Deploy
Self-hosting
Deploy MergeHarbor in your own Kubernetes cluster or AWS account, connect your identity provider, and choose your model providers.
Self-hosted MergeHarbor runs entirely in your environment: the API, background workers, the review agent, and the data stores. It is available on the Enterprise plan; contact sales for access to images and deployment support.
Components
| Component | Role |
|---|---|
| API | Console API, webhooks, authentication |
| Workers | Indexing and reviews; each holds repository mirrors on local disk |
| Review agent | Runs reviews against your chosen model providers |
| PostgreSQL | Organizations, reviews, findings, audit log, and job queues |
| Vector store | Semantic search (Qdrant, or pgvector in PostgreSQL) |
| Object storage | Optional review archives (any S3-compatible store) |
For very large estates, repositories are distributed across cells — each with its own database, search index, and workers — so capacity grows by adding cells.
Deployment options
- Kubernetes — a Helm chart with autoscaling, pod disruption budgets, network policies, Prometheus monitors, and alert rules.
- AWS — Terraform modules for networking, EKS, Aurora PostgreSQL, S3 with KMS encryption, Secrets Manager, and IAM roles for service accounts.
Identity
Configure an OpenID Connect provider (Okta, Microsoft Entra ID, Google Workspace, Auth0, Keycloak, or any compliant provider) before inviting users. Organizations can then enforce SSO, restrict sign-in to their domains, and map groups to roles. Disable the break-glass administrator token once SSO is working.
Model providers
Choose which providers and models MergeHarbor may use, including Amazon Bedrock and self-hosted open-weight models served by vLLM or Ollama. MergeHarbor routes each task to the most cost-effective allowed model that meets the quality bar for the change.
Operations
- Metrics in Prometheus format and OpenTelemetry traces from every service.
- Readiness and health endpoints for load balancers.
- Rolling upgrades; database migrations run automatically on startup.
- Backups follow your database and object-storage policies; repository mirrors and indexes can be rebuilt from your code hosts.
Production checklist
- Store all secrets in your secret manager.
- Terminate TLS in front of the API, and enable mutual TLS between the review agent and workers.
- Restrict the console’s allowed origins and set the trusted proxy ranges of your load balancer.
- Configure SSO and disable the break-glass token.
- Stream the audit log to your SIEM (Settings → Audit log → Streaming) and set retention to your policy.