{
  "slug": "registry/self-hosted",
  "title": "Self-hosted Registry",
  "description": "Run Cuitty Registry as a standalone service backed by Cuitty Store.",
  "url": "https://cuitty.com/docs/registry/self-hosted",
  "markdown_url": "https://cuitty.com/docs/registry/self-hosted.md",
  "json_url": "https://cuitty.com/docs/registry/self-hosted.json",
  "frontmatter": {
    "title": "Self-hosted Registry",
    "description": "Run Cuitty Registry as a standalone service backed by Cuitty Store.",
    "order": 2,
    "section": "Registry",
    "updatedAt": "2026-06-09"
  },
  "headings": [
    {
      "depth": 2,
      "slug": "minimal-topology",
      "text": "Minimal topology"
    },
    {
      "depth": 2,
      "slug": "example-local-profile",
      "text": "Example local profile"
    },
    {
      "depth": 2,
      "slug": "example-production-profile",
      "text": "Example production profile"
    },
    {
      "depth": 2,
      "slug": "environment",
      "text": "Environment"
    },
    {
      "depth": 2,
      "slug": "operations-checklist",
      "text": "Operations checklist"
    }
  ],
  "body_markdown": "Cuitty Registry self-hosts as its own service. The deployment owns package metadata, protocol indexes, upload sessions, audit events, quotas, and blobs through Cuitty Store instead of writing artifacts into a Cuitty Code data directory.\n\n## Minimal topology\n\n| Component | Responsibility |\n| --- | --- |\n| Registry API | Admin API, npm, Cargo, PyPI, and OCI protocol endpoints |\n| Store records | Namespaces, packages, versions, tokens, uploads, quotas, and indexes |\n| Store blobs | Tarballs, crates, wheels, sdists, OCI manifests, and OCI layers |\n| Store events | Publish, yank, unyank, visibility, transfer, cleanup, and migration events |\n| SpiceDB | Namespace, package, token, publish, install, and admin permissions |\n| Auth issuer | User and service-token identity |\n| Worker | Outbox draining, upload cleanup, index rebuilds, scans, and replication |\n\n## Example local profile\n\n```toml\n[profile.registry-local]\nrecords = \"sqlite:///var/lib/cuitty/registry/records.sqlite\"\nblobs = \"file:///var/lib/cuitty/registry/blobs\"\nevents = \"sqlite:///var/lib/cuitty/registry/events.sqlite\"\n```\n\n## Example production profile\n\n```toml\n[profile.registry-production]\nrecords = \"postgres://registry:change-me@postgres/registry\"\nblobs = \"s3://cuitty-registry-artifacts\"\nevents = \"postgres://registry:change-me@postgres/registry_events\"\n```\n\n## Environment\n\n```bash\nPUBLIC_REGISTRY_URL=https://registry.example.com\nAUTH_ISSUER=https://auth.example.com\nAUTH_CLIENT_ID=cuitty-registry\nSPICEDB_ENDPOINT=https://spicedb.example.com\nSPICEDB_PRESHARED_KEY=change-me\nCUITTY_STORE_PROFILE=registry-production\nREGISTRY_MAX_UPLOAD_BYTES=104857600\nREGISTRY_OCI_UPLOAD_TTL_HOURS=24\n```\n\n## Operations checklist\n\n1. Start Store records, events, and blob storage.\n2. Start SpiceDB and load the Registry authorization schema.\n3. Start the auth issuer and provision the `cuitty-registry` client.\n4. Run Registry migrations.\n5. Start the Registry API and worker.\n6. Run native-client smoke checks for each enabled protocol.\n7. Configure backup jobs for Store records, events, and blobs.\n\nUse [the operator runbook](/docs/registry/operator-runbook) for smoke checks, recovery, and failure-mode handling.",
  "links_out": [
    "/docs/registry/operator-runbook"
  ]
}