Deployment

Run it your way

One command for a single machine, a manifest set for a cluster, or a tarball for a site with no path to a registry — all three from the same images.

Get the bundle, then install

Customers get the deployment bundle from the licensing portal's Downloads page, not by cloning this repository — an air-gapped tarball with every image embedded, or a lighter compose bundle that pulls its images from the registry using the credentials in your licence e-mail. Extract it and, optionally, set a hostname and TLS mode in .env — the default is localhost with a self-signed certificate. With the air-gapped tarball:

tar -xzf dsh-stack-0.1.0-airgap.tar.gz && cd dsh-stack-0.1.0-airgap
for t in images/*.tar; do docker load -i "$t"; done
docker compose up -d --wait
docker compose logs control-plane | grep -A6 'FIRST-BOOT ADMIN'

The whole stack self-hosts with one command; an air-gap bundle ships every image.

Day 2 operations

One operator CLI covers status, backup, upgrade and restore. The backup includes the key-encryption key, so guard the archive like a credential:

./dsh-stack status
./dsh-stack backup            # includes the KEK — guard the archive like a key
./dsh-stack upgrade 0.2.0
./dsh-stack restore <archive>

On a k3s cluster

The same images deploy from a manifest set — a namespace, a secret and an apply:

export KUBECONFIG=~/.kube/dsh-k3s.yaml
kubectl create ns advisor
kubectl -n advisor create secret generic advisor-secrets \
  --from-literal=secret_key="$(openssl rand -hex 32)" \
  --from-literal=kek.b64="$(openssl rand -base64 32)" \
  --from-literal=db_password="$(openssl rand -hex 32)" \
  --from-literal=gateway_token="$(openssl rand -hex 32)" \
  --from-literal=admin_password="$(openssl rand -base64 24 | tr -d '/+=' | cut -c1-20)"
kubectl -n advisor apply -f deploy/k3s/advisor/
kubectl -n advisor rollout status deploy/advisor

A self-hosted deployment brings its own model the same way a hosted one does.

Bring your own model — OpenAI-compatible endpoints, Ollama, Anthropic, or Cloudflare AI Gateway / Workers AI — with keys envelope-encrypted at rest.

Runtime-editable URLs

The public URLs the control plane hands to agents, and the ones it uses for the identity-provider callback, are changed from the console's Settings page — not by redeploying.

Enrollment wizard and the data-boundary view

A guided enrollment wizard, and a site view that shows exactly where data is allowed to cross the boundary, are part of the hosted control plane rather than of a self-hosted install.

Run it your way

Request a demo