Step 1
Prepare accounts and ownership
Decide who owns the installation, collect the required accounts, and choose stable public URLs.
Assign an owner
Use a company-controlled email address for every provider. Avoid tying production to one employee’s personal account. Record at least two administrators for the infrastructure accounts and the Mac.
Create a simple ownership record with these fields:
| Item | Record |
|---|---|
| Coop release | Release version and archive checksum |
| Dashboard | Provider, project name, public URL, account owners |
| API | Provider, service name, public URL, region, account owners |
| Clerk | Application name, production issuer, account owners |
| Supabase or PostgreSQL | Project, region, connection owner, backup plan |
| Redis | Service, region, eviction policy, owner |
| Object storage | Provider, region, bucket name, owner |
| Relay Mac | Device name, physical owner, Apple Account owner |
| Encryption key | Secret-manager location and recovery custodians |
Accounts you need
- The extracted Coop release folder.
- A Clerk account for user sign-in.
- A Supabase account, or equivalent PostgreSQL and S3-compatible services.
- A Railway or Fly.io account for the API.
- A Redis service. Railway Redis is the easiest pairing with Railway. Fly.io users should choose a managed Redis reachable from their Fly region.
- A Vercel or Cloudflare account for the dashboard.
- A Mac that can stay signed in, powered on, awake, and connected to the internet.
Provider free tiers and prices change. Check each provider’s current limits before choosing a plan. Message history, attachments, backup retention, build minutes, and outbound bandwidth are the costs most likely to grow.
Choose public URLs
Plan two HTTPS origins:
https://coop.example.com dashboard
https://coop-api.example.com API
An origin is the scheme plus host and optional port. It has no path and no trailing slash. The dashboard URL becomes CLERK_ALLOWED_DASHBOARD_ORIGINS on the API. The API URL becomes VITE_API_BASE_URL when the dashboard builds. A mismatch blocks browser requests and WebSocket connections.
You can start with provider URLs and add custom domains later. If the dashboard URL changes, update the API allowlist. If the API URL changes, rebuild the dashboard and rebuild or reconfigure Relay.
Create a secure encryption key
Run this on a trusted computer:
openssl rand -base64 32
Store the result in a company secret manager. Do not paste it into chat, an issue, a commit, or a shared document. Set DATA_ENCRYPTION_KEY_VERSION=1 for a new installation.
Database and object-storage backups are not sufficient without the matching encryption key. Keep a separately controlled recovery copy and test that authorized operators can retrieve it.
Read the license boundary
The Elastic License 2.0 allows your company to run and modify Coop for its own operations. It does not allow offering Coop to third parties as a competing hosted or managed service. If you distribute a copy, include the license. Mark modified copies prominently.