> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nitsor.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Nitsor is a pre-release product. Every page in this documentation carries an availability status in its frontmatter (`availability`) and, as the first element of its body, a link labelled `Available now`, `Limited design-partner access`, or `Planned - not available yet`. That label is binding: it says whether a reader can use the behaviour the page describes.
> A page written in the present tense is not a claim that the behaviour ships. Where the availability label says `Planned - not available yet`, the page describes a target contract and there is no runnable product, screen, command, or public interface behind it.
> Every readiness claim this documentation makes lives on the Product status page. If any statement elsewhere disagrees with the capability status matrix on that page, the matrix is correct.
> Reading this documentation grants no product access and no permission. No agent can create or approve a Nitsor release.

# Self-host mechanics

> Separate the tested mechanics of nitsor up from the complete self-hosted product that is not yet published.

<a className="nit-availability" data-availability="target-contract" href="/product-status#status-definitions" aria-label="Planned — not available yet. Read the status definitions."><span aria-hidden="true" className="nit-availability__dot" />Planned — not available yet</a>

**Status: Planned — not available yet.** This page is a target contract with tested bootstrap mechanics inside it. No supported self-hosted Nitsor product is published.

## What `nitsor up` starts today

| Starts today                                          | A supported product must also start or define                   |
| ----------------------------------------------------- | --------------------------------------------------------------- |
| A pinned control-plane backend image                  | A versioned Nitsor application image                            |
| A pinned operator-dashboard image for that dependency | Nitsor's operator surfaces and their compatibility contract     |
| Generated Compose and environment files               | Supported storage, backup, restore, upgrade, and rollback paths |
| Health checks for the two dependency services         | End-to-end product readiness and workflow checks                |
| Bring-your-own OpenID Connect settings                | A complete supported self-host identity lifecycle               |

The command does not start a Nitsor application image. It therefore cannot satisfy the product-level self-host acceptance gate by itself.

## Tested mechanics

| Mechanic           | Tested behavior                                                                                                                               | What it does not prove                                             |
| ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------ |
| Preflight          | Checks the container client and daemon, supported processor architecture, free disk space, and required ports before writing first-run files. | Production sizing or platform support                              |
| Digest pins        | Rejects tag-only images and requires immutable image digests.                                                                                 | That a public registry currently publishes supported Nitsor images |
| Private secrets    | Writes the environment file with owner-only `0600` permissions and does not print secrets.                                                    | A complete secret-rotation or recovery policy                      |
| Compose generation | Writes the reviewed dependency template and environment values.                                                                               | A complete Nitsor deployment                                       |
| Health waits       | Waits for the configured dependency health endpoints.                                                                                         | Product workflow readiness                                         |
| Repeat runs        | Reuses existing generated files instead of replacing secrets.                                                                                 | Upgrade or rollback behavior                                       |

Non-interactive setup currently requires bring-your-own OpenID Connect issuer, client identifier, and client secret. A supported local-password identity target is not implemented.

## Distribution boundary

The command and installer mechanics exist in tested source, but the release pipeline does not publish the required package and image targets. Copy-and-paste installation examples, `curl | sh`, unpublished image names, service-level claims, and hosted-versus-self-host parity claims remain forbidden.

## Acceptance gaps

Before this can be called a supported self-hosted product, require a versioned package, verifiable integrity, a complete dependency list, identity setup, secret handling, storage and backup behavior, upgrade and rollback procedures, logs and metrics, a settled licence, and an end-to-end deployment test.

## Common mistakes and limits

* A healthy dependency stack is not a healthy Nitsor product.
* An immutable image reference does not prove the image is publicly available.
* Repeat-safe generation is not an upgrade policy.
* Bring-your-own identity settings are not a complete identity lifecycle.
* This target contract is not a service-level commitment.

## Next step

Use [Deployment and security](/reference/deployment-and-security) to build the broader evidence request, or review the [`nitsor up` command boundary](/reference/cli#command-inventory). For which capabilities the product site places in the self-hostable tier and which it does not, see [Pricing](https://nitsor.com/pricing); that is a commercial position, not a statement that a self-hosted deployment is available.

<table className="nit-page-details" aria-label="Page details">
  <tbody>
    <tr><th scope="row">Outcome</th><td>Evaluate the tested bootstrap mechanics without assuming they start a supported Nitsor application.</td></tr>
    <tr><th scope="row">Availability</th><td>Planned — not available yet</td></tr>
    <tr><th scope="row">Audience</th><td>Platform engineers, Security teams, Technical leaders</td></tr>
    <tr><th scope="row">Prerequisites</th><td>Read Deployment and security; Identify your identity, storage, backup, and recovery requirements</td></tr>
    <tr><th scope="row">Last verified</th><td>2026-08-23</td></tr>
  </tbody>
</table>