Deployment

Docker

docker run -d \
  --name postrust \
  -p 3000:3000 \
  -e DATABASE_URL="postgres://user:pass@host:5432/db" \
  -e PGRST_DB_ANON_ROLE="web_anon" \
  -e PGRST_JWT_SECRET="your-secret-key" \
  postrust/postrust:latest

Docker Compose

version: '3.8'

services:
  postgres:
    image: postgres:16-alpine
    environment:
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: app
    volumes:
      - postgres_data:/var/lib/postgresql/data

  postrust:
    image: postrust/postrust:latest
    depends_on:
      - postgres
    environment:
      DATABASE_URL: postgres://postgres:postgres@postgres:5432/app
      PGRST_DB_ANON_ROLE: web_anon
      PGRST_JWT_SECRET: ${JWT_SECRET}
    ports:
      - "3000:3000"

volumes:
  postgres_data:

AWS Lambda

The function serves what the server serves — the same router, so REST, GraphQL, JWT authentication and row-level security behave identically. GraphQL subscriptions are left out, since a function URL cannot hold a WebSocket. Connect it as a least-privilege authenticator role, never as a superuser, which would bypass row-level security.

# Build for Lambda
cargo lambda build --release -p postrust-lambda

# Deploy with AWS SAM
sam build && sam deploy --guided

See the full deployment guide for SAM templates and Serverless Framework examples.

Cloudflare Workers

The REST API runs in a Worker, reaching PostgreSQL through Hyperdrive. It is the server’s own request pipeline over a socket driver that is tested to answer as the server’s does, and every request takes on the token’s role and claims, so row-level security applies unchanged. The schema cache is kept in Workers KV. There is no GraphQL on Workers; use the server or Lambda for that.

npx wrangler hyperdrive create postrust --connection-string="postgres://authenticator:...@db:5432/app"
npx wrangler kv namespace create POSTRUST_SCHEMA_CACHE

# In a checkout: copy wrangler.example.toml to wrangler.toml, fill in the IDs
cd crates/postrust-worker
npx wrangler secret put PGRST_JWT_SECRET
npx wrangler deploy

How it differs from the server — what it serves, where its answers differ, conformance, measured costs and limits — is on the Cloudflare Workers page.

Fly.io

# Install Fly CLI
curl -L https://fly.io/install.sh | sh

# Launch app
fly launch

# Set secrets
fly secrets set DATABASE_URL="postgres://..."
fly secrets set PGRST_JWT_SECRET="..."

# Deploy
fly deploy

Railway

# Install Railway CLI
npm install -g @railway/cli

# Login and initialize
railway login
railway init

# Set variables
railway variables set DATABASE_URL="postgres://..."

# Deploy
railway up

Production Checklist