Running in production

soldermask serve is production-shaped out of the box. There is no separate "dev server" mode to forget to switch off.

What the server doesCopy Anchor Link

• Hypercorn serves the app: TLS with a self-signed certificate for the LAN address (or your own behind a proxy), HTTP/2, keep-alive, graceful shutdown that ends every event stream with a bye and finishes in about a second.
• Builds run as jobs in a bounded thread pool (--workers, default 2). A request never waits on the model or the router.
• Compression for JSON and HTML, immutable caching for the versioned static bundle (/static/*?v=<version>), a day of caching for version files, no-store for pages and API answers.
• No third-party requests. three.js and the fonts are vendored; the app works on a LAN with no internet. (The standalone export uses CDNs, since it must be one file.)
• Hardening: a Content-Security-Policy with per-request nonces, Strict-Transport-Security on TLS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, an 8 MB body limit, a 20,000-character message limit, five-strike lockout on the login page.
• Access control by default — see Access control.
• Observability: an access log with timings (sync traffic filtered out), Server-Timing on every response, /api/health that never touches git, Java or the disk, and /about for the full picture.

The one constraintCopy Anchor Link

One process per data directory. Jobs, the event bus and per-project locks live in memory. Do not run two servers against the same projects/, and do not put a multi-worker WSGI server in front of it. Scale by giving each team or workspace its own directory and port.

ResourcesCopy Anchor Link

A build runs freerouting under Java (hundreds of MB, a minute or two of CPU) and, on first use of a part, fetches its footprint and 3D model. Two concurrent builds are comfortable on a laptop; raise --workers on a bigger machine. The caches grow slowly; .cache/ can be deleted at any time.

LogsCopy Anchor Link

Stderr by default, or --log-file PATH. Lines look like 2026-09-01 10:19:17 INFO hypercorn.access: 127.0.0.1:51817 "POST /api/projects/x/chat 2" 202 512 11342us. Job start, finish and failures (with tracebacks) are logged under soldermask.jobs.

UpgradingCopy Anchor Link

Pull, pip install -e ., restart. Projects written by an older layout are migrated on first read with a backup left beside them; see Projects on disk. Check /about afterwards: it names the running version and whether it is tagged.