Server Operator Manual

Nyalin's smallest supported runtime is one application process, PostgreSQL, and S3-compatible object storage for media and derived remote-cache bytes.

Search backends and SMTP are optional attached services. Do not add Redis, NATS, Sidekiq, or a separate queue/cache service for the default deployment shape.

• NYALIN_DATABASE_URL points at PostgreSQL and is secret-bearing.
• NYALIN_PUBLIC_ORIGIN is the public HTTP(S) origin used for generated URLs.
• NYALIN_BIND_ADDR or PORT controls the listening socket.
• NYALIN_ACTOR_KEY_ENCRYPTION_KEY is required before creating local accounts or signing outbound ActivityPub delivery.
• NYALIN_OBJECT_STORAGE_* attaches S3-compatible storage for uploads and remote/cache derivatives.

Run the built-in admin command as a one-off process, then store the printed assignment in your secret store:

cargo run -p nyalin-app --no-default-features --features server -- generate-actor-key-encryption-key --key-id actor-key-2026-06

Treat the printed value as secret material. Do not commit it to .env files, docs, logs, screenshots, or support tickets.

1. Run scripts/local-dev-smoke.sh for a disposable end-to-end check. It starts MinIO plus a dedicated tmpfs-backed PostgreSQL 18 project; do not start the shared development PostgreSQL first.
2. The smoke init hook provisions per-run applying/runtime roles and the only application database, then the harness marks that database as disposable.
3. The harness applies the checked entity-first release with schema admin, then starts Dioxus with only the runtime credential.
4. On exit, the harness destroys its dedicated PostgreSQL container and network. Set all three documented database overrides only when intentionally testing an already-provisioned external database.
5. Do not use the legacy migration crate, a predecessor workflow, or a disposable candidate database as a fallback.
6. The app verifies the full runtime contract before workers or the request listener starts; a mismatch is a release/configuration failure.

• SMTP: set NYALIN_EMAIL_DELIVERY_MODE=smtp and the SMTP host, port, security, sender, and optional credentials. Plain SMTP is only for trusted local/internal relays such as Mailpit.
• Search: set NYALIN_SEARCH_BACKEND to typesense or meilisearch plus the matching endpoint and API key. PostgreSQL remains authoritative; search indexes are rebuildable derived data.

1. Back up PostgreSQL; it holds authoritative accounts, notes, sessions, moderation state, federation state, jobs, and cache metadata.
2. Back up object storage for uploaded media and processed derivatives according to your retention policy.
3. Back up NYALIN_ACTOR_KEY_ENCRYPTION_KEY separately. Losing it makes stored ActivityPub actor private keys undecryptable.
4. Ship logs through stdout/stderr or tracing-compatible process logs; do not write application-managed log files containing secrets.
5. No upgrade procedure exists before the first real deployment. The first supported catalog will be the full entity-derived empty-target schema; a later ADR must define upgrades from that real deployed state.