> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opencompany.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Production Deployment

> Deploy OpenCompany to a cloud VM with one command using company deploy

# Production Deployment

<Info>
  Not sure you need a server? Most people run OpenCompany on their own computer — see [Choose how to run](/choose-how-to-run).
</Info>

The recommended way to run OpenCompany in production is the built-in self-deploy CLI. One command provisions a login-gated OpenCompany VM on a cloud provider, installs the app, and runs it behind the login screen.

```bash theme={null}
company deploy up --provider gcp --owner-email you@example.com
```

Behind the scenes this runs two stages:

1. **Cloud CLI (auth + context)** - the provider adapter (currently `gcloud`; AWS is a follow-on) verifies your cloud CLI is installed and authenticated, resolves the project/region/zone, checks Application Default Credentials, and enables the required cloud APIs.
2. **Terraform** - generates fresh secrets and owner credentials, packages your local build, then creates all resources: the VM (resource id `opencompany` for new deployments; pre-rebrand deployments keep `machinaos`, retained for upgrade compatibility), firewall rule, artifact bucket, and service account. A cloud-init startup script installs Node.js and uv, installs the package, and runs `company serve` under systemd on a single public port.

<Info>
  `company serve` fronts the API, WebSocket, and the built single-page app on one port (optional daemons like the Node.js executor and WhatsApp are backend-managed and spawn on demand on their own loopback ports). No separate frontend container or reverse proxy is required for the standard path.
</Info>

## Prerequisites

* A cloud account (Google Cloud for the `gcp` provider).
* The `gcloud` CLI installed and authenticated:
  ```bash theme={null}
  gcloud auth login
  gcloud auth application-default login
  gcloud config set project <your-project-id>
  ```
* Node.js 22+ and npm on your local machine (used to package the local build via `npm pack`).
* Terraform is auto-installed by the deploy CLI if it is not already on PATH.

## Deploy

```bash theme={null}
company deploy up --provider gcp --owner-email you@example.com
```

When it finishes it prints the external IP, the URL, and the owner login credentials. If you did not pass `--owner-password`, a strong password is generated and printed once - save it.

<Warning>
  The generated login password is shown only once at the end of `deploy up`. Copy it immediately; it is not stored where you can read it back later.
</Warning>

### Common options

<ParamField path="--provider" type="string" default="gcp">
  Cloud provider. `gcp` today; AWS is a follow-on.
</ParamField>

<ParamField path="--owner-email" type="string" required>
  Login email for the owner account (single-owner mode).
</ParamField>

<ParamField path="--owner-password" type="string">
  Login password (min 8 chars). Generated and printed once if omitted.
</ParamField>

<ParamField path="--machine-type" type="string" default="e2-standard-2">
  VM size.
</ParamField>

<ParamField path="--port" type="number" default="5678">
  Public port the app binds and the firewall opens.
</ParamField>

<ParamField path="--allow-cidr" type="string" default="0.0.0.0/0">
  Firewall source range. Restrict to your own IP with something like `203.0.113.4/32`.
</ParamField>

<ParamField path="--region" type="string">
  Cloud region (provider default if omitted).
</ParamField>

<ParamField path="--zone" type="string">
  Cloud zone (provider default if omitted).
</ParamField>

<ParamField path="--project" type="string">
  GCP project (defaults to your `gcloud` config).
</ParamField>

## The Login Gate

The deploy path always provisions a login-gated, single-owner instance:

* `VITE_AUTH_ENABLED=true` and `AUTH_MODE=single`.
* The owner credential is generated at deploy time and seeded on first boot.
* Fresh `JWT_SECRET_KEY`, `SECRET_KEY`, and `API_KEY_ENCRYPTION_KEY` are minted per deployment.

<Warning>
  By default the VM is reached over plain HTTP on its IP, so `JWT_COOKIE_SECURE` is set to `false`. Put a domain and TLS terminator in front and flip `JWT_COOKIE_SECURE=true` once HTTPS is in place.
</Warning>

## Status and Health

```bash theme={null}
company deploy status
```

Prints the deployment's URL and polls `/health`. The VM takes a few minutes on first boot to install Node, npm, and build the app.

## Updating

Re-running `deploy up` re-applies Terraform safely (the VM keeps its durable resource id). To ship a new local build, run `company deploy up` again from an updated checkout.

## Tearing Down

```bash theme={null}
company deploy destroy
```

This runs `terraform destroy` and clears the local deployment state.

<Info>
  Deployment state lives at `<user-data>/deploy/opencompany/` (pre-rebrand deployments keep `deploy/machinaos/`, retained for upgrade compatibility). It is preserved by `company clean` - only `company deploy destroy` removes it, because it tracks live cloud resources.
</Info>

## Verify

```bash theme={null}
# Check health endpoint (URL printed by deploy up / status)
curl http://<external-ip>:5678/health
```

## Security Checklist

<Check>
  Owner login credentials are saved somewhere safe (password shown once)
</Check>

<Check>
  Firewall source range restricted with --allow-cidr where possible
</Check>

<Check>
  A TLS terminator + domain in front, with JWT\_COOKIE\_SECURE=true, before exposing publicly
</Check>

<Check>
  SSH key authentication only on the VM (disable password auth)
</Check>

***

## Self-Managed Deployment

Earlier releases shipped a Docker Compose topology; Docker support has been removed. Deploy with `company deploy` (Terraform -> GCP VM -> systemd) as described above.

## Related

<CardGroup cols={2}>
  <Card title="Installation" icon="gear" href="/installation">
    Environment variables and local setup
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.