Quilzomanual

Install and run Quilzo in production

Get the program, check it came from this project, and run it the way it is meant to be run.

Quilzo is one static binary with no dependencies to install. It runs as two processes from the same store: quilzo serve, the admin, which belongs on loopback; and quilzo site, the public site, which has no editing surface at all.

Get the program

No release is published yet. Build it from source, or build the container image from the source.

  1. Build it

    Go 1.27 and nothing else: go.mod requires no module.

    git clone https://github.com/Quilzo/Quilzo && cd Quilzo
go build -o quilzo ./cmd/quilzo
sudo install -m 0755 quilzo /usr/local/bin/quilzo

  2. Or build the container

    Built on gcr.io/distroless/static-debian12:nonroot: the binary, CA certificates and a passwd entry. No shell and no package manager.

    docker build -t quilzo .
docker run --rm -v quilzo:/srv quilzo --root /srv/store init
docker run -p 8081:8081 -v quilzo:/srv quilzo --root /srv/store site --addr 0.0.0.0:8081

Each release will publish signed binaries for Linux, macOS and Windows on amd64 and arm64, and a container image. INSTALL says how to check them: the checksum, and the build provenance that proves this project's release workflow built the file from a tag.

Run it for real

  1. Keep the admin on loopback

    quilzo serve listens on 127.0.0.1:8080 by default. Reach it through your own authenticating proxy or a VPN, and set its public address so sign-in flows and connected apps know where they are:

    quilzo config set admin.base_url https://quilzo.example.com

  2. Put the site on the internet, behind TLS

    quilzo site --addr 0.0.0.0:8081 --base-url https://example.org

    Terminate TLS in front of both processes. --base-url is needed for the sitemap and feeds.

  3. Write the audit log as its own account

    quilzo logd runs the log writer as a separate user the content platform cannot impersonate; quilzo logd status says whether the separation is in force.

  4. Encrypt what is stored

    quilzo vault enable     # prints the key once
quilzo vault rotate     # a new key from now on
quilzo vault rewrap     # move existing objects onto it

    The key comes from QUILZO_KEY, QUILZO_KEY_FILE or QUILZO_KEY_COMMAND.

  5. Read the posture scan

    Assurance › Security or quilzo posture scan reads this deployment and lists what is thin, with the reason and the fix (see Security posture).

Back up and upgrade

The store directory is the only state Quilzo has. Back it up and you have backed up content, history, policy, credentials, agents and the audit log; quilzo verify re-hashes every object after a restore. To upgrade, replace the binary and restart both processes. The full operations guide is INSTALL.

Next