Running as a Service

systemd unit file

Create /etc/systemd/system/certforge.service:

[Unit]
Description=CertForge Certificate Governance Server
Documentation=https://certforge.xyz/docs
After=network-online.target
Wants=network-online.target
# Uncomment if using PostgreSQL:
# After=postgresql.service

[Service]
Type=simple
User=certforge
Group=certforge
WorkingDirectory=/opt/certforge

ExecStart=/usr/local/bin/certforge --config /etc/certforge/config.yaml
ExecReload=/bin/kill -HUP $MAINPID

Restart=on-failure
RestartSec=5s
TimeoutStartSec=30s
TimeoutStopSec=30s

# Security hardening
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/opt/certforge/data /var/log/certforge

# Logging
StandardOutput=journal
StandardError=journal
SyslogIdentifier=certforge

# Environment (alternative to putting secrets in config.yaml)
# EnvironmentFile=/etc/certforge/environment

[Install]
WantedBy=multi-user.target

Enable and start:

systemctl daemon-reload
systemctl enable certforge
systemctl start certforge
systemctl status certforge

View logs

# Follow live
journalctl -u certforge -f

# Last 100 lines
journalctl -u certforge -n 100

# Since last boot
journalctl -u certforge -b

Secrets via environment file

Instead of putting database passwords in config.yaml, use an environment file: Create /etc/certforge/environment:

CERTFORGE_DB_URL=postgres://certforge:secret@localhost:5432/certforge?sslmode=require

Set permissions:

chown root:certforge /etc/certforge/environment
chmod 640 /etc/certforge/environment

Uncomment the EnvironmentFile line in the unit, then systemctl daemon-reload && systemctl restart certforge.

The following environment variables override their config.yaml equivalents when set: DATABASE_URL (database connection string), CERTFORGE_STORAGE_KEY (encryption key for stored private keys), and CERTFORGE_PROXY_PASSWORD (proxy auth password). Use the EnvironmentFile approach to keep secrets out of the config file.

Graceful reload

CertForge supports SIGHUP for configuration reload (equivalent to a restart, but connections drain cleanly):

systemctl reload certforge

Logrotate

If you write logs to a file instead of the journal: Create /etc/logrotate.d/certforge:

/var/log/certforge/*.log {
    daily
    rotate 30
    compress
    delaycompress
    missingok
    notifempty
    postrotate
        systemctl reload certforge 2>/dev/null || true
    endscript
}

Health check

Add a simple HTTP health check to your monitoring:

curl -sf http://localhost:8080/health && echo "OK" || echo "UNHEALTHY"

For systemd watchdog integration, set WatchdogSec=60s in [Service] — CertForge will automatically notify the watchdog on each successful health tick.

Getting Started

Core Concepts

Guides

Reference

Trust & Security

Self-Hosted

Running as a Service

systemd unit file

View logs

Secrets via environment file

Graceful reload

Logrotate

Health check

​systemd unit file

​View logs

​Secrets via environment file

​Graceful reload

​Logrotate

​Health check

systemd unit file

View logs

Secrets via environment file

Graceful reload

Logrotate

Health check