Deployment overview

Two things in the SuperFile family can run on infrastructure you control today.

The rest of this section is the operator's manual for SuperDRM: what it is made of, how to install it, configure it, protect its keys and run it.

#What you are deploying

SuperDRM is four stateless services and one database. Every service is a container image built for linux/arm64 and linux/amd64, every setting is an environment variable, and the only durable state is Postgres plus the key-encryption key (KEK). That is what makes it portable: the same images run on a laptop, a single VM, Kubernetes, or a customer's own network.

Runtime: Node 24, non-root, health checks on /health (api) and /healthz (docs, live).

#Topologies

#1. Single VM with Docker Compose (recommended first production host)

git clone https://github.com/shanesupers/superdrm && cd superdrm/deploy/compose
DOMAIN=drm.example.com ./install.sh                                   # pulls images, generates secrets, starts, creates tenant "default"
DOMAIN=drm.example.com PROFILE=edge ./install.sh                      # + Caddy with automatic TLS (ports 80/443 open)
DOMAIN=drm.example.com PROFILE=tunnel TUNNEL_TOKEN=… ./install.sh     # + cloudflared, no open ports
BUILD=1 DOMAIN=… ./install.sh                                         # build the images from this checkout instead of pulling

install.sh writes .env (every variable; see .env.example), secrets/kek.hex (back it up offline: every content key is sealed under it), secrets/docs.password and secrets/demo-tenant.json (the first tenant's API key and token secret, shown once). Ports bind to 127.0.0.1 by default; the edge and tunnel profiles are the two ways to expose the four hostnames.

Sizing: 2 vCPU / 4 GB handles thousands of licences per minute (a licence is one Postgres insert and one signed HTTPS call). Postgres grows about 200 bytes per licence row.

#2. Kubernetes with Helm

helm upgrade --install superdrm deploy/helm/superdrm \
  --set domain=drm.example.com \
  --set secrets.adminToken=$(openssl rand -hex 32) --set secrets.docsSessionSecret=$(openssl rand -hex 32) \
  --set secrets.docsPasswordHash='scrypt$…' --set postgres.password=$(openssl rand -hex 24) \
  --set secrets.kekHex=$(openssl rand -hex 32)          # local vault; prefer the pkcs11 / aws-kms values below

The chart gives you: Deployments for api (HPA 2–10, PodDisruptionBudget, rolling with zero unavailable), console, docs and live; an optional in-cluster Postgres StatefulSet or postgres.externalUrl; a pre-install/pre-upgrade migration Job; Ingress with TLS (cert-manager annotation by default; the console is not exposed unless ingress.exposeConsole=true); vault.provider=pkcs11 with a hostPath/CSI mount of your HSM vendor's PKCS#11 client, or vault.provider=aws-kms with an IRSA role on the ServiceAccount; ksm.enabled for the FairPlay sidecar; secrets.existingSecret to bring your own Secret.

#3. Bare metal or VM with systemd

ops/install.sh plus the four ops/superdrm-*.service user units, with env files under ~/.config/superdrm/. Postgres via DATABASE_URL, or the embedded PGlite for a single node. See Operations & migration.

#Database

Postgres 16 is the production database. The api talks plain SQL through one thin adapter; migrations are the files in db/migrations, applied by the api at boot, by npm run migrate, or by the Helm hook Job. The whole test suite runs against real Postgres and against embedded PGlite.

PGlite is for development, tests and single-node staging only: one process, one directory, no replication, no concurrent writers.

Backups: pg_dump nightly (Compose: docker compose exec postgres pg_dump -U superdrm superdrm | gzip > backup.sql.gz), plus the KEK material kept separately and offline. A database backup without the KEK is ciphertext; a KEK without the database is nothing. Restore drill: new stack → superdrm import the bundle or psql < backup → superdrm verify-kek.

#TLS and exposure

Only the api's licence routes must be reachable by players; everything else can stay private. Choose one: the Compose edge profile (Caddy, Let's Encrypt), the tunnel profile (cloudflared, no inbound ports), your Kubernetes Ingress, or your own load balancer. The api sets no cookies and licence routes are CORS-open by design; put a WAF or rate limit in front of /v1/*/license/* in public deployments.

#Upgrades

Images are tagged by git SHA and by version. Migrations are additive and idempotent; the api applies pending ones at boot (or the Helm hook does). Upgrade = pull the new tag, restart api first, then the others. Roll back by pointing the tag back; schema changes never drop columns in a release that a previous version still reads.

#Vault per platform

Details and the key ceremony: Hardware key vault.

#Hosting tiers we operate and offer

The code is identical across tiers: SUPERDRM_VAULT is the only switch.

Updated September 2026