Docs / Running the platform
Running the platform
For whoever runs the installation itself: the person who put it on a machine, holds its keys, and is above every tenant on it.
Installing is not on this page. There are two guides that instruct, and they are the only place a command is written down:
- Running it locally — the three processes on one machine, and the complete list of every setting the platform reads.
- Installing on one box — a real installation in containers, behind a proxy, with backups and the procedure for retiring a key.
This page is what those guides cannot be: the short list of decisions that are yours rather than a tenant’s, and where each one is made.
The profile you run under
The installation runs in one of two profiles, and the difference is not a matter of degree. In production the platform fails closed: it refuses to start on a placeholder key ring, refuses without the key its records are chained under, refuses without the credential its own two halves talk to each other with, and refuses to talk to a browser over an unencrypted connection. It also requires a second factor of everybody by default, and marks its cookies so a browser will only send them encrypted.
In the other profile all of that is a warning, because a laptop is not a threat model. That is the whole of it: nothing is slightly on. Choosing the production profile is how you tell the platform to stop being helpful about things that are not safe.
The profile the installation is running under is shown on its own status panel, so the answer to “is this really production” is never a guess.
Two addresses only you can set
The platform has one mail account of its own, separate from anything a tenant configures, and it is where invitations and password resets come from. Beside it are two decisions:
Where the platform reports about the machine. Not about anybody’s integration — about the box: a node that stopped accepting work, a request whose configuration never arrived, a shutdown. Give it an address and those reach somebody. Leave it blank and they stay in the node’s own log, which is what the platform will tell you it did rather than going quiet.
Whether the platform’s address may carry a tenant’s bad news. A tenant whose notification rule names no mail account of its own normally reaches nobody — and there is a switch that lets the platform send those alerts from its own address instead. It is off unless you turn it on, deliberately: this is the installation’s identity sending mail about somebody else’s failure.
It covers exactly one case. A rule naming an account that does not resolve, or naming none where the environment has several, still refuses — those are the author’s mistakes and the platform does not paper over them. A tenant reading Reacting to failures is told the switch exists and told to ask you.
Both live on the same screen as the mailbox itself, and both are yours alone: no tenant administrator sees them.
What you hold that nobody else does
- Creating tenants, and deleting one. A tenant is created with its two environments and no control adds a third.
- Taking an environment grant away, and deciding who administers a tenant. A tenant administrator gives access and changes it; removing it, and naming another administrator, are yours — see Administering a tenant.
- The key ring, and retiring a key from it. The procedure is in the installation guide, including the one thing about it that is easy to get wrong: take the backup after the retirement, not before.
- The whole record. Every tenant’s trail is readable from one place, which is the only view that crosses a tenant boundary anywhere in the product.
Where a number lives
Every setting the platform reads is in one table, in the local guide’s environment reference, and it is held against the platform in both directions: a setting the platform reads and the table does not list fails the build, and so does a row naming a setting nothing reads.
That is deliberately not repeated here. A second copy of a table like that is wrong the first time somebody changes a default, and this page would have no way of knowing.