Self-hosting
Install, configure, operate, and upgrade the hub and providers.
Use the Railgrid SaaS hub to get started without operating the control plane. If you want to run Railgrid on your own infrastructure, choose the software you need to run:
- Install a hub : embedded kcp for a single-replica installation, or external kcp for a highly available control plane you operate separately.
- Self-host an existing provider : connect your runtime to an existing hub.
Managing users on a running hub belongs in Administration . Building a new provider belongs in Extend Railgrid .
Two deployment shapes
These pages describe what Railgrid itself runs. Both shapes use the same charts and the same providers; they differ in how traffic reaches the hub and where state lives.
| Small cluster | Cloud cluster | |
|---|---|---|
| Kubernetes | A single-node or small k3s cluster | A managed cluster (GKE in the examples) |
| Public entry | Cloudflare Tunnel , no inbound ports | Gateway API on a cloud load balancer, DNS-only records |
| TLS at the edge | Cloudflare Universal SSL | Cloud-managed wildcard certificates |
| kcp | External, one etcd member per shard | External, three etcd members per shard across zones |
| Provider databases | Postgres in the cluster | Managed Postgres |
| Object storage | MinIO in the cluster | Cloud object storage through its S3 API |
| Dex state | Postgres | Kubernetes resources |
Both shapes run Dex for OIDC, two hub replicas against external kcp, and the public providers from the oci://ghcr.io/railgrid/charts registry, reconciled by Flux.
Bring-up order
Install the layers in this order, verifying each before the next. Every later layer depends on an earlier one being reachable.
- Public entry: DNS, certificates, and the ingress that will carry every hostname.
- cert-manager, and the kcp-operator if you run external kcp .
- kcp: etcd, shards, and the front proxy.
- Dex , reachable at its public issuer URL.
- The hub .
- Providers , one namespace each.
Before production use, establish a storage and recovery procedure and record the deployed component versions. Source examples are not a certification of a production deployment.