Standalone server

Install and start the versioned entry point:

pip install "sketchlog[server]"
sketchlog-server

The module entry point binds 127.0.0.1:8000 by default. Containers set an explicit externally reachable host.

Configuration

Variable	Default	Meaning
`SKETCHLOG_HOST`	`127.0.0.1`	Module-entry-point bind address
`SKETCHLOG_PORT`	`8000`	Bind port
`SKETCHLOG_MAX_STREAMS`	`1000`	Process-wide resident stream cap
`SKETCHLOG_NAMESPACE_QUOTA_MB`	`50`	Per-namespace planning quota, using 130 KiB per stream
`SKETCHLOG_MAX_BATCH_SIZE`	`10000`	Maximum submitted items per batch
`SKETCHLOG_MAX_REQUEST_BYTES`	`1048576`	Public request body limit
`SKETCHLOG_MAX_MESH_PAYLOAD_BYTES`	`41943040`	Authenticated digest/sync request and peer-response limit; range 1 KiB–64 MiB
`SKETCHLOG_MAX_LOCAL_TOMBSTONES`	`100000`	Per-node durable deletion-marker cap; range 1–1,000,000
`SKETCHLOG_AUTH_TOKEN`	unset	Administrator token for every `/v1/*` endpoint
`SKETCHLOG_NAMESPACE_TOKENS`	unset	JSON token-to-namespace-list authorization map
`SKETCHLOG_TLS_CERT`, `SKETCHLOG_TLS_KEY`	unset	Both are required to enable direct TLS
`SKETCHLOG_STORAGE_BACKEND`	inferred	`sqlalchemy`, `omnikv`, `memory`, or `none`
`SKETCHLOG_DB_URI`	unset	SQLAlchemy async URI; enables durable save/load
`SKETCHLOG_OMNIKV_DATA_DIR`	unset	OmniKV embedded data directory; enables OmniKV storage when selected
`SKETCHLOG_OMNIKV_NAMESPACE`	`sketchlog`	OmniKV embedded namespace for SketchLog state
`SKETCHLOG_OMNIKV_MODULE`	`omnikv`	Python/native bridge module exposing OmniKV embedded operations
`SKETCHLOG_MEMORY_THRESHOLD`	`90`	Readiness failure percentage, in `(0,100]`
`SKETCHLOG_MEMORY_LIMIT_BYTES`	auto	Explicit readiness memory limit; cgroup v2 is auto-detected
`SKETCHLOG_ANOMALY_SENSITIVITY`	`0.2`	Default KS anomaly threshold in `(0,1]`
`SKETCHLOG_NODE_ID`	process-derived	Mesh origin identity
`SKETCHLOG_PEERS`	unset	Comma-separated seed origins
`SKETCHLOG_ADVERTISED_ADDRESS`	unset	This node's allowlisted mesh origin
`SKETCHLOG_PEER_ALLOWLIST`	peers	Exact outbound/discovered peer origins
`SKETCHLOG_CLUSTER_SECRET`	unset	Required whenever mesh is enabled
`SKETCHLOG_SYNC_INTERVAL`	`5.0`	Mesh anti-entropy interval in seconds

With storage enabled, eviction applies backpressure and removes a stream only after its durable save succeeds. Without storage, eviction is intentionally ephemeral. File checkpoints and restored database payloads are validated as untrusted data before native allocation.

For SQLAlchemy storage, set SKETCHLOG_DB_URI. For OmniKV-backed storage, set SKETCHLOG_STORAGE_BACKEND=omnikv and SKETCHLOG_OMNIKV_DATA_DIR; see OmniKV storage backend for the required bridge contract.

GET /health is process liveness. GET /ready checks the effective memory limit and configured storage dependency. GET /metrics exports bounded route templates; it never labels series with namespace or stream IDs.

Helm

Single-node mode is the default. The chart rejects replicaCount > 1 unless mesh is explicitly enabled:

helm upgrade --install sketchlog ./charts/sketchlog \
  --set replicaCount=3 \
  --set mesh.enabled=true \
  --set-string mesh.clusterSecret="$CLUSTER_SECRET"

Mesh mode renders a StatefulSet, headless peer service, stable node IDs, allowlisted pod origins, and a Secret. Autoscaling is accepted only in mesh mode and renders an autoscaling/v2 HPA.

The default pod runs as UID 10001 with a read-only root filesystem, dropped capabilities, RuntimeDefault seccomp, and no mounted service-account token. Use extraEnv with secretKeyRef for server authentication or database credentials instead of committing secret values to a Helm values file.

The generated public contract is committed at protocol/openapi.yaml and the interactive form is available at /docs.