Self-hosting
What self-hosting means
Citadel ships as a single Go binary. You bring your own Postgres (via Supabase or a managed cluster), configure your own identity provider, and run the binary however you prefer — systemd unit, container, or bare process. No Citadel-controlled network hop is required at runtime.
License verification
Enterprise self-host requires a license file issued by Rethunk Engineering. The binary validates the license locally using an Ed25519 public key compiled into the release build. Verification is entirely offline — no request is made to any external server at startup or during operation.
The license file is a signed JSON document. The binary verifies the Ed25519 signature over the document payload, then checks the expiry date. If the signature is invalid or the file is missing, the binary refuses to start in licensed mode.
Grace period
After a license expires, the binary continues operating for a 7-day grace period. Expiry warnings appear in the admin panel during the 30 days before expiry and throughout the grace window.
IP allowlist
License files may include an allowed_ips field constraining which server IP addresses may use the license. Plain IPs and CIDR ranges are both accepted. If allowed_ips is absent, no IP restriction is applied.
Identity provider
Citadel does not bundle an identity provider. Self-host deployments connect a Supabase project (or compatible Auth server) for user authentication. The binary consumes the resulting JWTs; it does not issue them.