# Self-hosting

1. Deploy the CDK stack: `auritus deploy`

2. Optional: put your Google OAuth client id/secret into the stack's Secrets Manager secret and attach Google as a Cognito IdP (not required for CLI login).

3. `auritus login --username you@example.com` (Cognito email and password; JWTs cached under `~/.auritus/credentials`; see the [security page](/docs/security) for refresh-token rotation and unattended worker auth)

4. `auritus site create --origin https://your.site`

5. Run `auritus worker` on hardware you control so it wins the race against the 15-minute Batch fallback.

Spend guardrails: AWS Budgets disables the Batch queue at the daily threshold; per-site quotas apply; `auritus killswitch disable` is the manual stop.