Metadata-Version: 2.5
Name: bayafs
Version: 0.1.11
Summary: Install and operate FabricStudio on your own infrastructure.
Project-URL: Homepage, https://bayasystems.com
Project-URL: Documentation, https://bayasystems.com/docs/self-hosted
Author-email: Baya Systems <support@bayasystems.com>
License-Expression: LicenseRef-Proprietary
License-File: LICENSE
Keywords: eda,fabricstudio,installer,noc,self-hosted
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: System Administrators
Classifier: Operating System :: POSIX :: Linux
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: System :: Installation/Setup
Classifier: Topic :: System :: Systems Administration
Requires-Python: >=3.9
Requires-Dist: pyyaml>=6
Requires-Dist: rich>=13.7
Requires-Dist: tomli>=2.0; python_version < '3.11'
Provides-Extra: dev
Requires-Dist: pytest>=8; extra == 'dev'
Requires-Dist: ruff; extra == 'dev'
Description-Content-Type: text/markdown

# baya — FabricStudio, self-hosted

Installs and operates [FabricStudio](https://bayasystems.com) on your own Linux server: one
command brings up the whole platform, and each engineer works in their own workspace, on
their own home directory, signed in through a browser.

Published as `bayafs`; the command is `baya`.

## Requirements

- Linux x86-64 — RHEL/Oracle 9, Debian 13, Ubuntu 22.04+, or SLES 15
- 4+ CPUs, 16 GB+ RAM, 100 GB+ free disk
- Python 3.9 or newer
- root: the installer manages docker, Kubernetes, and ports 80/443
- Inbound 80 and 443 from your users; outbound HTTPS to Baya and to Google Artifact Registry
- A licence key from Baya

## Install

```sh
sudo python3 -m venv /opt/baya
sudo /opt/baya/bin/pip install bayafs
sudo ln -sf /opt/baya/bin/baya /usr/local/bin/baya

sudo baya doctor                      # check this host first; every failure names its fix
sudo baya license set <licence-key>
sudo baya storage set --base /home    # where your engineers' home directories live
sudo baya init --hostname fs.yourcompany.com
```

A virtual environment rather than a plain `pip install`: several distributions mark their
system Python externally managed and refuse, and a user-level install puts `baya` where
`sudo` cannot see it.

`init` installs what is missing, starts a single-node Kubernetes cluster, pulls the images
your licence entitles you to, and brings up the platform — about ten minutes. It is safe to
re-run: a failed step resumes rather than repeats.

`--hostname` is the address your users will type. It goes into the certificate, the login
redirect, and the tokens, so changing it later means re-running `init`.

## Give people access

```sh
sudo baya user map you@yourcompany.com --linux-user "$USER" --name "Your Name" --admin
# prompts for a password, twice, without showing it
sudo baya verify
```

`user map` binds a login to a local account and starts that person's workspace **on their
real home directory** — files their designs produce are owned by them, exactly as if they
had run the tools from a shell. The account must already exist and own that directory, or
the mapping is refused rather than half-applied.

It also creates the account they sign in with, prompting for a password twice without
displaying it. **Map yourself first, with `--admin`**: nobody can sign in to a fresh install
until someone is mapped, and the admin role is what opens the admin console inside the GUI.
No identity provider is needed for this — the bundled Keycloak holds the account.

A password is never accepted as a command-line argument: that would put it in shell history
and in the process list, where every user on the machine can read it. For automation, pipe
it in:

```sh
echo "$PASSWORD" | sudo baya user map alice@yourcompany.com --linux-user alice --password-stdin
```

Add `--require-change` to make someone choose their own at first sign-in, and reset one
later with `sudo baya user password <email>`.

`verify` proves the install works end to end — every service, the TLS front door, the login
page, the identity provider, and each person's workspace — and names the command to run for
anything that does not.

Then open `https://<hostname>` and sign in. The certificate is self-signed until you supply
your own, so browsers will warn.

## Everyday commands

```sh
sudo baya status                 # version, health, licence, storage
sudo baya verify                 # end-to-end check; run it after every change
sudo baya user list              # every mapping and the state of its workspace
sudo baya user describe <email>  # one mapping, re-verified against the filesystem
sudo baya storage describe       # the base, its filesystem, and every mapping
sudo baya admin list             # everyone's roles, and who can administer
sudo baya admin grant <email>    # give someone the admin role
sudo baya admin revoke <email>   # take it away; refuses if they are the last one
sudo baya user disable <email>   # stop a login without removing the mapping
sudo baya user unmap <email>     # remove them entirely; their files are untouched
sudo baya user password <email>  # set or reset a password, never shown
sudo baya release list           # versions your licence allows
sudo baya start | stop | restart # the whole install
sudo baya uninstall --yes        # removes the install; never touches your users' files
```

`sudo baya selftest` runs an offline check of the tool itself, with no cluster and no
credential — safe to run any time, including before you have a licence key.

## Not yet available

These are specified and coming; this release does not have them:

- `baya idp add` — federate your own identity provider (Entra, Google, GitHub, OIDC).
  Until then, sign-in accounts are held by the bundled Keycloak and created by `user map`,
  which is a complete way to run the install, not a workaround.
- `baya tls set` — install your own certificate. Until then the self-signed certificate
  generated at install is what browsers see.
- `baya update` / `baya rollback` — move between versions.
- `baya workspace` — per-engineer pod operations.
- `baya logs` — service logs without `kubectl`.
- `baya support-bundle` — a redacted diagnostic bundle for Baya.

---

Licensed software. `baya` itself is freely installable; running FabricStudio requires a
licence key issued by Baya Systems.
