FoldForge
Private deployment

Runs entirely on your own hardware

FoldForge is built to run inside your environment — gateway, orchestrator, Postgres and the GPU sidecars, all on infrastructure you control. Your designed sequences never leave your network. Self-host the open stack yourself, or take a private deployment delivered into your own registry and gated by an offline license.

Private deployment

For teams whose sequences are the IP: the whole platform deploys inside your perimeter, delivered and licensed for an environment you don't want anything leaving.

Data stays in your environment

The control plane and the GPU sidecars run in your VPC or cluster. Designed sequences, structures, and MSAs never leave your network — there's no FoldForge-hosted endpoint in the path.

Delivered to your registry

Images are pushed into your own internal registry (Harbor or any OCI registry) — your security team scans them on their terms, and you pull only from infrastructure you control.

Offline license

The deployment is gated by a signed, offline-verified license (Ed25519). No phone-home, no runtime dependency on the public internet — it verifies locally and never ships a private key.

Versioned releases you pin

Pin an immutable vX.Y.Z; you and support debug the exact same build. No latest drifting underneath a production deployment.

Built for security review

Ships with an SBOM, a hardening guide, and a defined support boundary — the artifacts an enterprise security review asks for, rather than an afterthought.

Backup, restore, upgrade

A documented backup/restore path plus a version-skew-aware upgrade with rollback — your data, your operational control, no surprise migrations.

The same control plane powers both paths — the difference is delivery: clone the open stack and run it yourself, or take it packaged for your registry with a license and a support boundary. Talk to us about a private deployment →

Topology

A thin always-on control plane runs anywhere Docker does; the expensive GPU work runs on hosts you rent or own and wire in by endpoint.

edge
Caddy → GatewayAuto-TLS reverse proxy in front of the HTTP/JSON API gateway.
core
Orchestrator + PostgresThe DAG engine and its durable state — workflow truth lives in Postgres on a volume.
compute
GPU sidecarsRFdiffusion / ProteinMPNN / Boltz / AF2 on rented GPU hosts, wired in via SIDECAR_* endpoints.
storage
S3-compatible object storeArtifact blobs + the AF2 MSA cache — Cloudflare R2 in production, MinIO locally.

What you'll need

A control-plane host

Any Linux box with Docker + Docker Compose. The MVP reference uses a single Hetzner Cloud node.

GPU host(s)

One or more machines with NVIDIA GPUs to run the model sidecars. Rent separately — not provisioned for you.

S3-compatible storage

A bucket for artifacts and one for the MSA cache. Cloudflare R2, AWS S3, or self-hosted MinIO.

Postgres

Runs as a container on a volume in the MVP; swap for a managed DB when scale demands it.

Bring up the stack

The reference deployment lives in the infra repo: Terraform to provision, Docker Compose to run.

  1. Provision (optional, Terraform)

    The reference Terraform provisions a Hetzner node, a Postgres volume, and Cloudflare R2 buckets. Skip it if you're bringing your own host and storage.

    terraform
    cd terraform
cp terraform.tfvars.example terraform.tfvars   # tokens + SSH keys
cp backend.hcl.example backend.hcl             # R2 state creds
../scripts/bootstrap-state.sh                  # one-time: state bucket
terraform init -backend-config=backend.hcl
terraform apply

  2. Configure the stack

    Copy the example env file and fill in secrets, image tags, and your SIDECAR_* GPU-host endpoints + object-store credentials.

    compose/.env
    cp compose/.env.example compose/.env
# set: GATEWAY_TAG, ORCHESTRATOR_TAG, DB creds,
#      SIDECAR_RFDIFFUSION / _PROTEINMPNN / _BOLTZ / _AF2,
#      R2 / S3 endpoint + bucket + keys

  3. Deploy & wait for health

    The deploy script pulls the pinned images, brings the stack up, and waits on the gateway's health endpoint. Bump the image tags to roll forward.

    deploy
    ./scripts/deploy.sh
# pulls pinned images, `docker compose up`, waits on /v1/healthz

  4. Verify it's ready

    Readiness pings the orchestrator and DB end to end — a 200 means the whole path is live.

    verify
    curl https://your-gateway/v1/readyz
# {"orchestrator":"ok","status":"ready"}
    No GPU yet? The pipeline runs end to end in mock mode, so you can stand up the control plane and integrate against the API before wiring real accelerators.

Operate

An optional distributed-tracing overlay (compose/docker-compose.trace.yml) adds an OpenTelemetry collector + Jaeger; the services already propagate a W3C traceparent end to end. Prometheus scrapes /metrics; /v1/healthz and /v1/readyz drive your load balancer.

Full runbooks live in the infra repo (provisioning, deploy, and the tracing overlay). The API reference covers the request side.