In your own AWS account.
The same Terraform that runs the hosted service, applied in your account from published, versioned images. Nothing is built on your machine. One region, about an hour the first time.
The runbookInstall
An AWS account with administrator access, Terraform 1.10 or OpenTofu, and a domain with a Route 53 zone in the same account. Docker is not needed.
cd deploy make install VERSION=v0.1.0 DOMAIN=forge.example.com BUDGET_EMAIL=ops@example.com \ CI_HOSTS=true PLATFORM_AI=true
VERSION names a published release. The stack pulls it from the public registry; the same tag is the release in the source repository.
public.ecr.aws/w4g9d9z4/sigbound/app:v0.1.0 public.ecr.aws/w4g9d9z4/sigbound/runner:v0.1.0
Sigbound AI reads on your own key. It goes into your account's parameter store; Terraform never reads it, and every read's cost is recorded on its run.
make model-key < key.txt
The same command with the next VERSION. Migrations run at boot.
make destroy with the same flags. The state bucket is left alone on purpose.
What the stack contains
Every piece is in deploy/stack, in the source. Baseline cost is roughly $75 a month idle; CI hosts and reads add usage on top.
The forge and the gate, as services that scale to what you use.
Encrypted at rest, automated backups with point-in-time recovery.
Repositories, artifacts and the log plane, versioned and blocked from public access. Disks are only a cache.
Sign-in codes, invitations and notifications sent as noreply@ your domain; mail to the domain is received and forwarded.
The sign-in doors for the deployment. A space adds its own issuer over OpenID Connect or SAML on top.
Scale-to-zero hosts for workflow runs, and a sandbox-per-run lane in microVMs with CI_LAMBDA=true.
One address for the site, the app, the API and git over HTTPS, with the certificate issued and renewed for you.
Every merge is signed with a key that never leaves your account.
Not yet in the package
Said plainly, so you can plan around it.
- 1Importing a space exported from the hosted service; the export exists, the import does not.
- 2More than one region; the stack is single-region.
- 3Running outside AWS. The application depends only on object storage, a database and a container runtime, and a cloud-agnostic package is the plan after this one.
Read the rest
Bootstrap, install, mail, the model key, first sign-in, upgrades, backups and recovery, step by step. Self-host on AWS
Single sign-on, SCIM, the audit log, export and closure: everything on the enterprise page, in your account. Enterprise