Deploying

Templates for each of these are in deploy/.

macOS: start at loginCopy Anchor Link

deploy/com.soldermask.serve.plist is a launchd agent. Edit the three paths and the API key, then:

cp deploy/com.soldermask.serve.plist ~/Library/LaunchAgents/
launchctl load ~/Library/LaunchAgents/com.soldermask.serve.plist
tail -f ~/Library/Logs/soldermask.log        # the banner, the QR code, the access log

KeepAlive restarts it if it dies. Java must be reachable from the agent's environment — Homebrew's OpenJDK is found automatically.

Linux: systemdCopy Anchor Link

deploy/soldermask.service runs the app as its own user with SOLDERMASK_HOME=/var/lib/soldermask, restarts on failure, and applies the usual hardening (NoNewPrivileges, ProtectSystem=full, a writable data directory only).

sudo cp deploy/soldermask.service /etc/systemd/system/
sudo systemctl daemon-reload && sudo systemctl enable --now soldermask
journalctl -u soldermask -f

Behind nginxCopy Anchor Link

deploy/nginx.conf terminates TLS with a real certificate and proxies to the app on plain HTTP. Two lines matter for the event stream: proxy_buffering off and a long proxy_read_timeout. Run the app as:

soldermask serve --http --port 8080 --proxy

--proxy makes it trust the forwarded headers and require the token from everyone, since all requests now look local.

ContainersCopy Anchor Link

No image is shipped: the router needs a Java 25 runtime and a 60 MB jar that is not in the repository, and the project has not been verified in a container. The systemd unit is the supported Linux path.

BackupsCopy Anchor Link

projects/ is the only state worth keeping — plain files, safe to copy while the server runs (writes are atomic). .cache/ is reproducible. The access token is .cache/access-token.