Self-hosting Algoryq Learn in an afternoon

The whole platform boots from one compose file: API, worker, PostgreSQL, Redis, object storage, search and a mail catcher. No cloud account, no licence key, no phone-home.

The three commands

docker compose up -d
pnpm db:migrate && pnpm db:rls && pnpm db:seed
pnpm --filter @akechi/api worker:devdocker compose up -d
pnpm db:migrate && pnpm db:rls && pnpm db:seed
pnpm --filter @akechi/api worker:dev

The second line is three steps for a reason. Migrations create the schema. Row-level security is applied separately, from the database catalogue, so a table added later is covered automatically — a policy living in one migration is a policy somebody forgets on the next table. The seed creates the permission catalogue, the role templates and, optionally, a demo institute.

The third line matters more than it looks

Email is written to a transactional outbox in the same transaction as the thing that caused it, then drained by a worker. Without the worker nothing is lost, but nothing is sent either. Run exactly one copy: its jobs claim no rows, so a second double-sends.

What you take on

• Backups, and — more importantly — a restore you have actually tested.
• TLS, and keeping it renewed.
• The database role split: the application connects as a role that is not the owner and holds no BYPASSRLS. Do not run it as the owner to make a problem go away; that is the problem.
• Upgrades, which are migrations you run.