@crvouga/atlas 0.6.1 → 0.8.0

package/CHANGELOG.md

@@ -1,6 +1,18 @@
 # Changelog: @crvouga/atlas
 
-## 0.6.1 (2026-10-15)
+## 0.8.0 (2026-10-15)
+
+### Features
+
+- add anonymous Atlas server image (#12) ([269d62d](https://github.com/crvouga/atlas/commit/269d62d74e08efd2ba473dd3629bddfd13670265))
+
+## 0.7.0 (2026-10-15)
+
+### Features
+
+- publish the Atlas server image (#10) ([5cfb9b9](https://github.com/crvouga/atlas/commit/5cfb9b99a4a4f09180f371587704c447493b2f9f))
+
+## 0.6.1 (2026-10-14)
 
 ### Fixes and improvements
 

package/README.md

@@ -68,6 +68,48 @@ live step logs and a Running status filter. Producers send heartbeats every
 configure `ATLAS_RUN_TIMEOUT_SECONDS` and `ATLAS_RUN_STALL_SECONDS` (0 disables the progress timeout),
 or edit these settings in the client. An interruption never turns missing outcomes into passes.
 
+## Deploy to Railway without code
+
+Copy this image URI into **Railway → New service → Docker image**:
+
+```text
+ghcr.io/crvouga/atlas:latest
+```
+
+The image includes the Atlas server and viewer; hosting it needs no repository, Dockerfile, build command
+or package installation. [`latest` on GHCR](https://github.com/users/crvouga/packages/container/atlas) follows
+the newest checked `main` image, independently of npm releases.
+
+1. Leave the start command unset. Add a long random secret as `ATLAS_TOKEN` (at least 12 characters;
+   use 48 or more) and set `RAILWAY_RUN_UID=0` for [Railway volume permissions](https://docs.railway.com/volumes#permissions).
+2. Attach a persistent volume at `/data` and keep one replica so reports and server settings survive updates.
+3. Set the healthcheck path to `/readyz` and generate a public domain. Railway supplies `PORT`;
+   leave `ATLAS_PORT` unset. Open the domain and sign in with the token as the password (any username).
+4. Enable **Settings → Source → Configure Auto Updates → Anytime** to follow `latest`.
+   [Railway checks for image updates periodically](https://docs.railway.com/deployments/image-auto-updates);
+   detection can take a few hours.
+
+For the exact image from a run, open **[CI](https://github.com/crvouga/atlas/actions/workflows/ci.yml) →
+run → Summary → Atlas CI**. The summary includes a copyable full commit tag, the immutable registry digest,
+whether that run updated `latest`, all job results, npm release details and artifact links. Use the commit
+tag to pin or roll back a deployment. The [deployment guide](docs/deploying.md#run-it) covers optional reader
+and publisher tokens, bucket storage and sending results from your projects.
+
+### Deploy without authentication
+
+For anonymous access, use this image in Railway instead:
+
+```text
+ghcr.io/crvouga/atlas-insecure:latest
+```
+
+It contains the same server and viewer, with anonymous reading, uploads and administration enabled.
+Follow the Railway steps above, leaving `ATLAS_TOKEN`, `ATLAS_PUBLISH_TOKEN`, `ATLAS_READ_TOKEN` and
+configuration-file auth tokens unset. Open the generated domain directly; no sign-in is required.
+Anyone who discovers the URL can read reports, upload results and change settings. An unlisted URL
+is not access control. See the [anonymous deployment guide](docs/deploying.md#deploy-without-authentication)
+for a token-free project configuration and verification commands.
+
 ## For AI agents
 
 Atlas is built to be integrated and operated by agents, with nothing to click and nothing to guess.
@@ -187,6 +229,9 @@ unless you choose a bucket. `atlas dev` runs the same server with the client's d
 development is one host too. See [the server](docs/server.md) and
 [running Atlas for a project](docs/deploying.md).
 
+Deploy the server using the [Railway setup above](#deploy-to-railway-without-code), or follow the
+[deployment guide](docs/deploying.md#run-it) for other hosts.
+
 ```sh
 atlas serve                                          # the project's server, at :8080 (ATLAS_TOKEN says who may upload)
 

package/docs/deploying.md

@@ -213,21 +213,108 @@ use a named `--store project=s3://… --write project` to put uploads in a share
 
 ### Run it
 
-**Docker.** [`examples/deploy/Dockerfile`](https://github.com/crvouga/atlas/blob/main/examples/deploy/Dockerfile)
-installs Atlas, builds the client once (it is the same for every project: the server tells the page where its
-data is) and starts the server, keeping results on the volume at `/data`:
+**Railway (deploy an image, no repository or code changes).** Create a service from the Docker image
+`ghcr.io/crvouga/atlas:latest`. Copy the URI below into Railway's image field:
+
+```text
+ghcr.io/crvouga/atlas:latest
+```
+
+For a specific revision, open a [CI run](https://github.com/crvouga/atlas/actions/workflows/ci.yml)'s
+**Summary → Atlas CI**: it includes the published commit image URI, immutable digest and whether that run
+updated `latest`. Pull request builds and failed publications are labelled accordingly.
+
+1. In Railway choose **New service → Docker image** and enter `ghcr.io/crvouga/atlas:latest`.
+   Leave the start command unset: the image includes the server and the prebuilt viewer.
+2. Add `ATLAS_TOKEN` with a long random value (generate one with `openssl rand -hex 24`). It grants admin
+   access; optionally add separate `ATLAS_PUBLISH_TOKEN` and `ATLAS_READ_TOKEN` for publishers and readers.
+3. Attach a volume at `/data` and set `RAILWAY_RUN_UID=0`: Railway mounts volumes as root, while the image
+   normally runs as `bun` ([Railway volume permissions](https://docs.railway.com/volumes#permissions)).
+   Keep one replica. The volume retains reports and server settings when the image is replaced.
+4. Set the healthcheck path to `/readyz` and generate a public domain. The image listens on `0.0.0.0` and
+   honors Railway's `PORT`; leave `ATLAS_PORT` unset. Open the domain and sign in with your token as the
+   password (any username), or use the viewer's token sign-in.
+5. Under **Settings → Source → Configure Auto Updates**, enable image updates and select **Anytime**.
+   Each successful `main` build publishes a new `latest`. Railway detects the changed digest and redeploys
+   within its update schedule; detection can be cached for a few hours, so publishing does not mean an
+   immediate deployment ([Railway image auto updates](https://docs.railway.com/deployments/image-auto-updates)).
+
+Check the domain with `curl --fail https://YOUR-DOMAIN/readyz`: HTTP 200 means the server read its backend.
+Projects publish to that domain with `ATLAS_STORE=https://YOUR-DOMAIN` and their `ATLAS_TOKEN`, as in
+[sending results](#3-send-results-from-ci-and-from-laptops). Hosting Atlas needs no project checkout; publishing
+your project's test results still needs the integration described there.
+
+For bucket storage instead, set `ATLAS_STORE=project=s3://my-bucket/atlas/my-project`, `ATLAS_WRITE=project`,
+and the bucket credentials. Keep the `/data` volume for server settings and local state.
+
+### Deploy without authentication
+
+Use `ghcr.io/crvouga/atlas-insecure:latest` for a server that requires no sign-in or API token. It is built
+from the same commit, server and viewer as `ghcr.io/crvouga/atlas:latest`, with `ATLAS_INSECURE=true`
+to allow listening on the network without tokens. Anonymous callers have full read, publish and admin access.
+Anyone who discovers an unlisted URL can read reports, upload results and change settings; the URL is
+not access control.
+
+In Railway, create a **Docker image** service with:
+
+```text
+ghcr.io/crvouga/atlas-insecure:latest
+```
+
+Leave the start command unset. Attach a persistent volume at `/data`, set `RAILWAY_RUN_UID=0`, keep one
+replica, set the healthcheck to `/readyz` and generate a public domain. Leave `ATLAS_PORT` unset so Railway's
+`PORT` is used. Enable **Settings → Source → Configure Auto Updates → Anytime** to follow `latest`.
+Do not set `ATLAS_TOKEN`, `ATLAS_PUBLISH_TOKEN` or `ATLAS_READ_TOKEN`, or add `auth.tokens` to
+`/data/atlas.server.json`: configured tokens still enable authentication. When reusing a volume from an
+authenticated deployment, remove its saved auth tokens first. Open the domain directly, including `/admin`
+for settings (leave the token field blank and choose **Load settings**).
+
+Verify anonymous reads and uploads without an Authorization header:
+
+```sh
+curl --fail https://YOUR-DOMAIN/readyz
+curl --fail https://YOUR-DOMAIN/api/server
+curl --fail 'https://YOUR-DOMAIN/api/checks?project=my-project' \
+  -H 'content-type: application/json' \
+  -d '{"producer":"smoke","checks":[{"id":"deployed","title":"Deployed","status":"passed"}]}'
+```
+
+Readiness returns HTTP 200, `/api/server` reports `"open":true` and `"role":"admin"`, and the upload returns
+HTTP 201. Configure a project with `ATLAS_STORE=https://YOUR-DOMAIN` and `ATLAS_PROJECT=my-project`;
+leave its `ATLAS_TOKEN` unset. Use the same publishing commands described in
+[sending results](#3-send-results-from-ci-and-from-laptops), omitting credentials.
+
+For local Docker:
 
 ```sh
-docker build -t atlas examples/deploy
-docker run -p 8080:8080 -v atlas-data:/data -e ATLAS_TOKEN=$(openssl rand -hex 24) atlas
+docker run --pull always -p 8080:8080 -v atlas-data:/data ghcr.io/crvouga/atlas-insecure:latest
 ```
 
+Both images publish full commit tags for pinning or rollback. A new GHCR package must be made Public
+once before Railway can pull without registry credentials; see
+[image publication](https://github.com/crvouga/atlas/blob/main/docs/releasing.md#server-image).
+
+### Docker
+
+The same published image works anywhere Docker runs. It already contains the client (the same
+for every project: the server tells the page where its data is), and keeps results on the volume at `/data`:
+
+```sh
+docker run --pull always -p 8080:8080 -v atlas-data:/data \
+  -e ATLAS_TOKEN=$(openssl rand -hex 24) ghcr.io/crvouga/atlas:latest
+```
+
+The image is built from each checked commit, independently of npm releases. To pin a deployment or roll
+back, replace `latest` with the full commit SHA. To build from this repository, use `docker build -t atlas .`;
+[`examples/deploy/Dockerfile`](https://github.com/crvouga/atlas/blob/main/examples/deploy/Dockerfile) is the
+alternative for building from an npm version or a local package tarball.
+
 For a bucket as the system of record add `-e ATLAS_STORE=project=s3://my-bucket/atlas/my-project -e ATLAS_WRITE=project -e AWS_REGION=us-east-1`.
 On ECS, EKS or EC2, attach the combined **both** policy (including `server/live/*` for producer leases) to the task, service account or
 instance and set no keys.
 
 **Try it on one machine.** [`examples/deploy/compose.yaml`](https://github.com/crvouga/atlas/blob/main/examples/deploy/compose.yaml)
-starts the server on a volume; `compose.s3.yaml` starts it with an S3 server and a bucket as its storage.
+starts the published image on a volume; `compose.s3.yaml` starts it with an S3 server and a bucket as its storage.
 Publish to `http://localhost:8080` from your project and open it.
 
 **Kubernetes.** [`examples/deploy/kubernetes.yaml`](https://github.com/crvouga/atlas/blob/main/examples/deploy/kubernetes.yaml):

package/docs/server.md

@@ -53,7 +53,11 @@ bunx atlas dev --data .atlas-data            # http://127.0.0.1:5180
 ATLAS_STORE=http://127.0.0.1:5180 bunx atlas report publish --producer unit --junit out.xml
 ```
 
-For containers, Kubernetes and CI see [running Atlas for a project](deploying.md).
+For Railway, deploy `ghcr.io/crvouga/atlas:latest` directly: the image contains the server and
+viewer, and every green `main` push updates it. See [running Atlas for a project](deploying.md#run-it) for
+Railway's volume, tokens, healthcheck and image auto updates, or for Docker, Kubernetes and CI.
+For anonymous reading, uploads and administration, use `ghcr.io/crvouga/atlas-insecure:latest` with no tokens
+configured; see [deploying without authentication](deploying.md#deploy-without-authentication).
 
 ## Configuration
 

package/llms-full.txt

@@ -1005,7 +1005,11 @@ bunx atlas dev --data .atlas-data            # http://127.0.0.1:5180
 ATLAS_STORE=http://127.0.0.1:5180 bunx atlas report publish --producer unit --junit out.xml
 ```
 
-For containers, Kubernetes and CI see [running Atlas for a project](deploying.md).
+For Railway, deploy `ghcr.io/crvouga/atlas:latest` directly: the image contains the server and
+viewer, and every green `main` push updates it. See [running Atlas for a project](deploying.md#run-it) for
+Railway's volume, tokens, healthcheck and image auto updates, or for Docker, Kubernetes and CI.
+For anonymous reading, uploads and administration, use `ghcr.io/crvouga/atlas-insecure:latest` with no tokens
+configured; see [deploying without authentication](deploying.md#deploy-without-authentication).
 
 ## Configuration
 
@@ -1583,21 +1587,108 @@ use a named `--store project=s3://… --write project` to put uploads in a share
 
 ### Run it
 
-**Docker.** [`examples/deploy/Dockerfile`](https://github.com/crvouga/atlas/blob/main/examples/deploy/Dockerfile)
-installs Atlas, builds the client once (it is the same for every project: the server tells the page where its
-data is) and starts the server, keeping results on the volume at `/data`:
+**Railway (deploy an image, no repository or code changes).** Create a service from the Docker image
+`ghcr.io/crvouga/atlas:latest`. Copy the URI below into Railway's image field:
+
+```text
+ghcr.io/crvouga/atlas:latest
+```
+
+For a specific revision, open a [CI run](https://github.com/crvouga/atlas/actions/workflows/ci.yml)'s
+**Summary → Atlas CI**: it includes the published commit image URI, immutable digest and whether that run
+updated `latest`. Pull request builds and failed publications are labelled accordingly.
+
+1. In Railway choose **New service → Docker image** and enter `ghcr.io/crvouga/atlas:latest`.
+   Leave the start command unset: the image includes the server and the prebuilt viewer.
+2. Add `ATLAS_TOKEN` with a long random value (generate one with `openssl rand -hex 24`). It grants admin
+   access; optionally add separate `ATLAS_PUBLISH_TOKEN` and `ATLAS_READ_TOKEN` for publishers and readers.
+3. Attach a volume at `/data` and set `RAILWAY_RUN_UID=0`: Railway mounts volumes as root, while the image
+   normally runs as `bun` ([Railway volume permissions](https://docs.railway.com/volumes#permissions)).
+   Keep one replica. The volume retains reports and server settings when the image is replaced.
+4. Set the healthcheck path to `/readyz` and generate a public domain. The image listens on `0.0.0.0` and
+   honors Railway's `PORT`; leave `ATLAS_PORT` unset. Open the domain and sign in with your token as the
+   password (any username), or use the viewer's token sign-in.
+5. Under **Settings → Source → Configure Auto Updates**, enable image updates and select **Anytime**.
+   Each successful `main` build publishes a new `latest`. Railway detects the changed digest and redeploys
+   within its update schedule; detection can be cached for a few hours, so publishing does not mean an
+   immediate deployment ([Railway image auto updates](https://docs.railway.com/deployments/image-auto-updates)).
+
+Check the domain with `curl --fail https://YOUR-DOMAIN/readyz`: HTTP 200 means the server read its backend.
+Projects publish to that domain with `ATLAS_STORE=https://YOUR-DOMAIN` and their `ATLAS_TOKEN`, as in
+[sending results](#3-send-results-from-ci-and-from-laptops). Hosting Atlas needs no project checkout; publishing
+your project's test results still needs the integration described there.
+
+For bucket storage instead, set `ATLAS_STORE=project=s3://my-bucket/atlas/my-project`, `ATLAS_WRITE=project`,
+and the bucket credentials. Keep the `/data` volume for server settings and local state.
+
+### Deploy without authentication
+
+Use `ghcr.io/crvouga/atlas-insecure:latest` for a server that requires no sign-in or API token. It is built
+from the same commit, server and viewer as `ghcr.io/crvouga/atlas:latest`, with `ATLAS_INSECURE=true`
+to allow listening on the network without tokens. Anonymous callers have full read, publish and admin access.
+Anyone who discovers an unlisted URL can read reports, upload results and change settings; the URL is
+not access control.
+
+In Railway, create a **Docker image** service with:
+
+```text
+ghcr.io/crvouga/atlas-insecure:latest
+```
+
+Leave the start command unset. Attach a persistent volume at `/data`, set `RAILWAY_RUN_UID=0`, keep one
+replica, set the healthcheck to `/readyz` and generate a public domain. Leave `ATLAS_PORT` unset so Railway's
+`PORT` is used. Enable **Settings → Source → Configure Auto Updates → Anytime** to follow `latest`.
+Do not set `ATLAS_TOKEN`, `ATLAS_PUBLISH_TOKEN` or `ATLAS_READ_TOKEN`, or add `auth.tokens` to
+`/data/atlas.server.json`: configured tokens still enable authentication. When reusing a volume from an
+authenticated deployment, remove its saved auth tokens first. Open the domain directly, including `/admin`
+for settings (leave the token field blank and choose **Load settings**).
+
+Verify anonymous reads and uploads without an Authorization header:
 
 ```sh
-docker build -t atlas examples/deploy
-docker run -p 8080:8080 -v atlas-data:/data -e ATLAS_TOKEN=$(openssl rand -hex 24) atlas
+curl --fail https://YOUR-DOMAIN/readyz
+curl --fail https://YOUR-DOMAIN/api/server
+curl --fail 'https://YOUR-DOMAIN/api/checks?project=my-project' \
+  -H 'content-type: application/json' \
+  -d '{"producer":"smoke","checks":[{"id":"deployed","title":"Deployed","status":"passed"}]}'
 ```
 
+Readiness returns HTTP 200, `/api/server` reports `"open":true` and `"role":"admin"`, and the upload returns
+HTTP 201. Configure a project with `ATLAS_STORE=https://YOUR-DOMAIN` and `ATLAS_PROJECT=my-project`;
+leave its `ATLAS_TOKEN` unset. Use the same publishing commands described in
+[sending results](#3-send-results-from-ci-and-from-laptops), omitting credentials.
+
+For local Docker:
+
+```sh
+docker run --pull always -p 8080:8080 -v atlas-data:/data ghcr.io/crvouga/atlas-insecure:latest
+```
+
+Both images publish full commit tags for pinning or rollback. A new GHCR package must be made Public
+once before Railway can pull without registry credentials; see
+[image publication](https://github.com/crvouga/atlas/blob/main/docs/releasing.md#server-image).
+
+### Docker
+
+The same published image works anywhere Docker runs. It already contains the client (the same
+for every project: the server tells the page where its data is), and keeps results on the volume at `/data`:
+
+```sh
+docker run --pull always -p 8080:8080 -v atlas-data:/data \
+  -e ATLAS_TOKEN=$(openssl rand -hex 24) ghcr.io/crvouga/atlas:latest
+```
+
+The image is built from each checked commit, independently of npm releases. To pin a deployment or roll
+back, replace `latest` with the full commit SHA. To build from this repository, use `docker build -t atlas .`;
+[`examples/deploy/Dockerfile`](https://github.com/crvouga/atlas/blob/main/examples/deploy/Dockerfile) is the
+alternative for building from an npm version or a local package tarball.
+
 For a bucket as the system of record add `-e ATLAS_STORE=project=s3://my-bucket/atlas/my-project -e ATLAS_WRITE=project -e AWS_REGION=us-east-1`.
 On ECS, EKS or EC2, attach the combined **both** policy (including `server/live/*` for producer leases) to the task, service account or
 instance and set no keys.
 
 **Try it on one machine.** [`examples/deploy/compose.yaml`](https://github.com/crvouga/atlas/blob/main/examples/deploy/compose.yaml)
-starts the server on a volume; `compose.s3.yaml` starts it with an S3 server and a bucket as its storage.
+starts the published image on a volume; `compose.s3.yaml` starts it with an S3 server and a bucket as its storage.
 Publish to `http://localhost:8080` from your project and open it.
 
 **Kubernetes.** [`examples/deploy/kubernetes.yaml`](https://github.com/crvouga/atlas/blob/main/examples/deploy/kubernetes.yaml):

package/llms.txt

@@ -47,4 +47,4 @@ Given only the repository link, start at docs/agents.md: install `@crvouga/atlas
 
 ## Optional
 
-- [Releasing](https://raw.githubusercontent.com/crvouga/atlas/main/docs/releasing.md): How @crvouga/atlas gets from main to npm.
+- [Releasing](https://raw.githubusercontent.com/crvouga/atlas/main/docs/releasing.md): How Atlas gets from main to npm and to its server container image.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crvouga/atlas",
-  "version": "0.6.1",
+  "version": "0.8.0",
   "description": "Atlas: specs of any kind, reported as layered evidence. Publish checks from any runner (JUnit, CTRF, a script), combine them across nodes, branches, environments and backends, gate CI on the result, and run statecharts against the real app.",
   "license": "MIT",
   "type": "module",