Run a server

This section is for the person who runs a Lasbolt server. You do not need it to use Lasbolt on a server that someone else runs.

What the server is

lasboltd is one Go program. It has no other part to install.

One binary. It has no C library and no runtime. CGO_ENABLED=0 builds it.
SQLite. The database is one file in the data folder (lasbolt.db). There is no database server to run.
An embedded web app. The web pages and the WASM crypto code are inside the binary. The server loads nothing from other hosts.
A control socket. The program lasboltctl talks to a running server through a Unix socket on the same host. The socket has no network port.

One server is one organisation. The server stores ciphertext and some data that it can read (the server-readable spaces). It never gets a master password or the encryption key of a user. See Security.

What you need

Item	Need
Host	A Linux host with systemd is the tested way. macOS also runs `lasboltd`, for tests.
Memory and disk	A small host is enough for a few users. The database grows with the number of items.
Go 1.27 and `make`	Only to build from source. There is no release archive yet.
A DNS name and a TLS certificate	Browsers and the apps need HTTPS. A reverse proxy holds the certificate.
A reverse proxy	Caddy or nginx. `lasboltd` speaks plain HTTP.
An unseal secret	A passphrase or a key file. See Sealing and keys.

How the parts fit

    flowchart LR
  C["Browsers and apps"] -->|"HTTPS"| P["Reverse proxy<br/>(TLS)"]
  P -->|"HTTP on 127.0.0.1"| D["lasboltd"]
  D --> DB[("data dir<br/>lasbolt.db")]
  D -->|"on a schedule"| BK[("data dir<br/>backups/")]
  BK -.->|"copy, sealed"| OFF[("Off-site store")]
  CTL["lasboltctl"] -->|"Unix socket"| D
  KEY["Unseal passphrase<br/>or key file"] -->|"at start"| D