baya — FabricStudio, self-hosted

Installs and operates FabricStudio on your own Linux server: one command brings up the whole platform, and each engineer works in their own workspace, on their own home directory, signed in through a browser.

Published as bayafs; the command is baya.

Requirements

• Linux x86-64 — RHEL/Oracle 9, Debian 13, Ubuntu 22.04+, or SLES 15
• 4+ CPUs, 16 GB+ RAM, 100 GB+ free disk
• Python 3.9 or newer
• root: the installer manages docker, Kubernetes, and ports 80/443
• Inbound 80 and 443 from your users; outbound HTTPS to Baya and to Google Artifact Registry
• A licence key from Baya

Install

sudo python3 -m venv /opt/baya
sudo /opt/baya/bin/pip install bayafs
sudo ln -sf /opt/baya/bin/baya /usr/local/bin/baya

sudo baya doctor                      # check this host first; every failure names its fix
sudo baya license set <licence-key>
sudo baya storage set --base /home    # where your engineers' home directories live
sudo baya init --hostname fs.yourcompany.com

A virtual environment rather than a plain pip install: several distributions mark their system Python externally managed and refuse, and a user-level install puts baya where sudo cannot see it.

init installs what is missing, starts a single-node Kubernetes cluster, pulls the images your licence entitles you to, and brings up the platform — about ten minutes. It is safe to re-run: a failed step resumes rather than repeats.

--hostname is the address your users will type. It goes into the certificate, the login redirect, and the tokens, so changing it later means re-running init.

Give people access

sudo baya user map you@yourcompany.com --linux-user "$USER" --name "Your Name" --admin
# prompts for a password, twice, without showing it
sudo baya verify

user map binds a login to a local account and starts that person's workspace on their real home directory — files their designs produce are owned by them, exactly as if they had run the tools from a shell. The account must already exist and own that directory, or the mapping is refused rather than half-applied.

It also creates the account they sign in with, prompting for a password twice without displaying it. Map yourself first, with --admin: nobody can sign in to a fresh install until someone is mapped, and the admin role is what opens the admin console inside the GUI. No identity provider is needed for this — the bundled Keycloak holds the account.

A password is never accepted as a command-line argument: that would put it in shell history and in the process list, where every user on the machine can read it. For automation, pipe it in:

echo "$PASSWORD" | sudo baya user map alice@yourcompany.com --linux-user alice --password-stdin

Add --require-change to make someone choose their own at first sign-in, and reset one later with sudo baya user password <email>.

verify proves the install works end to end — every service, the TLS front door, the login page, the identity provider, and each person's workspace — and names the command to run for anything that does not.

Then open https://<hostname> and sign in. The certificate is self-signed until you supply your own, so browsers will warn.

Everyday commands

sudo baya status                 # version, health, licence, storage
sudo baya verify                 # end-to-end check; run it after every change
sudo baya user list              # every mapping and the state of its workspace
sudo baya user describe <email>  # one mapping, re-verified against the filesystem
sudo baya storage describe       # the base, its filesystem, and every mapping
sudo baya admin list             # everyone's roles, and who can administer
sudo baya admin grant <email>    # give someone the admin role
sudo baya user password <email>  # set or reset a password, never shown
sudo baya release list           # versions your licence allows
sudo baya start | stop | restart # the whole install
sudo baya uninstall --yes        # removes the install; never touches your users' files

sudo baya selftest runs an offline check of the tool itself, with no cluster and no credential — safe to run any time, including before you have a licence key.

Not yet available

These are specified and coming; this release does not have them:

• baya idp add — federate your own identity provider (Entra, Google, GitHub, OIDC). Until then, sign-in accounts are held by the bundled Keycloak and created by user map, which is a complete way to run the install, not a workaround.
• baya tls set — install your own certificate. Until then the self-signed certificate generated at install is what browsers see.
• baya update / baya rollback — move between versions.
• baya workspace — per-engineer pod operations.
• baya logs — service logs without kubectl.
• baya support-bundle — a redacted diagnostic bundle for Baya.

Licensed software. baya itself is freely installable; running FabricStudio requires a licence key issued by Baya Systems.