THESIS docs
 v1.0.0
Live demo Get help
● Ship · Hosting

Deployment
Vercel or your own server.

Two supported ways to put THESIS online. Vercel needs Postgres for the admin; your own server can use a local SQLite file. Either way, serve it over HTTPS.

01Vercel

  1. Import the projectPush the folder to your own Git repository and import it in Vercel. vercel.json already sets the build (pnpm build), output (dist), the /app and /admin rewrites, /api/* and /admin/api/* to the function api/[...path].ts (60 s limit) and the security headers.
  2. Postgres RequiredCreate a Postgres 14+ database (for example Neon from the Vercel marketplace) and set DATABASE_URL to its pooled connection string with sslmode=require. The admin creates its mk_admin_* tables on first use. There is no SQLite on Vercel.
  3. Blob RecommendedStorage → create a private Blob store and connect it; that sets BLOB_READ_WRITE_TOKEN. Without it the aggregate counters live in /tmp and reset on cold starts, and the Status page says so. A public store needs THESIS_BLOB_ACCESS=public.
  4. Environment variablesADMIN_SECRET_KEY (openssl rand -hex 32), DATABASE_URL, optionally ANTHROPIC_API_KEY.
  5. Deploy, then create the ownerOpen /admin once so a function starts, then open the deployment's Logs (or vercel logs <deployment-url>) and search for setup code. Every cold start before the owner exists prints its own code; any printed code works (next steps).
  6. DomainProject → Settings → Domains. Add your domain and follow the DNS instructions.

Visitor country for blocking live modes comes from Vercel's x-vercel-ip-country header (or cf-ipcountry behind Cloudflare).

02Your own server

  1. Build on the server
    pnpm install
pnpm build
  2. SettingsCreate .env (how). Without DATABASE_URL the admin uses SQLite in THESIS_DATA_DIR; back that folder up.
  3. Keep it runningUse a process manager. The command it should run, from the project folder:
    pnpm run server
    The process manager must supply the variables from .env: with systemd, EnvironmentFile=/path/to/thesis/.env and ExecStart=/usr/bin/env pnpm run server; by hand, set -a && . ./.env && set +a && pnpm run server.
  4. HTTPS in frontPut a reverse proxy (Caddy, nginx) in front of port 8787, set THESIS_HOST=127.0.0.1 so only the proxy can reach it, and set THESIS_TRUST_PROXY=1 so rate limits and the Secure cookie see the real client and scheme.
No country blocking without a header

On a bare server there is no country header, so nobody is geo-blocked. If you rely on blocked countries, run behind Cloudflare (which adds cf-ipcountry) or on Vercel.

Security headers

vercel.json sets a strict Content-Security-Policy (only Hyperliquid and api.telegram.org may be contacted by the browser), X-Frame-Options: DENY and more. The Node server applies its own policy from server/csp.ts. If you add another service the browser must reach, add it to both.

03Before you open it to users

  • Owner created, two-factor on, ADMIN_SECRET_KEY backed up.
  • Status page: no blockers.
  • Your own risk notice in Legal; your terms linked from the landing copy if you need them.
  • Blocked countries reviewed; mainnet left off until you have tested on testnet yourself.
  • AI daily cap set to a budget you accept.