baya — FabricStudio, self-hosted

Installs and operates FabricStudio on your own Linux server: one command brings up the whole platform, and each engineer works in their own workspace, on their own home directory, signed in through your identity provider.

Published as bayafs; the command is baya.

Requirements

• Linux x86-64 — RHEL/Oracle, Ubuntu/Debian, or SLES
• 4+ CPUs, 16 GB+ RAM, 100 GB+ free disk
• root (the installer manages docker, Kubernetes, and port 443)
• Outbound HTTPS to Baya's token broker and to Google Artifact Registry
• A licence key from Baya

Install

pip install bayafs

baya doctor                          # check this host; run it before anything else
baya license set <your-licence-key>
baya storage set --base /home        # where your engineers' home directories live
baya init --hostname fs.yourcompany.com

init installs what is missing, starts a single-node Kubernetes cluster, pulls the images your licence entitles you to, and brings up the platform. It is safe to re-run: a failed step is resumed, not repeated.

Give people access

baya user map alice@yourcompany.com --linux-user alice --name "Alice Chen"
baya verify

user map binds a login to a local account and starts that person's workspace on their real home directory — files their designs produce are owned by them, exactly as if they had run the tools from a shell. verify proves the install works end to end and names the command to run for anything that does not.

Day to day

baya status                  # version, health, users, certificate, licence
baya verify                  # end-to-end check, after every change
baya update --check          # versions newer than the one installed
baya update                  # drains running work first; --force skips the wait
baya rollback                # back to the previous version
baya workspace list          # who is using what
baya logs <service>          # no kubectl required
baya support-bundle          # one tarball for Baya, secrets and designs redacted

Certificates and identity

A self-signed certificate is generated so day one works; replace it with yours:

baya tls set --cert /path/to/fullchain.pem --key /path/to/key.pem

Until an identity provider is federated, people sign in with a username and password held by the bundled Keycloak. To use your own:

baya idp add --type entra --tenant <id> --client-id <id> --client-secret <secret>
baya idp test

Uninstall

baya uninstall --yes

Removes the cluster and the install's own state. Your engineers' files are never touched.

Licensed software. baya itself is freely installable; running FabricStudio requires a licence key issued by Baya Systems.