Operations & deployment
Covey is lean to operate: one binary, one database, optional sandbox infrastructure.
Building blocks
- Control plane — the
coveybinary (API/BFF + orchestration + embedded web UI). - Sandbox daemon — a small second binary (
coveyd) that runs in the sandbox. - Postgres — the anchor for state, queue, memory and encrypted secrets.
Migrations
Versioned SQL migrations are embedded in the binary and run automatically at serve start (auto-migrate with pg_advisory_lock). Existing migrations are never edited.
Configuration
Operation is controlled via environment variables (database URL, listen address, public URL, master key). The master key is critical — without it, encrypted secrets cannot be decrypted.
Egress control
The sandboxes' network egress is controllable: where an agent may talk is decided by the platform. A central enforcement point against data exfiltration.
> Detailed operations guides (deployment, GitLab, email, Zammad) live in the repository under docs/.