Self-Hosting

Run the open-source Lux runtime on your own infrastructure. Same core system as Lux Cloud, with full operational control.

When to self-host

Self-host Lux when you want full control over deployment, data location, networking, and operations. Use Lux Cloud when you want the fastest managed path. The point is choice, not lock-in.

Docker

Quick run

docker run -d \
  --name lux   -p 6379:6379   -v lux-data:/data   -e LUX_PASSWORD=changeme   -e LUX_SAVE_INTERVAL=60   ghcr.io/lux-db/lux:latest

Docker Compose

services:
  lux:
    image: ghcr.io/lux-db/lux:latest
    ports:
      - "6379:6379"
    volumes:
      - lux-data:/data
    environment:
      LUX_PASSWORD: changeme
      LUX_DATA_DIR: /data
      LUX_SAVE_INTERVAL: 60
      LUX_MAXMEMORY: 512mb
    restart: unless-stopped

volumes:
  lux-data:

Binary

Build from source with Rust 1.75+ when you want to run or modify Lux directly:

git clone https://github.com/lux-db/lux.git
cd lux
cargo build --release
./target/release/lux

Configuration

All configuration is done through environment variables. No config files needed.

Persistence

Lux persists data using periodic snapshots written to LUX_DATA_DIR. The snapshot interval is controlled by LUX_SAVE_INTERVAL (in seconds). Data is serialized in a compact binary format and reloaded automatically on startup.

For Docker deployments, always mount a volume to /data to ensure snapshots survive container restarts.

Security

Set LUX_PASSWORD to require authentication. Clients must send AUTH password before any other command.

Enable LUX_RESTRICTED=true in production to disable destructive commands like FLUSHALL and CONFIG SET.

docker run -d \
  -p 6379:6379   -e LUX_PASSWORD=your-strong-password   -e LUX_RESTRICTED=true   ghcr.io/lux-db/lux:latest

App Auth

App auth is optional. Enable it when you want Lux to manage users, sessions, OAuth identities, and JWTs for an application. It is separate from LUX_PASSWORD, which still protects direct database access.

docker run -d \
  -p 6379:6379   -p 5890:5890   -e LUX_HTTP_PORT=5890   -e LUX_AUTH_ENABLED=true   -e LUX_AUTH_PUBLISHABLE_KEY=lux_pub_local   -e LUX_AUTH_SECRET_KEY=lux_sec_local   ghcr.io/lux-db/lux:latest

Auth stores state in reserved tables such as auth.users, auth.identities, auth.sessions, auth.keys, and auth.providers. Configure Google, GitHub, and Apple from local Studio's Auth → Providers tab or with lux auth provider …. Both talk directly to the engine using the operator or secret key; the admin auth API remains available for automation.

lux auth provider google --client-id GOOGLE_CLIENT_ID --client-secret GOOGLE_CLIENT_SECRET
lux auth provider github --client-id GITHUB_CLIENT_ID --client-secret GITHUB_CLIENT_SECRET
lux auth provider apple --bundle-id com.example.app
lux auth provider list

Memory Management

Set LUX_MAXMEMORY to cap memory usage. When the limit is reached, the behavior depends on LUX_MAXMEMORY_POLICY: