Skip to content
Create free account
Create free account
Self-hostingServer available on request

Run the server where you already work

The Crunu server is blind by design. At app.crunu.com or on infrastructure you control, it stores ciphertext, public keys and signed records, and has no key that decrypts a single value.

Create free accountRead the self-hosting guide
Example. Kiteline is a fictional company.

What you need first

  • 1Node.js 24 and the server codeThe operator tools server-init, doctor and crunu-server run on it. The server isn’t a public download: write to support@crunu.com to get it.
  • 2An address you’ll keepSign-in signatures, share links, passkeys and agents are bound to the server’s domain, so it can’t change later.
  • 3A safe place for .envA password manager works. The file holds SERVER_KEY, the server’s main secret.

Once per server

Install

Five steps take you from an empty machine or cloud account to a running server with its first owner.

  1. 1Decide who runs the server

    Encryption happens in the browser and in the crunu agent, never on the server. So choosing between app.crunu.com and your own server is about who operates it and who sees its metadata. Nobody on the server side can read your values in either case.

    • app.crunu.com: Crunu runs the server on Cloudflare Workers with a D1 database, free during early access
    • Your own server: you run it, you pay your platform provider, and only you see its metadata
    • Metadata means names of organizations, projects, environments and machines, email addresses, the audit log, and the size and time of versions
    Example. Kiteline is a fictional company.

  2. 2Generate the server’s settings

    server-init writes a .env file with a new SERVER_KEY, a one-time BOOTSTRAP_TOKEN for the first owner and a CRON_SECRET. Only your user can read the file.

    • Save a copy in your password manager right away
    • Losing SERVER_KEY signs everyone out and breaks share links. Environment data survives

  3. 3Pick one of five platforms

    Every platform runs the same server with the same database schema, and the web app is built into it. Each deploy script checks .env with the code the server uses at startup, so a wrong setting stops the deploy with a clear message.

    • Docker on your own server: Caddy issues TLS certificates, and Cloudflare Tunnel works when you want no open ports
    • Cloudflare Workers: Free is fine for a trial, but a team needs Workers Paid, because Free gives each request 10 ms of CPU time
    • Vercel: previews get their own database and server key, and on the Hobby plan cleanup runs at most once a day
    • AWS App Runner only in AWS accounts that already use it: AWS has closed it to new customers, and Crunu has no script for Amazon ECS Express Mode
    Example. Kiteline is a fictional company.

  4. 4Deploy with the platform’s script

    One command per platform builds and deploys the server. Secrets reach the platform through stdin or a file only you can read, never through command arguments or output. The server applies database migrations itself at startup.

    • The same script installs the first version and every update
    • On Cloudflare, code and secrets ship as one version, so a failed deploy changes nothing

  5. 5Create the first owner

    Open the server’s address and enter the bootstrap key from .env. Your account and organization keys are created in your browser, and the key stops working after this one use. Then save your Emergency Kit, create a recovery code and turn on a second factor.

    • Without the Emergency Kit and your password, a new device can’t sign in
    • Everyone else joins by invitation

Every day

Run

Once it’s up, three habits keep the server healthy: a check after every deploy, monitoring, and a daily backup.

  1. 6Check the deployment with doctor

    doctor checks a running server from the outside: health, TLS and certificate expiry, security headers, compression of API responses, the server clock, the agent release, migrations, cleanup and the client address behind proxies.

    • An overall result and an exit code, so it fits into cron and CI
    • --json gives machine-readable output

  2. 7Watch health, metrics and alerts

    GET /v2/health works with uptime checkers such as UptimeRobot or Better Stack. GET /v2/status with an operator token returns metrics as JSON or in Prometheus format, with no values and no email addresses. Alerts reach your team through a signed webhook or by email.

    • Slack, Microsoft Teams and PagerDuty connect through their incoming webhooks
    • On Cloud Run and App Runner, cleanup runs only with traffic, so alerts based on state can arrive late

  3. 8Back up to any storage you like

    crunu-server export writes the whole database to one archive. It holds no open values, so you can keep it with any provider. Keep the .env file apart from it, in your password manager.

    • Export every day and keep 30 days. The server has no built-in scheduler, and the backup guide gives a ready cron line for Docker
    • Verify a copy every month, or better, restore it into a scratch database
    • A restore rolls back everything after the copy, and devices that saw newer data refuse the older state until you reset them

As needed

Change

Moving, rotating the server key and updating use the deploy scripts and crunu-server you already have.

  1. 9Move to another platform with one archive

    Export the database, verify the archive, import it into an empty database on the new platform and deploy there with the same .env, then switch DNS. Any of the six setups can move to any other, in either direction.

    • Keep the same SERVER_KEY and the same address. Only the DNS record changes
    • Machines keep running on the variables they already have for their lease, up to 24 hours
    • Keep the old platform for a week. Going back is a DNS change
    Example. Kiteline is a fictional company.

  2. 10Rotate the server key without signing anyone out

    During a rotation the previous key keeps working, tokens are rehashed with the new key as they’re used, and rotate-key re-encrypts TOTP secrets and alert channels. People stay signed in and share links keep opening. Environment data is never encrypted with this key.

    • Four steps: new-server-key, deploy, rotate-key, drop-previous-key
    • Rotate when .env may have been seen, after a move, or once a year

  3. 11Update without a separate migration step

    An update is the same deploy script as the first install, and the server applies migrations at startup. Migrations only add, and released ones are protected by checksums, so you can roll the code back without rolling back the database.

    • Web releases are signed, and the server serves the signature so a deployed site can be checked against it
    • Rolling back below version 6.0 isn’t possible

Guides for operators

Self-hosting questions

What operators ask before they run their own server.

Another question? Email support@crunu.com.

Is app.crunu.com the same software I can host myself?

Yes. app.crunu.com runs the same Crunu server, deployed to Cloudflare Workers with a D1 database.

Can the people who run app.crunu.com read my secrets?

No. The server stores ciphertext and has no key to decrypt it. As the operator, Crunu does see metadata: names of organizations, projects, environments and machines, email addresses, the audit log, and the size and time of each version. One risk applies to every web-based vault: a compromised server could serve a modified web app that sees your password and Secret Key when you sign in. Signed releases and a strict content security policy reduce that risk, and the limitations page explains the rest.

Can I move from app.crunu.com to my own server later?

Not in one step. The archive that moves a server between platforms is made from the server’s whole database, and on app.crunu.com only the operator has access to it. At any time, you can export each environment you can read as a .env file or download an offline copy, then add those files to your own server. History, access settings and the audit log don’t carry over this way.

Is AWS supported?

Partly. The Crunu script deploys to AWS App Runner, but AWS has closed App Runner to new customers, so it works only in accounts that already use it. Crunu has no script for Amazon ECS Express Mode, the service AWS recommends instead. With a new AWS account, choose Cloud Run, Vercel or your own server.

What happens to machines and CI during a move?

Machines keep running on the variables they already have, for the length of their lease, up to 24 hours. Ask the team not to change environments or invite people for 15 to 30 minutes while you switch: anything written to the old server after the export won’t reach the new one.

Can I run several server instances for high availability?

On Postgres, several instances can share one database: audit log writes are serialized by a database lock. There’s no guide for a failover cluster, so plan it as your own setup.

Do the operator tools have an English interface?

Yes. server-init, doctor and crunu-server print in English, or in Russian when CRUNU_LANG or the system locale is Russian.

How do I get the server for self-hosting?

The server isn’t published as a public download. Write to support@crunu.com and say which platform you plan to use.

Try Crunu on the hosted service first

Free during early access. Your password and Secret Key are created in your browser and never reach the server.

Create free accountAsk about self-hosting