Operating it
This section is for the person who runs the server. Hatamoto is one program plus a Postgres database, so running it in production comes down to a few decisions: how the process is started (Docker or systemd), which reverse proxy handles HTTPS in front of it, which settings you give it, and how you back up the database and the files next to it.
If you are setting up a server for the first time, work through the guides in order, starting with a deployment. Come back to the reference pages when you need a specific setting, command or health check. Updates and rollback have their own section, How updates work, and how the parts fit together is described in Architecture.
Guides
- Deploy with Docker
Turn the Docker demo stack into a production setup with a real database password, a secret, your domain and only the proxy able to reach it.
- Deploy with systemd
Run Hatamoto as a systemd service on a Linux server, with its own user, an environment file and the unit the project ships.
- Reverse proxy and TLS
Serve your site over HTTPS by putting Caddy or nginx in front of Hatamoto, with the forwarded headers and public address set correctly.
- Backups
Back up and restore a site with one command, or by hand: the database, the server secret and uploaded media, in the right order, and test the restore before you need it.
- Hardening
Go through the production checklist before you open your site to the internet: settings, secrets, headers, plugins, files and outbound calls.
- Email
Connect Hatamoto to an SMTP server so password resets, invitations and form notifications reach people, then send a test message.
Reference
- Configuration reference
Every environment variable Hatamoto reads, with its default and meaning, plus the files, headers and email behaviour they control.
- Command-line reference
Every hatamoto command and flag, from running the server to users, content, redirects, packages, API keys and updates.
- Replicas and health
What is shared and what is per process when several Hatamoto processes use one database, the worker switches and the health endpoints.
- Outbound connections
Every network call a Hatamoto server makes on its own or on your behalf, what it sends, when it runs and how to turn it off.
- Security policy
How to report a vulnerability in Hatamoto privately, what happens after you report it, and which versions get security fixes.