About 2 min
Operating mechabedo
Beam is about getting one installation connected. This section is about running the things it connects to as infrastructure: a beam host that other people's installations depend on, mechabedo itself as a server, and upgrading both without dropping anybody.
It assumes you are the person who gets paged.
The pages
| Page | Contents |
|---|---|
| The architecture | Every component and every hop, drawn. Read this once and the rest stops needing prose |
| Cloud agentic workspaces | A fleet of server-shaped installations: provisioning, patterns, capacity, what to watch |
| Running a beam host | Sizing it, the proxy in front, slots and tokens, storage, backup, what to watch, and the failure table |
| Running mechabedo as a server | The vendor container as infrastructure: the volume, capacity, logs, backup and restore |
| Reference deployments | Two shapes of the same tandem - a host at the edge (spica, serving) and a host inside the workspace (a Coder template, planned) |
| Upgrading | The order the two are upgraded in, the version interlock between them, and how to get back |
The shape, once
Drawing the diagram…
Three properties fall out of that, and they are what make this operable:
- Only the beam host is exposed. Every installation dials out. There is no inbound route to a mechabedo, no certificate on it, and no port to firewall.
- The beam host holds almost nothing. Tunnels are in memory; buckets, sync blobs and the dataset are on its storage backend. Losing it interrupts access and loses no work.
- A mechabedo holds everything. The database, the transcripts, the harnesses and the workspaces are all on its volume. That is the thing to back up, and the thing an upgrade must not touch.
What to have before you start
- A host with a public address and TLS in front of it. The beam host speaks plain HTTP and expects a proxy (Running a beam host).
- A password manager or a secret store. There are three kinds of secret here - the host's
BEAM_TOKEN, one slot token per installation, and each installation's own login - and they are not interchangeable. - Somewhere to put backups that is not the machine being backed up.