Self-Managed Deployment

The appliances ask for the database, DNS and certificate in one form and run their own ingress. Running Broch yourself means deciding each of these before you install. All deployment files live in broch-io/broch-deploy.

Platforms

Platform	Database	TLS	Status
Docker Compose, any Linux host	Bundled or external Postgres	Caddy (automatic DNS-01) or your own cert	Supported
DigitalOcean Droplet, via Terraform	Bundled Postgres on block storage	Caddy (automatic DNS-01 on DigitalOcean, Cloudflare or GoDaddy DNS)	Supported
Azure Container Apps, via Terraform	Postgres Flexible Server, private in the module’s VNet	Managed cert for the hostname only; the wildcard is yours	Beta
AWS ECS Fargate, via Terraform	RDS	ACM (DNS-validated)	Beta

Docker Compose is the most portable choice and works anywhere Docker runs. DigitalOcean is the simplest single cloud VM.

Platforms that don’t work: Heroku, Google Cloud Run, AWS App Runner, Fly.io, Render and Railway. Every tunnel URL is a subdomain, so a wildcard certificate must terminate at an ingress you control, and these platforms issue only single-hostname certificates.

Before You Install

Step	Decide	Guide
1	Bundled or external PostgreSQL	Database
2	Your hostname and its wildcard record	Wildcard Domain & DNS
3	How the wildcard certificate is issued and renewed	TLS Certificates
4	What terminates TLS in front of Broch	Ingress & Reverse Proxy
5	Register the identity provider app	Identity Providers

Startup Settings

Broch refuses to start without the first three. It starts without an identity provider, but no one can sign in until one is set, and once you start setting one it refuses to start until the provider’s required values are all there. The deployment files wire these in. On Docker Compose, set the .env names; the compose file passes them on.

Setting	Variable(s)	Docker Compose .env	Notes
Master key	BROCH_MASTER_KEY	The same	The root of at-rest encryption, at least 32 bytes. The Terraform modules generate it (DigitalOcean on the Droplet at first boot); for Docker Compose, generate it with openssl rand -base64 48. Keep the same value on every redeploy. See At-Rest Encryption.
Database	ConnectionStrings__BrochConnection	POSTGRES_PASSWORD (bundled) or BROCH_DB_CONNECTION_STRING (external)	PostgreSQL 14+.
Hostname	API__WILDCARDHOSTNAME	BROCH_WILDCARD_HOSTNAME	The domain tunnels are served under, such as broch.{your-domain}.
Identity provider	AUTHENTICATION__*	The same	Includes AUTHENTICATION__ADMINROLES: a role your first admin holds in the IdP. Without it, no one can administer the server.

# Provider is one of: Auth0, AzureAd, EntraExternalId, Okta, Oidc (any OIDC issuer)
AUTHENTICATION__PROVIDER=Auth0
AUTHENTICATION__CLIENTID=<your-client-id>
AUTHENTICATION__CLIENTSECRET=<your-client-secret>
AUTHENTICATION__DOMAIN={your-tenant}.auth0.com
# Auth0 only: the Identifier of your Auth0 API. Broch will not start without it.
AUTHENTICATION__AUDIENCE=https://broch.{your-domain}
# Comma-separated; holding any listed role grants admin.
AUTHENTICATION__ADMINROLES=broch_admin

In a Docker Compose .env, single-quote a value containing spaces, # or $; see Docker Compose → Setup. The license isn’t a startup setting. Environment Variables lists everything else.

After You Install

1. Sign in at https://broch.{your-domain} with an account holding an admin role. Setup offers the free trial or a purchase. The trial is free until the 1st of the month, at least 15 days, with a card upfront, first charged on that 1st. See Licensing & Billing.
2. Check the proxy is trusted under Configuration → Reverse Proxy, which warns if it isn’t.
3. Grant access. Share is deny-by-default: add a Share Policy for your developers’ IdP role.
4. Invite developers. Send them Sharing Local Services to install the CLI and open their first tunnel.

Scaling

Scale one instance vertically: a single instance handles many concurrent users and tunnels. Beyond that, run independent instances, for example one per region or team, each with its own database and license. Clustering several instances on one database isn’t available yet; if you need it, contact [email protected].