---
title: Deployment
summary: Self-host the FastYoke runtime — Docker Compose, a Terraform / OpenTofu module, or a Helm chart. One image, one license contract, single-node.
order: 12
---

# Deploying the self-hosted runtime

::callout{type="info" title="Early access"}
Self-hosted deployment is available for early-access pilots alongside
[On-Prem](/on-prem). The paths below are single-node today; multi-node
HA follows the private-cluster topology. Start the conversation from the
[On-Prem](/on-prem) page.
::

The runtime ships as a **single container image** that reads its license
at boot. The same image runs in every environment — what you build in
development deploys unchanged. Pick the path that matches how your team
already works.

## One license, injected at boot

A self-hosted runtime is licensed with an offline token. There is nothing
to phone home: the runtime verifies the token locally at startup and
unlocks the entitlements it grants. Supply it either as:

- the `FASTYOKE_LICENSE` environment variable, or
- a file mounted at `/etc/fastyoke/license.jwt`.

No token — or an expired one past its grace window — boots the free tier
rather than failing. A lapsed renewal never takes your app down; it just
stops the licensed capabilities from scaling up.

## Docker Compose (single node)

The fastest path for a single-node install. One `docker compose up`
against a persistent volume runs the runtime with your license injected;
a raw binary under `systemd` is the equivalent for a bare host. Right for
air-gapped and in-firewall deployments where you manage the host
directly.

## Terraform / OpenTofu (AWS)

An infrastructure-as-code module provisions the instance, a dedicated
persistent data volume, and networking on AWS — the same declarative
workflow your platform team already uses. It is written to run on
OpenTofu as well as Terraform, and takes the license as an input that is
delivered to the instance at boot.

## Helm (Kubernetes)

A chart deploys the runtime into your existing cluster as a single
replica. The license is supplied as a standard Kubernetes secret (bring
your own, or let the chart create it), and the database is backed by a
persistent volume claim. Optional ingress fronts the service when you
want external access.

## Verify a deployment

However you deploy, confirm the runtime is up and see which entitlements
your license granted:

```bash
curl http://<host>:8080/api/v1/health
```

The `license` block in the response echoes the current status (active, in
grace, or free tier) and the entitlements in effect.

## Going further

Every path above is **single-node** — one runtime against one database
volume. For high availability, geo, or disaster recovery inside your own
network, see the private-cluster topology on the [On-Prem](/on-prem)
page. For the development workflow that precedes any of these, see
[FastYoke Runtime](/runtime).