One Binary, Many Roles — Operator training

How many services do you install: one, or twelve? Both — it is the same artifact. Every goca service runs the same signed binary in the same image, and --roles selects what starts:

goca serve --roles all
goca serve --roles api-admin,api-cert,ui
goca serve --roles acme

Two group names expand to sets: all is every role, and api is api-admin,api-cert — the shipped compose bundle uses the latter, so it is worth recognising. goca serve --help prints every role this binary carries, which is the authority over any table.

all suits development and small installations. Production splits the public heads, management plane, issuance core, custody and validation plane so each process receives only the network routes and credentials it needs — and moving between these shapes is a deployment change, not a data migration.

Metaphor: a utility knife — one handle, and the blade you extend is the tool it becomes.

Where it breaks: extending every blade at once is how you cut yourself. --roles all is fine on a laptop; production extends one blade per process, each with only its own credentials.

Now I can say why one binary is not one deployment shape.