Deployment

This guide covers deploying AuthBoundry to production.

Deployment Models

Self-Hosted

Deploy AuthBoundry on your own infrastructure. You manage updates, scaling, and operations.

  • Docker container
  • Kubernetes deployment
  • Traditional VM/server

Managed (Coming Soon)

AuthBoundry-managed hosted service. We handle operations, scaling, backups, and updates.

Prerequisites

Infrastructure

  • Linux server or container runtime
  • Network access to your applications
  • Database (PostgreSQL recommended)
  • TLS certificates for HTTPS

Configuration

  • Authority configuration file
  • Tenant definitions
  • Identity provider settings

Docker Deployment

Build

docker build -t authboundry:latest .

Run

docker run -p 3000:3000 \
  -e AUTHBOUNDRY_CONFIG=/config/authboundry.json \
  -v /path/to/config:/config \
  authboundry:latest

Kubernetes Deployment

Prerequisites

  • Kubernetes cluster (1.20+)
  • kubectl configured
  • Docker registry access

Create ConfigMap

kubectl create configmap authboundry-config \
  --from-file=authboundry.json=./config/authboundry.json

Deploy

kubectl apply -f deployment.yaml

Example Deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: authboundry
spec:
  replicas: 3
  selector:
    matchLabels:
      app: authboundry
  template:
    metadata:
      labels:
        app: authboundry
    spec:
      containers:
      - name: authboundry
        image: authboundry:latest
        ports:
        - containerPort: 3000
        env:
        - name: AUTHBOUNDRY_ADDR
          value: "0.0.0.0:3000"
        volumeMounts:
        - name: config
          mountPath: /config
      volumes:
      - name: config
        configMap:
          name: authboundry-config

High Availability

Multiple Replicas

Run multiple instances behind a load balancer.

replicas: 3  # or more for HA

Database Replication

Use database replication for HA:

  • PostgreSQL streaming replication
  • Database cluster with failover

Load Balancing

Use a load balancer to distribute traffic:

  • NGINX
  • HAProxy
  • Cloud provider load balancer

TLS/HTTPS

Self-Signed Certificates (Development)

openssl req -x509 -newkey rsa:4096 \
  -keyout key.pem -out cert.pem \
  -days 365 -nodes

Let's Encrypt (Production)

certbot certonly --standalone -d authboundry.example.com

Configure AuthBoundry

authboundry serve config.auth \
  --tls-cert /path/to/cert.pem \
  --tls-key /path/to/key.pem

Database Setup

PostgreSQL

createdb authboundry
psql authboundry < schema.sql

Connection String

postgresql://user:password@localhost:5432/authboundry

Configure AuthBoundry

export AUTHBOUNDRY_DATABASE_URL="postgresql://user:password@localhost:5432/authboundry" authboundry serve config.auth

Monitoring & Logging

Health Check

curl http://localhost:3000/health

Logs

AuthBoundry logs to stderr by default:

authboundry serve config.auth 2>&1 | tee authboundry.log

Metrics

Expose Prometheus metrics:

curl http://localhost:3000/metrics

Backup & Recovery

Database Backup

pg_dump authboundry > backup.sql

Restore from Backup

psql authboundry < backup.sql

Backup Strategy

  • Daily automated backups
  • Off-site backup storage
  • Regular restore testing
  • Retention: at least 30 days

Updates & Migrations

Before Update

  1. Create backup
  2. Test update in staging
  3. Review release notes

Update Process

  1. Stop AuthBoundry gracefully
  2. Run database migrations
  3. Deploy new version
  4. Verify functionality

Graceful Shutdown

kill -TERM <pid>
# AuthBoundry will:
# 1. Stop accepting new connections
# 2. Wait for in-flight requests to complete
# 3. Close database connection
# 4. Exit

Security Considerations

Network Isolation

  • AuthBoundry should only be accessible from your application servers
  • Use firewall rules to restrict access
  • Consider internal-only deployment

Secrets Management

  • Use environment variables for secrets, not config files
  • Use secret management service (Vault, etc.)
  • Never commit secrets to version control

Database Security

  • Use strong database passwords
  • Restrict database network access
  • Enable database encryption
  • Audit database access

Capacity Planning

Sizing

  • CPU: 2-4 cores per 1000 requests/sec
  • Memory: 512MB-2GB per instance
  • Database: 10GB+ for historical audit data

Scaling

  • Horizontal: Add more AuthBoundry instances
  • Vertical: Increase instance resources
  • Database: Upgrade database hardware

Next Steps