Self-Hosted Quick Start

helm repo add hexr https://charts.hexr.dev
helm repo update

kubectl create namespace hexr-system
kubectl create namespace spire

global:
  trustDomain: your-company.internal
  registry: your-registry.example.com/hexr

spire:
  server:
    trustDomain: your-company.internal
  agent:
    socketPath: /run/spire/sockets/agent.sock

attestor:
  database:
    postgres:
      external:
        host: your-postgres.example.com
        port: 5432
        database: hexr_attestor
        user: hexr

hexr-vault:
  vault:
    postgres:
      url: postgresql://hexr:PASSWORD@your-postgres.example.com:5432/hexr_vault

credentialInjector:
  aws:
    roleArn: arn:aws:iam::123456789:role/hexr-agent-role
  gcp:
    workloadIdentityProvider: projects/123/locations/global/workloadIdentityPools/hexr/providers/spire

dashboard:
  ingress:
    enabled: true
    host: dashboard.your-company.com

helm install hexr-runtime hexr/hexr-runtime \
  -n hexr-system \
  -f values.yaml \
  --set attestor.database.postgres.external.password="YOUR_DB_PASSWORD" \
  --timeout 10m

# Check all pods are running
kubectl get pods -n hexr-system
kubectl get pods -n spire

# Expected output:
# spire-server-0                    1/1     Running
# spire-agent-xxxxx                 1/1     Running  (per node)
# auto-registrar-xxxxx              1/1     Running
# cred-injector-xxxxx               1/1     Running
# hexr-vault-xxxxx                  1/1     Running
# hexr-gateway-xxxxx                1/1     Running
# hexr-dashboard removed — dashboard runs in your cluster via Helm values
# otel-collector-xxxxx              1/1     Running
# valkey-0                          1/1     Running

hexr build my_agent.py --tenant my-team --trust-domain your-company.internal
hexr push
hexr deploy