In your own AWS account.

The same Terraform that runs the hosted service, applied in your account from published, versioned images. Nothing is built on your machine. One region, about an hour the first time.

The runbook

Install

An AWS account with administrator access, Terraform 1.10 or OpenTofu, and a domain with a Route 53 zone in the same account. Docker is not needed.

cd deploy
make install VERSION=v0.1.0 DOMAIN=forge.example.com BUDGET_EMAIL=ops@example.com \
  CI_HOSTS=true PLATFORM_AI=true
The images

VERSION names a published release. The stack pulls it from the public registry; the same tag is the release in the source repository.

public.ecr.aws/w4g9d9z4/sigbound/app:v0.1.0
public.ecr.aws/w4g9d9z4/sigbound/runner:v0.1.0
The model key

Sigbound AI reads on your own key. It goes into your account's parameter store; Terraform never reads it, and every read's cost is recorded on its run.

make model-key < key.txt
Upgrading

The same command with the next VERSION. Migrations run at boot.

Tearing down

make destroy with the same flags. The state bucket is left alone on purpose.

What the stack contains

Every piece is in deploy/stack, in the source. Baseline cost is roughly $75 a month idle; CI hosts and reads add usage on top.

ECS Fargate

The forge and the gate, as services that scale to what you use.

RDS Postgres

Encrypted at rest, automated backups with point-in-time recovery.

S3

Repositories, artifacts and the log plane, versioned and blocked from public access. Disks are only a cache.

SES

Sign-in codes, invitations and notifications sent as noreply@ your domain; mail to the domain is received and forwarded.

Cognito

The sign-in doors for the deployment. A space adds its own issuer over OpenID Connect or SAML on top.

CI hosts and the Lambda lane

Scale-to-zero hosts for workflow runs, and a sandbox-per-run lane in microVMs with CI_LAMBDA=true.

ALB and Route 53

One address for the site, the app, the API and git over HTTPS, with the certificate issued and renewed for you.

The signing key

Every merge is signed with a key that never leaves your account.

Not yet in the package

Said plainly, so you can plan around it.

  1. 1Importing a space exported from the hosted service; the export exists, the import does not.
  2. 2More than one region; the stack is single-region.
  3. 3Running outside AWS. The application depends only on object storage, a database and a container runtime, and a cloud-agnostic package is the plan after this one.

Read the rest

The runbook

Bootstrap, install, mail, the model key, first sign-in, upgrades, backups and recovery, step by step. Self-host on AWS

What a self-host gets you

Single sign-on, SCIM, the audit log, export and closure: everything on the enterprise page, in your account. Enterprise