Deployment

winget requires HTTPS

A winget REST source must be served over HTTPS with a trusted certificate (this also applies to localhost on recent winget versions). Plan TLS for every endpoint clients talk to.

Origin via Docker

The Community stack is app + PostgreSQL. Two reverse-proxy options ship out of the box:

• Caddy (docker-compose.yml) — automatic Let's Encrypt for a public domain.
• Existing Traefik (docker-compose.traefik.yml) — no Caddy; the app joins Traefik's network and is routed by labels. Use this when port 80/443 is already taken by Traefik.

# behind an existing Traefik:
docker compose -f docker-compose.traefik.yml --env-file .env.deploy up -d

Set KVELLMAN_IMAGE to a prebuilt image (built elsewhere and pushed to a registry) to avoid building on a small server; migrations run automatically at container start.

Edge / mirror nodes (Enterprise)

A site can run a headless edge node that serves the winget API and installer downloads locally, caching from the origin on demand. Clients add the node as their source; the first install pulls through the node, the rest hit the LAN. Nodes enroll with the origin (one-time key → durable mTLS identity) and are centrally controlled (package scope, installer filter, push/pre-stage, health).

Telemetry & toggles

Repository-usage telemetry (searches, manifest fetches, downloads) is off by default and enabled via environment. The same pattern applies to the upstream-catalog sync and a GitHub token for imports.

For the full, step-by-step guide (origin, edge node under WSL, TLS for LAN/localhost, the registry workflow) see DEPLOYMENT.md in the open-core repository.