# Deploy Sovrium on a VPS with systemd and Caddy

You have a Linux VPS and want the Sovrium binary to run as a managed service with automatic HTTPS — no Docker.

## Run it as a service

Install the binary (`curl -fsSL https://sovrium.com/install | sh`), then define a systemd unit that runs it with your secrets:

```ini
# /etc/systemd/system/sovrium.service
[Service]
ExecStart=/usr/local/bin/sovrium start /srv/app/app.ts
Environment=PORT=3000
Environment=SOVRIUM_DATA_DIR=/srv/app/.sovrium
Environment=AUTH_SECRET=<32-byte hex>
Environment=SOVRIUM_ENCRYPTION_KEY=<32-byte hex>
Environment=BASE_URL=https://app.example.com
Restart=always
User=sovrium
[Install]
WantedBy=multi-user.target
```

Front it with Caddy for TLS (Caddy fetches and renews the certificate for you):

```
# /etc/caddy/Caddyfile
app.example.com {
  reverse_proxy localhost:3000
}
```

## Verify

```bash
sudo systemctl enable --now sovrium && sudo systemctl reload caddy
curl -fsS https://app.example.com/ >/dev/null && echo "up"
```

## Next

- [CLI Reference](/en/docs/cli) — `start`, `reload`, and the flags the unit can use.
- [Security Hardening](/en/docs/security-hardening) — firewall, non-root user, and secret handling.
- [Environment Variables](/en/docs/env-vars) — everything the `[Service]` block can set.