Self-Hosted Deployment¶

Run the daemon as a container, a systemd service, or a Kubernetes deployment. Single binary, no runtime dependencies.

Docker¶

The CloudSlash Dockerfile uses a multi-stage build:

1. Stage 1: Node 22 Alpine: builds the React/Vite Web UI
2. Stage 2: Go 1.23 Alpine: compiles the statically-linked binary
3. Final image: gcr.io/distroless/static-debian12:nonroot: minimal attack surface, no shell

The final image runs as a non-root user (nonroot, UID 65532) and exposes two ports:

Build the Image¶

git clone https://github.com/DrSkyle/CloudSlash.git
cd CloudSlash
docker build -t cloudslash:latest .

AWS Credentials¶

Run With

docker run -d \: name cloudslash \
  -p 8080:8080 \
  -p 8081:8081 \
  -v ~/.aws:/home/nonroot/.aws:ro \
  -v cloudslash-data:/home/nonroot/.cloudslash \
  cloudslash:latest

• ~/.aws is mounted read-only: CloudSlash reads credentials but never writes to them
• cloudslash-data is a named volume persisting the graph store, plugins, and history between restarts

Environment Variables¶

Run With

docker run -d \: name cloudslash \
  -p 8080:8080 \
  -e AWS_ACCESS_KEY_ID=AKIA... \
  -e AWS_SECRET_ACCESS_KEY=... \
  -e CLOUDSLASH_AI_KEY=sk-ant-... \
  -v cloudslash-data:/home/nonroot/.cloudslash \
  cloudslash:latest

Demo Mode¶

No Credentials

docker run -d \: name cloudslash-demo \
  -p 8080:8080 \
  cloudslash:latest \
  cs daemon --mock

Environment Variables¶

All configuration can be set via environment variables. They override config.yaml values but are overridden by CLI flags.

Standard cloud SDK environment variables (AWS_*, GOOGLE_APPLICATION_CREDENTIALS, AZURE_*) are respected automatically.

Fly.io¶

CloudSlash ships a fly.toml for direct Fly.io deployment:

app = 'cloudslash'
primary_region = 'iad'

[build]

[http_service]
  internal_port = 8080
  force_https = true
  auto_stop_machines = 'stop'
  auto_start_machines = true
  min_machines_running = 0

[[vm]]
  memory = '1gb'
  cpu_kind = 'shared'
  cpus = 1

[mounts]
  source = 'cloudslash_data'
  destination = '/home/nonroot/.cloudslash'

Deploy:

fly auth login
fly launch: no-deploy
fly secrets set AWS_ACCESS_KEY_ID=AKIA... AWS_SECRET_ACCESS_KEY=...
fly deploy

The auto_stop_machines = 'stop' setting scales to zero when idle, so you only pay when CloudSlash is actively used.

Self-Hosted¶

With systemd

Create /etc/systemd/system/cloudslash.service:

[Unit]
Description=CloudSlash Infrastructure Daemon
After=network.target

[Service]
Type=simple
User=cloudslash
ExecStart=/usr/local/bin/cs daemon
Restart=always
RestartSec=5
Environment="AWS_PROFILE=production"
Environment="CLOUDSLASH_AI_KEY=sk-ant-..."

[Install]
WantedBy=multi-user.target

Enable and start:

systemctl enable cloudslash
systemctl start cloudslash
systemctl status cloudslash

Reverse Proxy¶

nginx

To expose CloudSlash behind nginx with TLS:

server {
    listen 443 ssl;
    server_name infra.mycompany.com;

    ssl_certificate /etc/letsencrypt/live/infra.mycompany.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/infra.mycompany.com/privkey.pem;

    location / {
        proxy_pass http://localhost:8080;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }
}

GoReleaser Binaries¶

Pre-built binaries are available for:

Download from GitHub Releases or install via Homebrew:

brew tap DrSkyle/tap
brew install cloudslash