> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hexr.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Self-Hosted Quick Start

> Deploy Hexr on your own Kubernetes cluster — EKS, GKE Standard, AKS, or on-premises. Your cluster, your Postgres, your evidence.

## Prerequisites

| Requirement | Minimum                          |
| ----------- | -------------------------------- |
| Kubernetes  | 1.28+                            |
| Helm        | 3.12+                            |
| kubectl     | Configured with cluster access   |
| PostgreSQL  | 14+ (external or in-cluster)     |
| Nodes       | 3 nodes, 4 vCPU / 16 GB RAM each |

***

## 1. Add the Helm Repository

```bash theme={null}
helm repo add hexr https://charts.hexr.dev
helm repo update
```

***

## 2. Create Namespace

```bash theme={null}
kubectl create namespace hexr-system
kubectl create namespace spire
```

***

## 3. Configure Values

Create `values.yaml`:

```yaml theme={null}
global:
  trustDomain: your-company.internal
  registry: your-registry.example.com/hexr

spire:
  server:
    trustDomain: your-company.internal
  agent:
    socketPath: /run/spire/sockets/agent.sock

attestor:
  database:
    postgres:
      external:
        host: your-postgres.example.com
        port: 5432
        database: hexr_attestor
        user: hexr

hexr-vault:
  vault:
    postgres:
      url: postgresql://hexr:PASSWORD@your-postgres.example.com:5432/hexr_vault

credentialInjector:
  aws:
    roleArn: arn:aws:iam::123456789:role/hexr-agent-role
  gcp:
    workloadIdentityProvider: projects/123/locations/global/workloadIdentityPools/hexr/providers/spire

dashboard:
  ingress:
    enabled: true
    host: dashboard.your-company.com
```

***

## 4. Install

```bash theme={null}
helm install hexr-runtime hexr/hexr-runtime \
  -n hexr-system \
  -f values.yaml \
  --set attestor.database.postgres.external.password="YOUR_DB_PASSWORD" \
  --timeout 10m
```

***

## 5. Verify

```bash theme={null}
# Check all pods are running
kubectl get pods -n hexr-system
kubectl get pods -n spire

# Expected output:
# spire-server-0                    1/1     Running
# spire-agent-xxxxx                 1/1     Running  (per node)
# auto-registrar-xxxxx              1/1     Running
# cred-injector-xxxxx               1/1     Running
# hexr-vault-xxxxx                  1/1     Running
# hexr-gateway-xxxxx                1/1     Running
# hexr-dashboard removed — dashboard runs in your cluster via Helm values
# otel-collector-xxxxx              1/1     Running
# valkey-0                          1/1     Running
```

***

## 6. Deploy Your First Agent

```bash theme={null}
hexr build my_agent.py --tenant my-team --trust-domain your-company.internal
hexr push
hexr deploy
```

***

## Next Steps

<CardGroup cols={2}>
  <Card title="Terraform Setup" icon="cloud" href="/self-hosted/terraform">
    Infrastructure as code for cloud providers.
  </Card>

  <Card title="Air-Gapped" icon="lock" href="/self-hosted/air-gapped">
    Deploy without internet access.
  </Card>
</CardGroup>