Docs/Start

Getting started

Run a complete three-service RustyAuth realm—or the central Fleet stack—with generated local secrets and one command.

Prerequisites

Docker with Compose v2
Git, OpenSSL and curl
A browser with WebAuthn support

Start an isolated realm

git clone https://github.com/rusty-auth/rustyauth.git
cd rustyauth
scripts/local-stack standalone up

The launcher creates private values in the ignored .env.standalone.local, derives an ignored local YAML configuration and starts the Dioxus dashboard, RustyAuth realm backend and private SableDB. Open http://localhost:8081.

Nothing public is pre-seeded

The checked-in examples contain policy, not working secrets. The local launcher generates every secret independently and Compose rejects missing values by name.

Verify the stack

curl --fail http://127.0.0.1:8081/healthz
curl --fail http://127.0.0.1:8081/readyz
curl --fail http://127.0.0.1:8081/.well-known/passkey-auth
curl --fail http://127.0.0.1:8081/.well-known/jwks.json

Liveness proves the backend process is running. Readiness proves its private durable dependency is reachable. Capability discovery describes supported browser flows; backup health remains an authenticated operator concern.

Create the first operator

Follow the first-run dashboard flow to register the local allowlisted account. Production uses rustyauth operator promote <user-id> owner from a deployment shell: control of an email address alone never grants operator access. Add ?preview=1 locally to inspect populated sample data without mutating SableDB.

Run the Fleet control plane instead

scripts/local-stack fleet up

Open http://localhost:5196. This starts a separate Dioxus Fleet dashboard, control-plane API and private Fleet SableDB. Pair isolated realms through their management APIs; Fleet never receives direct database access.

Stop without deleting state

scripts/local-stack standalone down
# or
scripts/local-stack fleet down

The named SableDB volume survives container replacement. Pass --volumes only when you intentionally want to erase local identity data.