TürkçeDemo
Menu

Installation

Self-hosted components and responsibility boundaries

Define the place of the application, PostgreSQL, artifact storage, identity, network, and telemetry components in the target topology.

Content statusVerified in sourceDocumentation versionLatest

Core components

  • Spring Boot application and production container
  • PostgreSQL metadata and operation records
  • Filesystem or S3-compatible artifact storage
  • TLS/DNS, ingress, identity, egress, logs, and health endpoints

Responsibility boundary

Owners for PostgreSQL, storage, TLS, ingress, identity, backup, restore, upgrades, and secrets must be assigned before production use.

Core data flow

A package client reaches the application through TLS and ingress. After identity and access-policy checks, the application writes metadata to PostgreSQL and artifact content to the selected storage component. External connections for Proxy, OSV, and identity integrations cross separate egress and secret boundaries.

  • Inbound: host, path, port, and TLS termination for management UI and API, package protocols, and health endpoints
  • Data: PostgreSQL connection pool, schema migration, filesystem or S3 access, and capacity
  • Outbound: package upstreams, OSV sources, LDAP or OIDC, and system proxy where required
  • Operations: readiness and liveness, rollout, task tracking, log access, and secret rotation

Topology decisions

Container count alone does not define a production topology. PostgreSQL availability, storage shared by every replica, ingress session and timeout behavior, DNS and TLS, and platform disruption rules must be designed together.

Pre-install responsibility matrix

For each component, identify the supplying team plus owners for change approval, monitoring, alerting, backup, restore testing, secret rotation, and incident response.

  • Application image or chart and release reference
  • PostgreSQL endpoint, maintenance window, and connection budget
  • Filesystem or PVC, or S3 bucket, encryption, and credential chain
  • Ingress controller, DNS record, TLS certificate, and maximum package size
  • Identity provider, egress allowlist, logging platform, and acceptance-evidence repository

Readiness criteria

Accept installation only when readiness verifies PostgreSQL and shared-storage access, sample administration and package flows work through TLS, failed connections are observable, and a rollback owner is explicitly assigned.