Skip to content

docs: add enterprise CTA banners to PostgreSQL self-hosting page #288

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
saifsmailbox98 merged 2 commits into from
Jun 21, 2026
Merged

docs: add enterprise CTA banners to PostgreSQL self-hosting page #288

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
105aa58
docs: add enterprise CTA banners to PostgreSQL self-hosting page
devin-ai-integration[bot] Jun 21, 2026
f5af051
docs: add enterprise CTA before Kubernetes example section
devin-ai-integration[bot] Jun 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions docs/self-hosting/postgres.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,10 @@ title: "PostgreSQL Database"
description: "Deploy Agent Vault with PostgreSQL for production and multi-instance setups"
---

import EnterpriseCTA from "/snippets/enterprise-cta.mdx";

<EnterpriseCTA />

## Overview

Agent Vault uses an embedded SQLite database by default, which requires no setup. For production deployments, or when running multiple instances, switch to PostgreSQL.
Expand Down Expand Up @@ -121,6 +125,8 @@ Save the output in your platform's secret store (Kubernetes Secrets, Docker secr
The SQLite file is left intact. If anything goes wrong, remove `DATABASE_URL` and restart to fall back immediately.
</Tip>

<EnterpriseCTA />

## Example: Kubernetes

A minimal setup with two replicas. The MITM proxy terminates TLS itself, so it needs a Layer-4 (TCP) load balancer. The API/UI can sit behind a standard HTTP Ingress.
Expand Down Expand Up @@ -280,6 +286,8 @@ In production, place an L4 load balancer (HAProxy, nginx stream, cloud LB) in fr
- **Advisory locks**: Service-config writes acquire a Postgres advisory lock scoped to the vault, preventing concurrent writes from producing an inconsistent config. Reads are lock-free.
- **Two listener types**: The API (`:14321`) is standard HTTP -- put it behind an L7 load balancer with TLS termination. The MITM proxy (`:14322`) does its own TLS handshake with upstreams, so the load balancer must do TCP (L4) passthrough.

<EnterpriseCTA />

## Rollback

If you need to revert to a single-instance deployment:
Expand Down