Skip to content
Orvanta Docs

Self-hosting Overview

Orvanta can be deployed on your own infrastructure, whether that’s a single VM, a Kubernetes cluster, or a managed container platform. Self-hosting gives you:

  • Data sovereignty. Your workflow data never leaves your infrastructure.
  • Custom networking. Run behind a VPN or private network.
  • Compliance. Meet regulatory requirements that prohibit third-party data processors.
  • Cost control. Predictable infrastructure costs for high-volume workloads.

Architecture overview

Section titled “Architecture overview”

A self-hosted Orvanta deployment consists of the following components:

ComponentDescription
API serverCore REST API and webhook receiver.
Worker poolExecutes workflow nodes (polyglot runtime).
EditorWeb-based node editor (served as a static SPA).
DatabasePostgreSQL — stores workflows, scripts, audit logs, and the job queue (workers poll Postgres; no separate broker required).
Object storageS3-compatible (optional): stores large job results and workspace artefacts.

Deployment options

Section titled “Deployment options”
OptionBest for
Docker ComposeSingle-machine deployments, local testing.
Kubernetes (Helm)Production, high-availability deployments.
Managed PaaSRender, Railway, Fly.io. No deployment guide exists yet.

Kubernetes (Helm)

Section titled “Kubernetes (Helm)”

Since 6.2.0 the chart is published as an OCI artifact on GitHub Container Registry, next to the images. The chart is orvanta, version 4.1.3 (application version 6.2.0); the chart version moves independently of the platform version.

Terminal window
helm registry login ghcr.io
helm install myorvanta oci://ghcr.io/orvanta-cloud/charts/orvanta \
  --version 4.1.3 -n orvanta --create-namespace --values values.yaml

Upgrade with helm upgrade myorvanta oci://ghcr.io/orvanta-cloud/charts/orvanta --version <chart-version> -n orvanta --values values.yaml. The package is private by default, so helm registry login needs credentials that can read it, and the application images may need orvanta.imagePullSecrets set. Until the package is made public, a registry login is required even to pull the chart.

Notes on the default values:

  • The chart ships a demo PostgreSQL and a demo MinIO. They are not persistent and are for testing only: point orvanta.databaseUrl at a managed Postgres for anything real (see Running without a Postgres superuser if the role is not a superuser).
  • orvanta.baseDomain and orvanta.baseProtocol build the instance’s BASE_URL.
  • Workers are configured under orvanta.workerGroups.

The chart’s own repository documents every value. Ignore the helm repo add instructions in its README: they predate OCI publishing, and no classic Helm repository was ever published.

Next steps

Section titled “Next steps”