Self-Hosting Overview
Deploy the Ensemble platform inside your own AWS or GCP account using Terraform and the official Helm chart.
Self-hosting lets you run the entire Ensemble platform inside your own cloud account, under your own network, identity, and data-governance controls. Nothing leaves your infrastructure except the outbound calls you explicitly configure (for example, to your chosen LLM providers).
This section is written for the platform, infrastructure, and DevOps engineers who will stand up and operate the deployment. It assumes working familiarity with Kubernetes, Terraform, and your target cloud (AWS or GCP).
What you deploy
The platform ships as a set of container images deployed to a Kubernetes cluster (Amazon EKS or Google GKE) via a single Helm chart, plus a small set of managed cloud resources provisioned with Terraform.
Application workloads (Helm)
The web UI, API server, background worker, and database migration job, deployed to your cluster from one Helm chart.
Supporting resources (Terraform)
Object storage, a secrets store, IAM/identity, KMS keys, and (optionally) a managed auth provider, created in your account.
Deployment paths
Two supported clouds, one chart. The application layer is identical across clouds; only the surrounding managed services differ.
Deploy on AWS (EKS)
EKS cluster, ECR, Secrets Manager, S3, Cognito, ALB ingress with ACM TLS.
Deploy on GCP (GKE)
GKE Autopilot cluster, Artifact Registry, Secret Manager, GCS, Firebase Auth, GCE ingress with a Google-managed certificate.
High-level architecture
See Architecture for the component-by-component breakdown, data flows, and the security model.
What you provide
Self-hosting is a shared-responsibility model. You bring and operate the foundational infrastructure; the chart and Terraform wire the platform onto it.
| You provide | The platform provides |
|---|---|
| A Kubernetes cluster (EKS or GKE) | Application container images and the Helm chart |
| A PostgreSQL database | Schema creation and migrations (automatic) |
| A domain name and TLS strategy | Ingress, service, and certificate wiring |
| LLM provider API keys | Provider integrations and routing |
| A Temporal endpoint (Cloud or self-hosted) | The worker that runs workflow activities |
| Cloud IAM/permissions to run Terraform | Terraform modules for the supporting resources |
How to read this section
1. Architecture
Understand the components and dependencies before you build.
2. Prerequisites
Tools, accounts, sizing, and cost planning.
3. Configuration
The full environment variable and secrets reference.
4. Helm chart
Chart values, images, ingress, and the migration job.
5. Terraform
Modules, variables, and outputs for AWS and GCP.
6. Deploy
End-to-end walkthroughs for AWS and GCP.
7. Operations
Upgrades, backups, scaling, and teardown.
8. Troubleshooting
Diagnose common deployment issues.
Version compatibility: this guide targets the current chart and image release
line. Pin a specific chart version and matching image tag for reproducible
production deployments rather than tracking a moving latest tag. See
Helm chart for how image tags map to chart versions.