Install

Deployment and host setup for a self-hosted Vetrix instance. The three pages below are not variants of one procedure — they cover different layers and different targets. Pick a runtime from the first two: Docker Compose puts the whole stack on a single server with the bundled PostgreSQL and a local volume, while Kubernetes runs the same image in a cluster off applied manifests, where storage is a PVC and the single-replica limit is a property of that volume's access mode. The third page is not a runtime at all — it tunes the TLS-terminating proxy that sits in front of either one, and applies whichever runtime you chose.

Pages

• Docker deployment — Single-server install with Docker Compose: prerequisites, generating JWT_SECRET / SECRET_ENC_KEY / the database password, waiting on the readiness probe, and calling the first-run setup endpoint to create the admin account; then the scripts/install.sh one-step installer, the required and optional environment variables (including when a missing SECRET_ENC_KEY refuses the boot), the /data volume layout, server and worker image builds including multi-arch, the pull-and-restart upgrade path with migrations applied on startup, the liveness and readiness endpoints, and a production hardening checklist that moves TLS and PostgreSQL off the Compose defaults.
• Kubernetes deployment — Cluster install from the manifests in deployments/kubernetes/: build and push the image, edit the secret template, apply namespace through ingress in order, and create the admin account over a port-forward; then production secret handling via External Secrets, Sealed Secrets, or Helm values, the scaling constraint that a ReadWriteOnce PVC pins the deployment to one replica with a Recreate strategy until a ReadWriteMany volume is provisioned, exposing git over SSH through the LoadBalancer service, enabling HTTPS with a cert-manager cluster issuer on the ingress, the configured liveness and readiness probes, rollout and rollback commands, and default CPU and memory requests and limits.
• Front-nginx HTTP/2 and brotli — Edge-proxy tuning applied to whatever terminates TLS in front of Vetrix, not to the Go backend or the Next.js server: the HTTP/2 listener, brotli as the preferred encoding with gzip kept as the fallback, and an advisory Alt-Svc header. Gives the controller-level ConfigMap patch for ingress-nginx alongside the per-ingress annotation, the equivalent standalone nginx server block with the trusted-repo requirement for the brotli module and the gzip-only fallback when it cannot be installed, curl commands that confirm the protocol and both content encodings, the one-node canary window with the metrics that signal a rollback, and the rollback itself — which drops brotli and the header but leaves HTTP/2 enabled.