Hub deployment
Install, configure, secure, and operate a self-hosted Railgrid hub.
Run the Railgrid hub on your own infrastructure. Choose an installation path, configure access, and establish storage and recovery procedures before onboarding workspaces.
What a hub deployment contains
| Component | Role | Where it is documented |
|---|---|---|
| Hub | Console, API, provider registry, kubeconfig minting. Serves HTTPS on :9443. | Install the hub |
| kcp | The control plane every workspace and provider API lives in. Embedded in the hub pod, or external shards you operate. | External kcp |
| Dex (or another OIDC issuer) | Signs users in. kcp and the hub both verify its tokens. | OIDC |
| Ingress | Carries the console, the issuer, kcp, and published apps under public hostnames with TLS. | Ingress , Gateway API , Cloudflare Tunnel |
| Providers | Capabilities users enable in workspaces. Each is its own chart in its own namespace. | Provider hosting |
Hostnames you will need
Plan these before installing anything; several of them are baked into certificates, kubeconfigs, and OIDC client registrations.
| Hostname | Served by | Needed when |
|---|---|---|
console.example.com | Hub | Always. This is hub.hubExternalURL. |
auth.example.com | Dex | Using OIDC. This is idp.issuerURL and Dex’s config.issuer. |
kcp.example.com | kcp front proxy | Using external kcp and giving users or edges direct kcp access. |
kcp-root.example.com, one per shard | Each kcp shard | Using external kcp: shards advertise these as their virtual-workspace URLs. |
*.apps.example.com | Infrastructure provider routes | Publishing applications and App Studio previews. |
Keep each public hostname exactly one label below a zone whose wildcard certificate you hold. A hostname two labels down (console.dev.example.com) is not covered by a *.example.com certificate.
Where to start
Start with Install the hub . For a production deployment, read authentication , external kcp , and operations before onboarding users.