anbaric-hosting 1.1.1 → 1.2.1

package/README.md

@@ -22,7 +22,9 @@ The platform is configured entirely through environment variables:
 | `ANBARIC_PLATFORM_INTERNAL_URL` | how deployed apps reach the internal entry point | `http://localhost:<internal port>` |
 | `ANBARIC_TENANT` | tenant this platform serves (returned to the CLI on login) | — |
 | `ANBARIC_BUILD_LAYER` | `docker` (needs a docker socket) or `fargate` (AWS); unset disables app deployment | unset |
-| `ANBARIC_AUTHENTICATOR` | module name of an auth plugin exposing `createAuthenticator()` | unset (auth disabled) |
+| `ANBARIC_AUTHENTICATOR` | `stub`, or the module name of an auth plugin exposing `createAuthenticator()` | unset (auth disabled) |
+| `ANBARIC_STUB_USER` | the fixed identity the stub authenticator signs everyone in as | `local-admin` |
+| `ANBARIC_CLI_KEY_LOOKUP_URL` / `_SECRET` | verify CLI keys against a central key registry instead of the local database (hosted-platform feature; self-hosts leave unset) | unset (keys local) |
 | `ANBARIC_APPS_DIR` | working directory for app bundles | `/tmp/anbaric-apps` |
 | `ANBARIC_DISPATCH_INTERVAL_MS` | queue dispatch interval | `1000` |
 
@@ -41,3 +43,34 @@ it must only ever be reachable by deployed apps (same docker network, same
 task, or a security-group rule).
 
 Health check: `GET /ping` → `{"status":"ok"}` on both ports.
+
+## The self-host flow
+
+Self-hosting is deliberately simple — one platform, everything local, no
+external control plane:
+
+1. **Domain**: run on `localhost`, or put the platform behind your own
+   domain/TLS (a reverse proxy or the reference AWS setup in the repo's
+   `gitops/`); set `ANBARIC_PLATFORM_PUBLIC_URL` accordingly.
+2. **Authentication — three choices**:
+   - **Unset**: no auth at all. Every request is anonymous; fine on a
+     trusted network or laptop.
+   - **`ANBARIC_AUTHENTICATOR=stub`**: every request is authenticated as one
+     fixed identity with no credential check — the whole auth-dependent
+     surface (`/whoami`, CLI keys, the dashboard) works without an identity
+     provider. Development only: anyone who can reach the platform *is* that
+     user.
+   - **Your own provider**: publish or vendor a module exporting
+     `createAuthenticator() : Authenticator` — `authenticate` returns
+     `[User, Tenant]` for a valid session and writes its own redirect/401
+     otherwise — and name it in `ANBARIC_AUTHENTICATOR`. Any OIDC/SAML/
+     anything provider fits behind that contract.
+3. **CLI access**: `anbaric login`, choose Other and enter your platform
+   URL. The browser authorization, keypair issuance, key storage and
+   verification all happen on your platform — no central service involved.
+   `ANBARIC_TENANT` is an optional label your platform reports to the CLI
+   ("Logged into tenant X"); leave it unset for a single-tenant install.
+
+Anbaric Cloud (the hosted product) layers central login, organizations and
+edge routing on top of exactly this platform — none of it lives in the open
+source packages, and none of it is needed to self-host.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anbaric-hosting",
-  "version": "1.1.1",
+  "version": "1.2.1",
   "description": "Run an Anbaric platform: the hosted API, dispatcher, build layers and app proxy, bootable with the anbaric-hosting command",
   "license": "MIT",
   "type": "module",
@@ -14,7 +14,7 @@
     "bin"
   ],
   "dependencies": {
-    "anbaric-cloud-hosting": "^1.1.1",
+    "anbaric-cloud-hosting": "^1.2.1",
     "tsx": "^4.20.0"
   }
 }