Deploy
Self-contained vs external Compose layouts, plus network trust
SliceSeeker is an internal stack. Do not publish admin-ui, indexer-api, tusd, or search-api to the public internet. There is no app-level login; network isolation is the security model.
Network isolation covers the admin UI and the APIs. It does not cover your media: indexing sends media and text to a third-party AI gateway. Review Data handling before indexing confidential material.
Two deployment layouts. Same application images and phase model; they differ only in where Postgres, Valkey, and object storage run.
| Layout | Use when |
|---|---|
| Self-contained | You want every dependency as a container on one host (eval, single-node) |
| External | You already have Postgres, Redis/Valkey, and S3-compatible storage |
Application services always run as containers: indexer-api, indexer-worker, admin-ui, search-api, and tusd.
Build the five SliceSeeker images from source or pull a tagged release from GHCR — see Container images.
Network trust
| Who | How they should reach the stack |
|---|---|
| Operators (admin UI) | Private path only — Docker private network, bastion, VPC, or an overlay VPN such as Tailscale or WireGuard. None of those are required by the project; pick what you already run. |
| Backend services (search-api) | Internal Compose / cluster hostname only (e.g. http://search-api:3001) |
Compose ports: in the examples are for lab / single-host convenience. In production, bind to a private interface, omit host publish and reach services over an overlay/VPN, or put the stack behind a private reverse proxy. Do not map :8080 / :3000 / tusd / :3001 to 0.0.0.0 on a public host.
S3_PUBLIC_ENDPOINT must be browser-reachable for admin UI playback — but only on that same private/VPN path, not on the open web.
Quick start
Self-contained (merge infra + phase files):
cp deploy/self-contained/.env.example deploy/self-contained/.env
# set AI_GATEWAY_API_KEY
docker compose -f deploy/self-contained/docker-compose.infra.yml --env-file deploy/self-contained/.env up -d
docker compose -f deploy/self-contained/docker-compose.infra.yml -f deploy/self-contained/docker-compose.phase1.yml --env-file deploy/self-contained/.env up -d
docker compose -f deploy/self-contained/docker-compose.infra.yml -f deploy/self-contained/docker-compose.phase2.yml --env-file deploy/self-contained/.env up -dExternal (run init once first):
cp deploy/external/.env.example deploy/external/.env
# set DATABASE_URL, VALKEY_URL, S3_*, AI_GATEWAY_API_KEY
docker compose -f deploy/external/docker-compose.init.yml --env-file deploy/external/.env up
docker compose -f deploy/external/docker-compose.phase1.yml --env-file deploy/external/.env up -d
docker compose -f deploy/external/docker-compose.phase2.yml --env-file deploy/external/.env up -dCompose files live under deploy/ in the repository. See Operations for Valkey noeviction, pool sizing, and readiness.
Third-party images in these examples (Postgres/pgvector, Valkey, tusd, RustFS) are pinned to explicit tags and pulled from their own registries.