Deployment

FileDB is a static Go binary with no external dependencies — no libc, no system packages. It's single-node by design — there's no replication; each replica needs its own data directory.

Docker

docker run -d --name filedb 
  -p 127.0.0.1:8080:8080 
  -v filedb-data:/data 
  -e FILEDB_PASSWORD=$(openssl rand -hex 24) 
  -e FILEDB_TRUSTED_PROXY=172.17.0.1 
  --read-only --tmpfs /tmp --cap-drop=ALL --security-opt=no-new-privileges 
  ghcr.io/filedb/filedb:2.10

The key rule: never publish the port directly (-p 127.0.0.1:8080:8080, not -p 8080:8080) — always put nginx/Caddy in front of FileDB.

systemd (Linux VM / bare metal)

sudo useradd --system --home /var/lib/filedb --shell /usr/sbin/nologin filedb
sudo mkdir -p /var/lib/filedb /var/log/filedb /etc/filedb
sudo chown filedb:filedb /var/lib/filedb /var/log/filedb
sudo install -m 755 filedb /usr/local/bin/
sudo install -m 644 filedb.service /etc/systemd/system/
sudo install -m 600 /dev/stdin /etc/filedb/env <<EOF
FILEDB_PASSWORD=$(openssl rand -hex 24)
FILEDB_TRUSTED_PROXY=127.0.0.1
EOF
sudo systemctl daemon-reload
sudo systemctl enable --now filedb

Windows service (NSSM)

nssm install FileDB "C:Program Filesfiledbfiledb.exe"
nssm set FileDB AppParameters "-data C:ProgramDatafiledbdata -addr :8080"
nssm set FileDB ObjectName "NT AUTHORITYLocalService"
nssm set FileDB AppEnvironmentExtra "FILEDB_PASSWORD=$(New-Guid)"

Graceful shutdown on Windows — Ctrl+Break is the SIGTERM equivalent; NSSM sends it first, giving the binary time to clean up before SIGKILL.

Reverse proxy

FileDB doesn't terminate TLS itself — always put nginx or Caddy in front. Caddy is the simplest path to automatic Let's Encrypt:

db.example.com {
    reverse_proxy filedb:8080 {
        header_up X-Real-IP {remote_host}
        header_up X-Forwarded-For {remote_host}
    }
}