AWS with SST
Deploy the Carbon stack to your own AWS account with SST: ECS Fargate, ECR, and a WAF.
This self-hosting recipe deploys the ERP and MES containers to ECS Fargate behind load balancers using SST. Infrastructure is defined in sst.config.ts with app carbon and home aws. For a single-server deployment, see Docker with Caddy.
Don't want to run any of this?
Carbon Cloud manages infrastructure, scaling, backups, and upgrades. Self-host when Carbon must run in your AWS account.
What gets provisioned
| Resource | Details |
|---|---|
| VPC + ECS cluster | CarbonVpc2 and CarbonCluster. |
CarbonERPService | 2 vCPU / 4 GB · port 3000 · health check /health · autoscaling 1–10 tasks on CPU and memory. |
CarbonMESService | The same shape, for the MES. |
| WAF web ACL | AppAlbWebAcl: a 1000 requests/IP rate-limit rule plus the AWS managed common rule set. |
Container images are pulled from ECR (carbon/erp and carbon/mes), built and pushed by CI. SST does not build them.
Prerequisites
| Requirement | Details |
|---|---|
| AWS account | With AWS_REGION and AWS_ACCOUNT_ID. |
| ECR images | Pre-built and tagged with IMAGE_TAG. |
| TLS certificates | CERT_ARN_ERP and CERT_ARN_MES; optionally custom domains URL_ERP and URL_MES. |
| Supabase instance | Provisioned out of band, not by SST. Supplies SUPABASE_URL, SUPABASE_DB_URL, the keys, and SUPABASE_JWT_SECRET. |
The WAF web ACL must be manually associated with the application load balancer after the first deploy. SST creates it but does not attach it.
Deploy
Run SST from the repository root with the infrastructure variables exported.
Set the environment
Export AWS_REGION, AWS_ACCOUNT_ID, IMAGE_TAG, the CERT_ARN_* values, optional URL_* values, and the application runtime configuration. Provision Supabase separately.
Deploy the stack
npx sst deploy --stage prodThis provisions the VPC, cluster, Fargate services, and WAF, then pulls the ECR images tagged by IMAGE_TAG. The prod stage retains resources when removed; other stages delete them.
Associate the WAF
Attach AppAlbWebAcl to the application load balancer in the AWS console (or with the CLI). SST creates the web ACL but does not attach it.
SST does not build the container images. CI builds and pushes carbon/erp and carbon/mes to ECR; the deploy pulls the tag named by IMAGE_TAG.
See Environment variables for the full configuration surface, the Docker with Caddy recipe for a single VPS, or Local development to run Carbon locally with the crbn CLI.