ChronoSeal Deployment Guide

ChronoSeal runs as a native Unix daemon behind TLS, serving WebAssembly assets. This guide covers building, configuring, and service installation options.

System Requirements

Building from Source

Install the Rust WASM build targets and tools:

rustup target add wasm32-unknown-unknown
cargo install wasm-pack

Build the browser WASM package and compile the server daemon:

# Build WASM package and copy to frontend assets
wasm-pack build wasm --target web --release
rm -rf frontend/pkg
mv wasm/pkg frontend/pkg

# Build release server daemon
cargo build -p chronoseal-server --bin chronoseal --release

The compiled binary is written to target/release/chronoseal.

Native Service Installation

The easiest way to deploy ChronoSeal on Linux is using our installer script. This creates a dedicated system user, configures directory paths, copies assets, and sets up systemd sandboxing:

sudo bash scripts/install.sh

Verify installation operational status:

sudo systemctl status chronoseal
chronoseal health
sudo journalctl -u chronoseal -f

Configuration Precedence

ChronoSeal resolves configuration variables in this order: CLI parameters > CHRONOSEAL_* Environment Variables > TOML file > Defaults.

The TOML configuration is searched at: $CHRONOSEAL_CONFIG, /etc/chronoseal/config.toml, ~/.config/chronoseal/config.toml.

Common Environment overrides

• CHRONOSEAL_BIND: Binding address (e.g. 127.0.0.1:3000).
• CHRONOSEAL_DB_TYPE: sqlite-in-memory, sqlite-in-disk, or valkey.
• CHRONOSEAL_VALKEY_ADDR: Address of Valkey server (defaults to 127.0.0.1:6666).
• CHRONOSEAL_FRONTEND_DIR: Directory containing frontend static assets.

Reverse Proxy Configuration (Nginx)

Ensure ChronoSeal runs behind TLS in production. Secure proxy traffic to the local daemon port:

location / {
    proxy_pass         http://127.0.0.1:3000;
    proxy_http_version 1.1;
    proxy_set_header   Host $host;
    proxy_set_header   X-Real-IP $remote_addr;
    proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header   X-Forwarded-Proto $scheme;
}

Docker Compose Deployment

Build and run the container service (configured for non-root execution by default):

bash scripts/build.sh
docker compose up -d --build

Production Checklist

• Ensure WASM modules in frontend/pkg are rebuilt with the --release flag.
• Serve all ChronoSeal endpoints exclusively over HTTPS.
• Restict server bind address to localhost (127.0.0.1) behind a reverse proxy.
• Run the daemon service under a dedicated unprivileged user account.
• Disable debug logging (avoid CHRONOSEAL_LOG=debug) in production to protect credentials.
• Configure Valkey or persistent SQLite for production session storage.