DarkDuck supports three deployment configurations, from zero-friction local to internet-facing production.

​
Deployment Modes

ModeAuthBest For
local_trustedNo login requiredSingle-operator local machine
authenticated + privateLogin requiredPrivate network (Tailscale, VPN, LAN)
authenticated + publicLogin requiredInternet-facing cloud deployment

​
Quick Comparison

​
Local Trusted (Default)

  • Loopback-only host binding (localhost)
  • No human login flow
  • Fastest local startup
  • Best for: solo development and experimentation

​
Authenticated + Private

  • Login required via Better Auth
  • Binds to all interfaces for network access
  • Auto base URL mode (lower friction)
  • Best for: team access over Tailscale or local network

​
Authenticated + Public

  • Login required
  • Explicit public URL required
  • Stricter security checks
  • Best for: cloud hosting, internet-facing deployment

​
Choosing a Mode

ScenarioRecommended Mode
Just trying DarkDucklocal_trusted (default)
Sharing with a team on private networkauthenticated + private
Deploying to the cloudauthenticated + public
Set the mode during onboarding: 
pnpm darkduck onboard
Or update it later: 
pnpm darkduck configure --section server
Start with local_trusted to explore the platform. You can upgrade to authenticated mode at any time without losing data.

​
Infrastructure Options

ComponentOptions
DatabaseEmbedded PGlite (default), Docker PostgreSQL, Hosted PostgreSQL
StorageLocal disk (default), S3-compatible object storage
SecretsLocal encrypted (default), environment variable override
RuntimeNode.js direct, Docker container

Local Development

Run DarkDuck locally with zero external dependencies

Docker

Run DarkDuck in Docker without installing Node or pnpm

Deployment Modes

Detailed configuration for each deployment mode