Configuration

The public self-hosted configuration is the checked-in cto-gui/docker-compose.self-hosted.yml plus settings read by the cto-gui-libvirt-backend. This page documents that evaluation surface. It does not invent a generic Enterprise environment contract.

Compose Contract

Setting	Checked-in value	Purpose
`SELF_HOSTED`	`true`	Select local-console mode and disable cloud-dependent routes
`KVM_URI`	`qemu:///system`	Connect to the host system libvirt daemon
`TEST_STORAGE_DIR`	`/app/data/tests`	Retain test state, locks, and cleanup journals in `cto-data`
`SOURCE_ISO_DIR`	Host source-ISO path	Resolve read-only source artifacts at the same absolute path visible to host libvirt
`SOURCE_GOLDEN_IMAGE_DIR`	Host promoted-image path	Resolve immutable installed QCOW2 inputs at the same absolute path visible to host libvirt
`TRUST_PROXY_HEADERS`	`true` in the Compose file	Permit proxy-derived client information subject to the backend’s trusted-proxy rules

The backend also defaults ISO uploads to /var/lib/libvirt/images and limits uploads to 10 GB unless the backend setting is deliberately changed.

Host Path Overrides

Two shell environment variables affect Compose bind mounts:


export SOURCE_ISO_HOST_DIR=/srv/openfactory/source-isos
export SOURCE_GOLDEN_IMAGE_HOST_DIR=/srv/openfactory/golden-images
docker compose -f docker-compose.self-hosted.yml up --build -d

Create and permission those directories first. The container path is kept identical to the host path because host libvirt, not the container, opens image files for QEMU. A path that exists only inside the container will fail at guest launch time.

Persistent and Non-Persistent Data

Location	Ownership and lifecycle
`/var/lib/libvirt/images`	Host-managed uploaded ISOs, guest disks, and overlays
Source ISO directory	Operator-managed, mounted read-only
Golden-image directory	Operator-promoted immutable inputs, mounted read-only
`cto-data` named volume	Backend state including test records and cleanup journals
Container filesystem outside mounts	Disposable; do not rely on it for recovery

Back up or snapshot only after identifying which resources must be retained. The Compose file does not schedule backups.

Exposure and Proxy Settings

The frontend maps host port 80. TRUST_PROXY_HEADERS does not provide TLS or authentication; it only changes how the backend accepts forwarded connection metadata from explicitly trusted proxy ranges. If you add a reverse proxy, configure its network path and trusted proxies narrowly and verify spoofed forwarding headers are rejected from untrusted peers.

Do not place the evaluation console directly on the public internet. A production identity, TLS, secrets, and authorization design is a separate deployment decision.

Validate Every Change

After changing paths or settings:

recreate the affected container;
verify self_hosted: true through the mode endpoint;
upload and launch a disposable ISO;
stop and delete the guest;
restart the stack and confirm cleanup state and inventory survive.