Standalone deployment
Single-binary install for one Linux host. Bundles nginx, sets up a local MongoDB, and bootstraps secrets. The fastest path to a production-shaped instance for a single project.
Multi-VM deployment
Two or more standalone hosts behind one load balancer, sharing a single external MongoDB. Same one-command bootstrap as standalone — every host beyond the first adopts the cluster's secrets via --secrets-from. Works with both KEK backends (env hex bytes in secrets.env, or PKCS#11 keys inside an HSM).
Docker Compose
Reference compose file for local development and small production. Volumes for state, environment-driven secrets, healthchecks on every service, and a one-shot upgrade path.
Helm chart
Production Kubernetes deployment with split API / worker / scheduler workloads, leader election, External Secrets integration, and an opinionated PodDisruptionBudget for upgrades.
High availability
Replicate every layer: a 3-member MongoDB replica set, multi-replica API, leader-elected scheduler, and rolling upgrades that never drop in-flight ACME orders.
Upgrade
CertAutoPilot upgrades in place. The binary is the only moving part; state lives in MongoDB and the secret store, both of which are preserved across upgrades. Index migrations run at startup. Rollback is "run the previous binary" — no schema migrations to reverse.
Backup & restore
Two things must be backed up together: MongoDB (all the data) and the secret store (the KEK that can decrypt it). Losing either makes the other useless. Every backup strategy in this doc backs up both at the same point in time and stores them off-host.
Outbound network access
The hosts and ports CertAutoPilot reaches from your network. Use this page to scope egress firewall rules. Only the services you actually configure need to be reachable — start with the always-on group, then open the rest as you turn features on.