docs/self-hosting: document single-user NixOS production setup #187

New issue

Closed

opened 2026-04-06 02:04:46 +00:00 by barrettruth · 0 comments

barrettruth commented

2026-04-06 02:04:46 +00:00

Problem

Delta needs a reproducible single-user self-hosted deployment path.

The production shape should match the current product decision: no app login flow, no multi-user account model, no reminders subsystem, no PWA/offline app requirement. Google OAuth may still exist only as provider integration for Calendar/Tasks sync.

Solution

Document the NixOS-first setup:

service user, working directory, SQLite database path, and file ownership
required runtime environment variables by name only
SOPS layout for app secrets, backup secrets, and provider OAuth credentials
reverse proxy/TLS origin used by the app
API-key bootstrap for CLI access
Google OAuth client setup for Calendar/Tasks sync, including redirect URI and scopes
migrations, backup/restore, and R2-compatible backup checks
what is explicitly out of scope: multi-user, app-login OAuth, reminders, PWA/offline app, mobile app

Acceptance criteria

A new operator can deploy a single-user Delta instance on NixOS from the repo docs.
No real secret values appear in docs, issues, logs, PR descriptions, or generated artifacts.
The docs distinguish app authentication from Google provider OAuth for sync.
Backup and restore steps are documented and testable.

## Problem Delta needs a reproducible single-user self-hosted deployment path. The production shape should match the current product decision: no app login flow, no multi-user account model, no reminders subsystem, no PWA/offline app requirement. Google OAuth may still exist only as provider integration for Calendar/Tasks sync. ## Solution Document the NixOS-first setup: - service user, working directory, SQLite database path, and file ownership - required runtime environment variables by name only - SOPS layout for app secrets, backup secrets, and provider OAuth credentials - reverse proxy/TLS origin used by the app - API-key bootstrap for CLI access - Google OAuth client setup for Calendar/Tasks sync, including redirect URI and scopes - migrations, backup/restore, and R2-compatible backup checks - what is explicitly out of scope: multi-user, app-login OAuth, reminders, PWA/offline app, mobile app ## Acceptance criteria - A new operator can deploy a single-user Delta instance on NixOS from the repo docs. - No real secret values appear in docs, issues, logs, PR descriptions, or generated artifacts. - The docs distinguish app authentication from Google provider OAuth for sync. - Backup and restore steps are documented and testable.

barrettruth added the

labels

2026-05-10 20:16:28 +00:00

barrettruth changed title from ~~reconisder self-hosting guide~~ to docs/self-hosting: document NixOS-first production setup

2026-05-10 20:16:28 +00:00

barrettruth added this to the v0.1.0 milestone

2026-05-10 20:16:28 +00:00

barrettruth referenced this issue

2026-05-11 18:30:03 +00:00

wontfix: self-hosted multi-user deployment model #118

barrettruth changed title from ~~docs/self-hosting: document NixOS-first production setup~~ to docs/self-hosting: document single-user NixOS production setup

2026-05-11 18:30:08 +00:00

barrettruth referenced this issue

2026-05-11 18:31:12 +00:00

v0.1.0 roadmap: single-user self-hosted launch #144

barrettruth referenced this issue

2026-05-12 13:53:30 +00:00

tracker: foundation hardening before Google sync #355

~~barrettruth referenced this issue 2026-05-14 16:16:19 +00:00~~

docs: simplify self-hosting guide #466

barrettruth referenced this issue from a pull request that will close it,

2026-05-14 16:47:38 +00:00

docs: simplify self-hosting guide #466