Self-hosted deployment
Helm chart plus container images — run DriftGuard in your own Kubernetes cluster.
Architecture
The API is a single container built from apps/api/Dockerfile. It needs three things at runtime: a Postgres database, a Redis instance for the job queue, and a GitHub App so it can receive webhooks and post checks. Anthropic powers the AI review. See environment variables for the full list.
Docker
The fastest way to run a single instance. Migrations run on startup:
# Build from the API package docker build -t driftguard-api apps/api docker run -p 8000:8000 \ -e DATABASE_URL=postgres://user:pass@db:5432/driftguard \ -e REDIS_URL=redis://redis:6379/0 \ -e SECRET_KEY=$(openssl rand -hex 32) \ -e GITHUB_APP_ID=123456 \ -e GITHUB_APP_PRIVATE_KEY="$(cat app.pem)" \ -e GITHUB_WEBHOOK_SECRET=whsec_… \ -e ANTHROPIC_API_KEY=sk-ant-… \ driftguard-api
Helm (Kubernetes)
For production, deploy the container to your cluster and wire secrets from your secret store rather than passing them on the command line:
helm install driftguard ./charts/driftguard \ --namespace driftguard --create-namespace \ --set image.tag=latest \ --set env.GITHUB_APP_ID=123456 \ --set externalSecrets.enabled=true # pull SECRET_KEY, keys, DSN from your secret store # Postgres + Redis are dependencies — point at managed services in production.
DriftGuard is in early access — self-hosting is intended for teams comfortable operating a Python service with Postgres and Redis. Point the GitHub App's webhook URL at your instance's /api/v1/webhooks/github.