Skip to main content

​
Download

For an ARM64 server, replace amd64 with arm64. Use latest.txt rather than hard-coding a version; it contains the current version string, and the tarball path includes that version.

​
Generate keys

Prints an env-format bundle:
Treat the bundle as the crown jewels and keep it off terminal scrollback and shell history. Redirect it straight to a root-only file: custoscp gen-keys > /root/custos-keys && chmod 600 /root/custos-keys. Losing CUSTOS_MASTER_KEY means losing every stored secret.

​
Configure

The control plane reads everything from process environment variables and does not load .env files itself. Supply them through your shell, service manager, or deployment platform. Minimum:
  • CUSTOS_DATABASE_URL
  • CUSTOS_LISTEN_ADDR
  • CUSTOS_MASTER_KEY, CUSTOS_SIGNING_PRIVATE_KEY, CUSTOS_SERVER_TRANSPORT_PRIVATE_KEY
Full annotated list in Configuration.

​
Migrate and seed

migrate up creates the schema and is required before create-admin. create-admin prints a generated password unless you pass --password. Both accept --database-url if you would rather not set CUSTOS_DATABASE_URL in the environment. Migrations are embedded in the binary, so the binary and its schema always ship together.

​
Run

For a production deployment, run it under systemd with secrets in the encrypted credential store — see Running under systemd.

​
Health endpoints

Point your load balancer at /readyz and your process supervisor at /livez.