Self-hosted Setup
For teams with strict data-residency or air-gapped requirements.
What you'll deploy
| Component | Tech | Notes |
|---|---|---|
| Vibecontrols backend | A stateful API service | Container, 3+ replicas behind a load balancer |
| Postgres | 18+ with the graph extension extension | Replication recommended |
| Redis | 7+ | For cache + the event bus events |
| Web app (the Vibecontrols web app) | React 19 + Vite 7 + Tailwind v4 | Build → S3 + CDN |
| Plannotator portal (optional) | Node service | If you use the plan plugin |
frps (optional) | Free open-source | Only if you use VibeTunnels (frp) tunnels |
Prerequisites
- Postgres
- Redis 7+ (or compatible — Redis, ElastiCache, etc.)
- Container runtime (Docker/our previous orchestrator/our cloud platform/ECS)
- TLS-terminating reverse proxy (nginx, Caddy, ingress controller)
- A schema registry for federation (we use the schema registry; you can self-host)
High-level steps
- Provision Postgres + Redis
- Apply backend migrations (single command on the backend container; see your release notes for the exact invocation)
- Build + push the backend container to your registry
- Deploy backend (3+ replicas) behind LB
- Build + deploy the web app (
bun run buildthen sync to S3/static host) - Configure the platform gateway to include the Vibecontrols backend
- Configure required Configuration entries (see below)
- Smoke-test with a fresh install of the agent
Required Configuration entries
After backend is up, set these via vibecontrols config set --scope GLOBAL:
| Key | Example |
|---|---|
platform.web.publicUrl | https://app.your-vibecontrols.example.com |
platform.graphql.publicUrl | https://api.your-vibecontrols.example.com/graphql |
tunnel.provider | cloudflare or vibetunnels |
tunnel.vibetunnels.frpsUrl | (if using VibeTunnels) |
tunnel.vibetunnels.frpsAuth | (if using VibeTunnels — mark isSecret) |
agent.updates.installScriptUrl | Optional — for self-hosted agent updates |
Reference repos
- Plannotator portal (only if you use the plan plugin)
Detailed runbook
Internal runbooks are at ~/products/confidential/servers/ (not public). Contact vignesh@burdenoff.com for the redacted public version.