Self-hosting overview & architecture
- Written for
- ＋ Written for
- Deprecated
- ＋ Deprecated
- Applies to
- ＋ Applies to
Self-hosting overview & architecture
Atlas is fully self-hostable — you can run the whole platform on your own infrastructure, with your data in your database. This section explains the moving parts and how to deploy, configure and operate them.
The services
A deployment is a small set of containers built from the Atlas repository:
Service | What it is | Responsibilities |
|---|---|---|
api | Fastify server | The Frontend API, Backend API and dashboard API, plus SCIM, the OIDC OP, DiscourseConnect, LTI and the Stripe billing webhook |
web | Static SPA (nginx) | The dashboard single-page app |
worker | Background worker | Webhook delivery, scheduled sweeps and other async jobs |
marketing | Static site (nginx) | The landing page and hosted sign-in/sign-up entry |
They share two stateful dependencies:
PostgreSQL — the system of record for every instance's users, sessions, organizations, connections, webhooks and audit log.
Redis — rate-limit counters, idempotency keys and other ephemeral state.
One origin, by design
The API and the SPA must be served from one origin over HTTPS. The refresh cookie (__atlas_rt) is SameSite=Lax, Secure, Path=/v1, so the app and API have to be same-site — a reverse proxy (Traefik in the reference deployment) terminates TLS and routes by path: /v1, /.well-known, /hosted, /embed.js, /scim, /oauth2, /discourse, /lti and /stripe go to api, /dashboard to web, and everything else to marketing.
Tenant isolation
Atlas enforces tenant isolation in the application layer (an InstanceScope the repositories go through), not Postgres row-level security. In practice that means it connects to a single dedicated database and never needs a separate DB role per tenant — the scope guarantees no query crosses an instance boundary.
The platform instance
Atlas dogfoods itself: the dashboard is authenticated by a platform instance (PLATFORM_INSTANCE_ID) — an Atlas instance like any customer's, created by the bootstrap step. That's why signing in to your own dashboard uses the same sign-in flow your customers get.
Deployment options
The reference deployment targets Docker Compose on Coolify, and there are Kubernetes manifests in the repo (deploy/k8s). Either way the shape is the same: the four services, Postgres and Redis, behind one TLS origin.
Next
Stand it up → Deploying Atlas.