title: Deployment Guide description: Self-host phorvec server with Docker, configure for production, and manage licensing.

Deployment Guide

phorvec server is distributed as a Docker container. This guide covers everything needed to go from a first local run to a production-hardened deployment.

Getting Started

Docker Quick Start

The fastest way to run phorvec server is a single docker run command:

docker run -p 8000:8000 -v phorvec_data:/data phorvec-server:latest

This starts the REST API on port 8000 and stores all data in the phorvec_data Docker volume. No configuration is required. The server starts in development mode with Community Edition limits (3 agents maximum).

Verify the server is running:

curl http://localhost:8000/health

A healthy server returns:

{ "status": "ok", "version": "x.y.z", "edition": "community" }

Docker Compose

For a more complete local or production setup, use Docker Compose. The following example includes an optional Redis instance for distributed rate limiting:

version: "3.9"

services:
  phorvec:
    image: phorvec-server:latest
    ports:
      - "8000:8000"
    volumes:
      - phorvec_data:/data
    environment:
      PHORVEC_ENVIRONMENT: production
      JWT_SECRET_KEY: ${JWT_SECRET_KEY}
      PHORVEC_LICENSE_KEY: ${PHORVEC_LICENSE_KEY}
      CORS_ORIGINS: ${CORS_ORIGINS}
      REDIS_URL: redis://redis:6379
    depends_on:
      - redis
    restart: unless-stopped

  redis:
    image: redis:7-alpine
    volumes:
      - redis_data:/data
    restart: unless-stopped

volumes:
  phorvec_data:
  redis_data:

The dashboard is a separate static deployment (see Ports below). Deploy it independently on port 3000 and point it at the API on port 8000.

Environment Variables

Ports

Minimum Requirements

Disk usage grows with the number of agents and the total volume of stored vectors. Each 768-dimension float32 vector occupies approximately 3 KB of index space before quantization.

Production Security Checklist

Work through this checklist before exposing phorvec to any network traffic outside localhost.

1. Set PHORVEC_ENVIRONMENT=production — enforces strong secret requirements and strict CORS validation at startup.

2. Generate a strong JWT_SECRET_KEY — use a cryptographically random value of at least 32 characters:

   openssl rand -hex 32
   

3. Configure CORS_ORIGINS — specify the exact origins your dashboard and any API clients will use. Do not use * in production.

4. Enable HTTPS via reverse proxy — deploy phorvec behind nginx, Traefik, or a cloud load balancer that terminates TLS. Set FORCE_HTTPS=true in phorvec so plain HTTP is redirected.

5. Set up Redis for distributed rate limiting — if running more than one phorvec instance, configure REDIS_URL so that per-key rate limits are enforced consistently across all instances.

6. Restrict the data volume — the directory mounted at PHORVEC_STORAGE_PATH should be owned by the container user and not accessible to other processes on the host.

7. Rotate API keys regularly — revoke unused or old keys via DELETE /api/v1/keys/{key_id}. There is no cost to creating new keys.

8. Review audit logs — query GET /api/v1/audit or use the dashboard to review recent activity. Enterprise deployments should schedule regular exports.

Licensing

Community Edition

Community Edition is the default when no PHORVEC_LICENSE_KEY is set.

• Free, no registration required
• Maximum 3 agents
• Audit log limited to the last 100 entries
• All core MCP tools available
• REST API and dashboard available

Enterprise Edition

Enterprise Edition is activated by setting the PHORVEC_LICENSE_KEY environment variable.

• Unlimited agents
• Full audit log history with CSV/JSON export
• Cryptographic hash chain for tamper-evident audit records
• Configurable audit retention (AUDIT_RETENTION_DAYS)
• Priority support

Contact the phorvec team for an Enterprise license.

License Format and Validation

phorvec licenses are JWT tokens signed with RS256 (asymmetric RSA). The public key is bundled with the server binary.

• Offline validation — no network request is made at startup or during operation. Air-gapped deployments are fully supported.
• No phone-home — phorvec never contacts an external service to verify license status.
• Graceful fallback — an absent, invalid, or expired license key causes phorvec to fall back to Community Edition limits. The server continues running; only Enterprise-gated features become unavailable.

API Quick Reference

All endpoints require Authorization: Bearer <api_key> except /health.

For full request and response schemas, start the server and open http://localhost:8000/docs for the interactive OpenAPI documentation.