clap-markdown
.
+
+
diff --git a/docs/docs/cli-reference/standalone-config.md b/docs/docs/cli-reference/standalone-config.md
new file mode 100644
index 00000000000..0dd0a1502c8
--- /dev/null
+++ b/docs/docs/cli-reference/standalone-config.md
@@ -0,0 +1,82 @@
+# `spacetimedb-standalone` configuration
+
+A local database instance (as started by `spacetime start`) can be configured in `{data-dir}/config.toml`, where `{data-dir}` is the database's data directory. This directory is printed when you run `spacetime start`:
+
+
+spacetimedb-standalone version: 1.0.0
+spacetimedb-standalone path: /home/user/.local/share/spacetime/bin/1.0.0/spacetimedb-standalone
+database running in data directory /home/user/.local/share/spacetime/data
+
+On Linux and macOS, this directory is by default `~/.local/share/spacetime/data`. On Windows, it's `%LOCALAPPDATA%\SpacetimeDB\data`.
+
+## `config.toml`
+
+- [`certificate-authority`](#certificate-authority)
+- [`logs`](#logs)
+
+### `certificate-authority`
+
+```toml
+[certificate-authority]
+jwt-priv-key-path = "/path/to/id_ecdsas"
+jwt-pub-key-path = "/path/to/id_ecdsas.pub"
+```
+
+The `certificate-authority` table lets you configure the public and private keys used by the database to sign tokens.
+
+### `logs`
+
+```toml
+[logs]
+level = "error"
+directives = [
+ "spacetimedb=warn",
+ "spacetimedb_standalone=info",
+]
+```
+
+#### `logs.level`
+
+Can be one of `"error"`, `"warn"`, `"info"`, `"debug"`, `"trace"`, or `"off"`, case-insensitive. Only log messages of the specified level or higher will be output; e.g. if set to `warn`, only `error` and `warn`-level messages will be logged.
+
+#### `logs.directives`
+
+A list of filtering directives controlling what messages get logged, which overwrite the global [`logs.level`](#logslevel). See [`tracing documentation`](https://docs.rs/tracing-subscriber/0.3/tracing_subscriber/filter/struct.EnvFilter.html#directives) for syntax. Note that this is primarily intended as a debugging tool, and log message fields and targets are not considered stable.
+
+### `websocket`
+
+```toml
+[websocket]
+ping-interval = "15s"
+idle-timeout = "30s"
+close-handshake-timeout = "250ms"
+incoming-queue-length = 2048
+```
+
+#### `websocket.ping-interval`
+
+Interval at which the server will send `Ping` frames to keep the connection alive.
+Should be smaller than `websocket.idle-timeout` to be effective.
+
+Values are strings of any format the [`humantime`] crate can parse.
+
+#### `websocket.idle-timeout`
+
+If the server hasn't received any data from the client (including `Pong` responses to previous `Ping`s it sent), it will consider the client unresponsive and close the connection.
+Should be greater than `websocket.ping-interval` to be effective.
+
+Values are strings of any format the [`humantime`] crate can parse.
+
+#### `websocket.close-handshake-timeout`
+
+Time the server waits for the client to respond to a graceful connection close. If the client doesn't respond within this timeout, the connection is dropped.
+
+Values are strings of any format the [`humantime`] crate can parse.
+
+#### `websocket.incoming-queue-length`
+
+Maximum number of client messages the server will queue up in case it is not able to process them quickly enough. When the queue length exceeds this value, the server will start disconnecting clients.
+Note that the limit is per client, not across all clients of a particular database.
+
+
+[`humantime`]: https://crates.io/crates/humantime
diff --git a/docs/docs/deploying/maincloud.md b/docs/docs/deploying/maincloud.md
new file mode 100644
index 00000000000..66130fdcbe2
--- /dev/null
+++ b/docs/docs/deploying/maincloud.md
@@ -0,0 +1,51 @@
+# Deploy to Maincloud
+
+Maincloud is a managed cloud service that provides developers an easy way to deploy their SpacetimeDB apps to the cloud.
+
+## Deploy via CLI
+
+1. Install the SpacetimeDB CLI for your platform: [Install SpacetimeDB](/install)
+1. Create your module (see [Getting Started](/docs/getting-started))
+1. Publish to Maincloud:
+
+```bash
+spacetime publish -s maincloud my-cool-module
+```
+
+## Connecting your Identity to the Web Dashboard
+
+By logging in your CLI via spacetimedb.com, you can view your published modules on the web dashboard.
+
+If you did not log in with spacetimedb.com when publishing your module, you can log in by running:
+```bash
+spacetime logout
+spacetime login
+```
+
+1. Open the SpacetimeDB website and log in using your GitHub login.
+1. You should now be able to see your published modules https://spacetimedb.com/profile, or you can navigate to your database directly at https://spacetimedb.com/my-cool-module.
+
+---
+
+With SpacetimeDB Maincloud, you benefit from automatic scaling, robust security, and the convenience of not having to manage the hosting environment.
+
+# Connect from Client SDKs
+To connect to your deployed module in your client code, use the host url of `https://maincloud.spacetimedb.com`:
+
+## Rust
+```rust
+DbConnection::builder()
+ .with_uri("https://maincloud.spacetimedb.com")
+```
+
+## C#
+```csharp
+DbConnection.Builder()
+ .WithUri("https://maincloud.spacetimedb.com")
+```
+
+## TypeScript
+```ts
+ DbConnection.builder()
+ .withUri('https://maincloud.spacetimedb.com')
+```
diff --git a/docs/docs/deploying/spacetimedb-standalone.md b/docs/docs/deploying/spacetimedb-standalone.md
new file mode 100644
index 00000000000..db738dd8d73
--- /dev/null
+++ b/docs/docs/deploying/spacetimedb-standalone.md
@@ -0,0 +1,280 @@
+# Self Hosting SpacetimeDB
+
+This tutorial will guide you through setting up SpacetimeDB on an Ubuntu 24.04 server, securing it with HTTPS using Nginx and Let's Encrypt, and configuring a systemd service to keep it running.
+
+## Prerequisites
+- A fresh Ubuntu 24.04 server (VM or cloud instance of your choice)
+- A domain name (e.g., `example.com`)
+- `sudo` privileges on the server
+
+## Step 1: Create a Dedicated User for SpacetimeDB
+For security purposes, create a dedicated `spacetimedb` user to run SpacetimeDB:
+
+```sh
+sudo mkdir /stdb
+sudo useradd --system spacetimedb
+sudo chown -R spacetimedb:spacetimedb /stdb
+```
+
+Install SpacetimeDB as the new user:
+
+```sh
+sudo -u spacetimedb bash -c 'curl -sSf https://install.spacetimedb.com | sh -s -- --root-dir /stdb --yes'
+```
+
+## Step 2: Create a Systemd Service for SpacetimeDB
+To ensure SpacetimeDB runs on startup, create a systemd service file:
+
+```sh
+sudo nano /etc/systemd/system/spacetimedb.service
+```
+
+Add the following content:
+
+```ini
+[Unit]
+Description=SpacetimeDB Server
+After=network.target
+
+[Service]
+ExecStart=/stdb/spacetime --root-dir=/stdb start --listen-addr='127.0.0.1:3000'
+Restart=always
+User=spacetimedb
+WorkingDirectory=/stdb
+
+[Install]
+WantedBy=multi-user.target
+```
+
+Enable and start the service:
+
+```sh
+sudo systemctl enable spacetimedb
+sudo systemctl start spacetimedb
+```
+
+Check the status:
+
+```sh
+sudo systemctl status spacetimedb
+```
+
+## Step 3: Install and Configure Nginx
+
+### Install Nginx
+
+```sh
+sudo apt update
+sudo apt install nginx -y
+```
+
+### Configure Nginx Reverse Proxy
+Create a new Nginx configuration file:
+
+```sh
+sudo nano /etc/nginx/sites-available/spacetimedb
+```
+
+Add the following configuration, remember to change `example.com` to your own domain:
+
+```nginx
+server {
+ listen 80;
+ server_name example.com;
+
+ #########################################
+ # By default SpacetimeDB is completely open so that anyone can publish to it. If you want to block
+ # users from creating new databases you should keep this section commented out. Otherwise, if you
+ # want to open it up (probably for dev environments) then you can uncomment this section and then
+ # also comment out the location / section below.
+ #########################################
+ # location / {
+ # proxy_pass http://localhost:3000;
+ # proxy_http_version 1.1;
+ # proxy_set_header Upgrade $http_upgrade;
+ # proxy_set_header Connection "Upgrade";
+ # proxy_set_header Host $host;
+ # }
+
+ # Anyone can subscribe to any database.
+ # Note: This is the only section *required* for the websocket to function properly. Clients will
+ # be able to create identities, call reducers, and subscribe to tables through this websocket.
+ location ~ ^/v1/database/[^/]+/subscribe$ {
+ proxy_pass http://localhost:3000;
+ proxy_http_version 1.1;
+ proxy_set_header Upgrade $http_upgrade;
+ proxy_set_header Connection "Upgrade";
+ proxy_set_header Host $host;
+ }
+
+ # Uncomment this section to allow all HTTP reducer calls
+ # location ~ ^/v1/[^/]+/call/[^/]+$ {
+ # proxy_pass http://localhost:3000;
+ # proxy_http_version 1.1;
+ # proxy_set_header Upgrade $http_upgrade;
+ # proxy_set_header Connection "Upgrade";
+ # proxy_set_header Host $host;
+ # }
+
+ # Uncomment this section to allow all HTTP sql requests
+ # location ~ ^/v1/[^/]+/sql$ {
+ # proxy_pass http://localhost:3000;
+ # proxy_http_version 1.1;
+ # proxy_set_header Upgrade $http_upgrade;
+ # proxy_set_header Connection "Upgrade";
+ # proxy_set_header Host $host;
+ # }
+
+ # NOTE: This is required for the typescript sdk to function, it is optional
+ # for the rust and the C# SDKs.
+ location /v1/identity {
+ proxy_pass http://localhost:3000;
+ proxy_http_version 1.1;
+ proxy_set_header Upgrade $http_upgrade;
+ proxy_set_header Connection "Upgrade";
+ proxy_set_header Host $host;
+ }
+
+ # Block all other routes explicitly. Only localhost can use these routes. If you want to open your
+ # server up so that anyone can publish to it you should comment this section out.
+ location / {
+ allow 127.0.0.1;
+ deny all;
+ }
+}
+```
+
+This configuration by default blocks all connections other than `/v1/identity` and `/v1/database/{name}
+ + > + ) : ( + + )} +No messages
} ++ {message.senderName} +
+{message.text}
+{systemMessage}
+