## Before you start

Daevix is self-hosted and alpha; there is no hosted console. Everything below
runs on your own machine. Tooling — Go plus `sqlc`, `goose`, `golangci-lint`,
and `mkcert` — is provisioned by [mise](https://mise.jdx.dev); there is no `go`
on your PATH until mise is active.

## Build the binary

Provision the toolchain, generate local TLS certificates, and build `dvx` into
`bin/`. Servers are TLS-only, so the certs come first.

{{< terminal title="dvx" prompt="$" >}}
$ mise install
$ make dev-certs
$ make build
$ ./bin/dvx --version
{{< /terminal >}}

`make test` runs the unit tests (`go test -short ./...`) if you want to confirm
the tree before running anything.

## Run the IMDS daemon locally

`make run-imds` runs `dvx serve imds` in the foreground over TLS. It sets
`DVX_ENCLAVE_ID=dev-local` and serves the IMDS-like metadata socket at
`/tmp/dvx-imds.sock` — the same socket an agent mounts to read its identity.

{{< terminal title="dvx" prompt="$" >}}
$ make run-imds
{{< /terminal >}}

In a second shell, query the metadata service the way an agent would — over the
unix socket, not the network:

{{< terminal title="dvx" prompt="$" >}}
$ curl -s --unix-socket /tmp/dvx-imds.sock http://imds/v1/identity
{{< /terminal >}}

{{< planenote plane="controlplane" >}}
This runs the imds alone. A full deployment adds a controlplane the broker
pulls desired state from; the two planes run in Kubernetes (Kata containers and
Cilium), the enclave in your own cluster. That path — `make deploy-iam`,
`make deploy-enclave`, and the local `kind` cluster — lives in the repository
`Makefile` and `README.md`.
{{< /planenote >}}