Private Hub

The Orvanta Hub is where scripts, flows, apps and connection types get shared across the community. On Enterprise plans, you can instead point your Orvanta instance at your own Hub deployment, so only items your team has approved are available — nothing is shared outside your organization.

The Private Hub deployment itself ships as a separate bundle, available to licensed Enterprise customers; contact Orvanta to get access rather than looking for a public image.

Setup

Docker

1. Obtain the Private Hub bundle and its docker-compose.yml from Orvanta (Enterprise licence required).
2. Configure the .env file with the database password, your Orvanta instance URL, and your license key.
3. Run docker-compose up -d to start the hub and its database.
4. Update the hub base URL in instance settings to point at your Private Hub.

If users access Orvanta from different URLs (internal vs. public), set APP_ACCESSIBLE_URL in the .env file so the Hub redirects correctly.

Kubernetes

A Helm chart for deploying the Private Hub on Kubernetes ships with the same Enterprise bundle. Ask Orvanta for it — it is not published to a public chart repository.

Authentication requirements

Authentication happens through the Orvanta instance. Both services must share the same root domain (e.g., orvanta.example.com and hub.example.com). Set the COOKIE_DOMAIN environment variable on the Orvanta server to the root domain. Log out and back in after making this change.

Custom CA certificates

For self-signed or internal CA certificates, set the NODE_EXTRA_CA_CERTS environment variable and mount the certificate file.

Docker example:

environment:
  - NODE_EXTRA_CA_CERTS=/certs/ca.pem
volumes:
  - ./certs/ca.pem:/certs/ca.pem:ro

Debugging

• Enable debug logs with DEBUG_LOG=true.
• Access the debug page at /debug for configuration and status information.
• Share logs and debug output with Orvanta support if needed.

Multiple Orvanta instances

A single Private Hub can serve multiple instances. Designate one as the main instance for authentication. Additional instances simply configure their hub base URL, with no further setup required.

Restricting access

Set the API_SECRET environment variable on the Hub. Configure the same value in instance settings under “Private Hub API secret” to restrict access to logged-in users or requests carrying the X-api-secret header.

First steps

Script asks and versions

Scripts organize around “script asks” containing:

• Summary: what the script does.
• Integration: folder/category (use snake_case).

Each ask has one approved version available on connected instances.

Submit, approve, and edit scripts

• Click + Add then Submit a new script to create a new ask and version.
• Navigate to the script and click Approve to make it available across instances.
• Use Edit to modify code; new versions require re-approval.
• Previously used versions remain available with unique IDs.

Search availability

After approving scripts, search results update with delays:

• Hub search: up to 1 hour.
• Orvanta instance search: up to 1 day.

Hub scripts search and embeddings

Vector search uses embeddings computed hourly by the Hub and fetched daily by Orvanta instances.

Configure frequencies with environment variables:

• EMBEDDINGS_REFRESH_INTERVAL_SECS on the Hub (minimum 3600 seconds recommended).
• HUB_EMBEDDINGS_PULLING_INTERVAL_SECS on Orvanta server(s).