal network only, or behind IP allowlist.
PostgreSQL for multi-instance — SQLite doesn’t support concurrent writers across replicas.
Vault Transit for multi-replica signing — keyfile requires a shared PVC (ReadWriteMany); Vault avoids the problem entirely by keeping keys server-side.
Scheduled authserver purge — expired tokens, DPoP nonces, and assertion JTIs aren’t cleaned by serve. Schedule externally (systemd timer, k8s CronJob, or docker sidecar). See Backup, upgrade, purge.

Storage: SQLite vs Postgres

	SQLite	PostgreSQL
Setup	Zero — auto-created on first boot	Requires external DB + `authserver migrate` on first start
Concurrent readers	✓ (WAL mode)	✓
Concurrent writers across instances	✗	✓
Cross-instance config propagation	30 s polling (in-memory cache tick)	Milliseconds via `LISTEN/NOTIFY`
Backup	File copy while stopped, or `.backup` while running	`pg_dump`
Recommended for	Single instance, dev, evaluating	Production, HA, multi-instance

The 30-second SQLite propagation window matters mostly during initial bring-up (creating resources, rotating keys) — steady-state it’s invisible.

Signing keys: keyfile vs Vault Transit

	Keyfile	Postgres key store	Vault Transit
Setup	Auto-generated on boot; PEM files in `signing.key_path`	Keys stored in the Postgres DB with encryption at rest	External Vault + Transit engine + auth (token or AppRole)
Multi-instance safe	Requires shared PVC (`ReadWriteMany`)	✓ (propagates via `LISTEN/NOTIFY`)	✓ (Vault is the shared store)
Private keys on disk	✓ (PEM under `key_path`)	Encrypted in DB (not plaintext on disk)	✗ — signing happens in Vault
Rotation	`authserver admin key rotate`	Same	Same, via Vault
Compliance	Fine for most	Good for regulated storage	Best for HSM-grade / FIPS

Details in Security: Key management and Operate: Vault Transit.

What every mode ships

Regardless of how you deploy:

Public OAuth endpoints on :9000 — /oauth/authorize, /oauth/token, /oauth/register, /oauth/revoke, /oauth/introspect
Discovery on :9000 — /.well-known/oauth-authorization-server, /.well-known/openid-configuration, /.well-known/jwks.json
Health on :9000/health and :9000/ready
Admin API + Admin UI on :9001 — clients, users, resources, providers, grants, issuances, signing keys, audit
Structured logs (slog), Prometheus metrics on :9001/metrics (admin port), optional OpenTelemetry traces + metrics OTLP
Signing-key rotation via SIGHUP (kill -HUP <pid> / docker kill -s HUP / POST /admin/keys/rotate)

Choose your mode

Standalone binary — systemd unit, dedicated user, PEM keyfile, reverse proxy notes
Docker Compose — SQLite and Postgres compose files, Caddy TLS example, backup + upgrade
Kubernetes (Helm) — chart install, values files, ingress split (public + admin), OIDC in values, Vault Transit, observability wiring, Kind for local testing
HashiCorp Vault Transit — HSM-grade signing across any of the above
Backup, upgrade, purge — data lifecycle across all modes

Configuration reference — every knob for every section
Security: Threat model — trust boundaries and 16 named threats
Guides: Monitoring — Prometheus + OTEL wiring end to end