Skip to content

Docs · Self hosted

One script, signed images, no surprises

A production instance never builds from source. It pulls three prebuilt images per release, each signed by the release pipeline, orchestrated by one operator script that verifies the signatures itself.

The deployment model

  • One instance is one customer. Isolation is a deployment boundary; there is no multi tenant mode.
  • Pull only: the app and worker image, the edge image with the built interface, and the receive only inbound mail service, each cosign signed.
  • Secrets are generated per instance and required by the compose file; nothing is committed.
  • Everything is orchestrated by one operator script: install, configure, upgrade, status, and a dry run mode. It ends every run with a checklist of what it cannot do for you: DNS records, backup settings, verification steps.

Before you start

  • A fresh Ubuntu 22.04 or 24.04 instance.
  • A domain you control; TLS is automatic through Let's Encrypt as soon as the printed DNS records resolve.
  • A model API key, unless the instance will run local models only.
  1. 1

    Fetch the operator script

    The script installs its own tooling, including cosign for signature verification.

    curl -fsSL https://raw.githubusercontent.com/Cogeto/cogeto/main/scripts/operator/cogeto -o cogeto
chmod +x cogeto
  2. 2

    Dry run first

    The check mode validates the environment and prints what install would do, without changing anything.

    sudo ./cogeto install --check --domain <your.domain> --acme-email <you>
  3. 3

    Install

    The script pulls the release images, verifies their signatures, generates secrets, and brings the instance up.

    sudo ./cogeto install --domain <your.domain> --acme-email <you> --mistral-key <key>

    The run ends with an instance specific checklist: the DNS records to create, backup settings to confirm, and the verification steps. TLS activates as soon as the DNS records resolve.

  4. 4

    Verify a release image yourself, any time

    Signing is keyless through the public transparency log, so verification needs no key from us. Each GitHub release also carries the image's software bill of materials and the exact verify command.

    cosign verify cogeto/cogeto:<version> \
  --certificate-identity-regexp '^https://github.com/Cogeto/cogeto/\.github/workflows/release\.yml@refs/tags/' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com'

Upgrades and rollback

Re-download the script first: the installed copy cannot update itself, and only the new script backfills any credential a newer compose requires. The script refuses unpublished tags, re-runs migrations, health checks the instance, and detects when a release changed the embedding model, offering the reindex. Rollback rolls images back; migrations are forward only, and full data rollback is the runbook's rehearsed backup restore.

curl -fsSL https://raw.githubusercontent.com/Cogeto/cogeto/main/scripts/operator/cogeto -o cogeto
chmod +x cogeto
sudo ./cogeto upgrade

What deployment is not, deliberately

No Terraform, no cloud API automation, no self serve provisioning, no automatic updates: one good script run by a human, for a cohort where every instance matters. Backups use the hosting provider's own capability, and restore is rehearsed, not assumed. The operator runbook covers provisioning, DNS, onboarding, backups with a rehearsed restore, upgrades, and troubleshooting, checklist by checklist.

The operator runbookDeployment reference

Want it operated for you instead?

A hosted instance on EU infrastructure starts with the pilot conversation, not a signup form.

Start a pilotFully offline installation