Run it on boxes you own

1. # Self-hosted: the bundled Postgres, pgbouncer, Valkey and ClickHouse containers
2. COMPOSE_PROFILES=bundled
4. # openssl rand -hex 32 - admin sessions, core alone
5. ADMIN_JWT_SECRET=••••••••••••
6. # Customer sessions, Ed25519 - core signs with the private key
7. CUSTOMER_JWT_PRIVATE_KEY=••••••••••••
8. CUSTOMER_JWT_PUBLIC_KEY=••••••••••••
9. # openssl rand -hex 32 - unsubscribe, open and click links
10. EMAIL_LINK_SECRET=••••••••••••
11. REVIEW_VOTER_TOKEN_SECRET=••••••••••••
12. SIGNALS_SERVICE_SECRET=••••••••••••
13. # openssl rand -base64 32, keep stable
14. CONFIG_ENCRYPTION_KEY=••••••••••••
15. SIGNALS_ENCRYPTION_KEY=••••••••••••
17. DB_PASSWORD=••••••••••••
18. SIGNALS_DB_PASSWORD=••••••••••••
19. VALKEY_PASSWORD=••••••••••••
20. CLICKHOUSE_PASSWORD=••••••••••••
22. # The hosts browsers upload files to - the S3 presign host, or STORAGE_UPLOAD_URL
23. UPLOAD_ORIGINS=https://media-bucket.s3.eu-central-1.amazonaws.com

{"time":"2026-10-25T09:31:02.118Z","level":"ERROR","msg":"production config error","issue":"TRUSTED_PROXIES must be set in production: your proxy/LB CIDRs (so forwarded client IPs are trusted for rate limiting), or the literal 'none' if the backend is directly internet-facing"}{"time":"2026-10-25T09:31:02.118Z","level":"ERROR","msg":"production config error","issue":"ADMIN_JWT_SECRET and EMAIL_LINK_SECRET must differ - they are held by different tiers, and one value would hand over both"}{"time":"2026-10-25T09:31:02.118Z","level":"ERROR","msg":"production config error","issue":"CORS_ALLOWED_ORIGINS must list the deployed frontend origins (empty blocks all browser API calls)"}{"time":"2026-10-25T09:31:02.119Z","level":"ERROR","msg":"server exited with error","err":"refusing to start: 3 production config error(s) - see logs above"}

• shop.example.comvetrina-demo:3000The storefront - every channel's host can point at the same upstream
• admin.example.comdashboard:8080The admin - its own nginx proxies /api/* to the backend in-network, so it needs no API host
• api.example.comapp:8080Inbound payment webhooks - providers POST to /api/v1/payments/webhook/<provider>, the URL you register with them
• api.example.com/t/*ingest:8091The beacons, once the ingest tier is scaled out - app proxies them on otherwise
• api.example.com/media/t/*media:8083Image transforms, likewise - app serves the route either way

$ cp env/prod-caddy.env.example env/prod-caddy.env# domains + ACME email$ docker compose -f docker-compose.small.yml --profile edge up -d

{$STOREFRONT_DOMAIN:localhost} {  import security_headers  encode zstd gzip  reverse_proxy vetrina-demo:3000}{$API_DOMAIN:api.localhost} {  import security_headers  encode zstd gzip  # reverse_proxy /media/t/* media:8083  # reverse_proxy /t/* ingest:8091  reverse_proxy app:8080}

$ REGISTRY=registry.example.com ./skelet release v0.1.0==> build registry.example.com/skelet-app:v0.1.0  (linux/amd64)==> push  registry.example.com/skelet-app:v0.1.0==> build registry.example.com/skelet-signals:v0.1.0  (linux/amd64)==> push  registry.example.com/skelet-signals:v0.1.0==> build registry.example.com/skelet-dashboard:v0.1.0  (linux/amd64)==> push  registry.example.com/skelet-dashboard:v0.1.0==> build registry.example.com/skelet-vetrina-demo:v0.1.0  (linux/amd64)==> push  registry.example.com/skelet-vetrina-demo:v0.1.0Pushed tag: v0.1.0Deploy with (docker-compose.prod.yml reads these):  export APP_IMAGE=registry.example.com/skelet-app:v0.1.0  export SIGNALS_IMAGE=registry.example.com/skelet-signals:v0.1.0  export DASHBOARD_IMAGE=registry.example.com/skelet-dashboard:v0.1.0  export VETRINA_DEMO_IMAGE=registry.example.com/skelet-vetrina-demo:v0.1.0  docker compose -f docker-compose.prod.yml up -d

1. startnothing set

   One app container runs every backend role - the API, websockets, media transforms, the scheduler, webhook delivery and the outbox relay - beside one Postgres.

   • app
   • db

2. envVALKEY_URL=redis://…

   Caches, rate limits and lockouts shared across processes, notifications that reach every replica, and draft previews - the one feature that needs it. Keep it once there is more than one replica.

   • app ×2
   • db
   • valkey

3. envOPENSEARCH_URL=https://…

   Tuned relevance, stemming, merch boosts and facets on every attribute. Without it, browse runs on Postgres - slower on a big catalogue, never empty.

   • app ×2
   • db
   • valkey
   • opensearch

4. envJOBS_EXTERNAL=true

   The app stops claiming scheduler jobs, webhook deliveries and outbox rows, and the worker takes them. They are claimed through the database, so worker replicas split the work.

   • app ×2
   • db
   • valkey
   • opensearch
   • worker

5. edge/media/t/* → media:8083

   Image decode and resize get a CPU budget of their own. Warm images redirect to the bucket, so at steady state the tier mostly idles.

   • app ×2
   • db
   • valkey
   • opensearch
   • worker
   • media

6. envSIGNALS_ENABLED=true

   The Signals suite, in the full shape: a process of its own, its own Postgres, and ClickHouse for the event spine.

   • app ×2
   • db
   • valkey
   • opensearch
   • worker
   • media
   • signals
   • signals-db
   • clickhouse

7. edge/t/* → ingest:8091

   A spike on the beacons saturates this tier instead of checkout. It keeps no state, so scale it freely.

   • app ×2
   • db
   • valkey
   • opensearch
   • worker
   • media
   • signals
   • signals-db
   • clickhouse
   • ingest

1. -COMPOSE_PROFILES=bundled
2. +DATABASE_URL=postgres://…@your-managed-pg:5432/skelet?sslmode=require
3. +SIGNALS_DB_URL=postgres://…@your-managed-pg:5432/skelet_signals?sslmode=require
4. +VALKEY_URL=rediss://…
5. +SIGNALS_CH_URL=clickhouse://user:password@your-managed-ch:9440/signals?secure=true

• app/healthPings Postgres and Valkey40s to drain10s HTTP, 10s background workers, 15s event bus
• app/readyzAnswers 503 while optional pieces are unconfigured-
• worker:8081/healthzScheduler jobs, webhook delivery, the outbox relay35s to drainKilled early, in-flight jobs wait out their lease
• media:8083/healthzImage resize and focal crop20s to drain10s draining, then 5s flushing telemetry
• signals:8090/healthzRetention, forwarding, trait compute35s to drainA retention prune won't finish inside 10s
• ingest:8091/healthzThe public /t beacons20s to drain10s stopping, then 5s flushing telemetry

$ sh -c "dbmate --no-dump-schema --wait --migrations-dir /app/migrations up && skelet plugin migrate up && skelet data-patch up"# the schema, every enabled plugin's migrations, then the run-once data patches - app waits for it to exit 0