Skip to main content

​
Production Deployment

Not sure you need a server? Most people run OpenCompany on their own computer — see Choose how to run.
The recommended way to run OpenCompany in production is the built-in self-deploy CLI. One command provisions a login-gated OpenCompany VM on a cloud provider, installs the app, and runs it behind the login screen.
Behind the scenes this runs two stages:
  1. Cloud CLI (auth + context) - the provider adapter (currently gcloud; AWS is a follow-on) verifies your cloud CLI is installed and authenticated, resolves the project/region/zone, checks Application Default Credentials, and enables the required cloud APIs.
  2. Terraform - generates fresh secrets and owner credentials, packages your local build, then creates all resources: the VM (resource id opencompany for new deployments; pre-rebrand deployments keep machinaos, retained for upgrade compatibility), firewall rule, artifact bucket, and service account. A cloud-init startup script installs Node.js and uv, installs the package, and runs company serve under systemd on a single public port.
company serve fronts the API, WebSocket, and the built single-page app plus the Node.js sidecar all on one port. No separate frontend container or reverse proxy is required for the standard path.

​
Prerequisites

  • A cloud account (Google Cloud for the gcp provider).
  • The gcloud CLI installed and authenticated:
  • Node.js 22+ and npm on your local machine (used to package the local build via npm pack).
  • Terraform is auto-installed by the deploy CLI if it is not already on PATH.

​
Deploy

When it finishes it prints the external IP, the URL, and the owner login credentials. If you did not pass --owner-password, a strong password is generated and printed once - save it.
The generated login password is shown only once at the end of deploy up. Copy it immediately; it is not stored where you can read it back later.

​
Common options

​
string
default:"gcp"
Cloud provider. gcp today; AWS is a follow-on.
​
string
required
Login email for the owner account (single-owner mode).
​
string
Login password (min 8 chars). Generated and printed once if omitted.
​
string
default:"e2-standard-2"
VM size.
​
number
default:"8080"
Public port the app binds and the firewall opens.
​
string
default:"0.0.0.0/0"
Firewall source range. Restrict to your own IP with something like 203.0.113.4/32.
​
string
Cloud region (provider default if omitted).
​
string
Cloud zone (provider default if omitted).
​
string
GCP project (defaults to your gcloud config).

​
The Login Gate

The deploy path always provisions a login-gated, single-owner instance:
  • VITE_AUTH_ENABLED=true and AUTH_MODE=single.
  • The owner credential is generated at deploy time and seeded on first boot.
  • Fresh JWT_SECRET_KEY, SECRET_KEY, and API_KEY_ENCRYPTION_KEY are minted per deployment.
By default the VM is reached over plain HTTP on its IP, so JWT_COOKIE_SECURE is set to false. Put a domain and TLS terminator in front and flip JWT_COOKIE_SECURE=true once HTTPS is in place.

​
Status and Health

Prints the deployment’s URL and polls /health. The VM takes a few minutes on first boot to install Node, npm, and build the app.

​
Updating

Re-running deploy up re-applies Terraform safely (the VM keeps its durable resource id). To ship a new local build, run company deploy up again from an updated checkout.

​
Tearing Down

This runs terraform destroy and clears the local deployment state.
Deployment state lives at <user-data>/deploy/opencompany/ (pre-rebrand deployments keep deploy/machinaos/, retained for upgrade compatibility). It is preserved by company clean - only company deploy destroy removes it, because it tracks live cloud resources.

​
Verify

​
Security Checklist

Owner login credentials are saved somewhere safe (password shown once)
Firewall source range restricted with —allow-cidr where possible
A TLS terminator + domain in front, with JWT_COOKIE_SECURE=true, before exposing publicly
SSH key authentication only on the VM (disable password auth)

​
Self-Managed Deployment

Earlier releases shipped a Docker Compose topology; Docker support has been removed. Deploy with company deploy (Terraform -> GCP VM -> systemd) as described above.

Installation

Environment variables and local setup