Skip to content
AntharaAntharaAnthara Docs

Deployment overview

This page describes an on-prem Anthara deployment for platform and security teams. It lists what gets deployed, what you need to provide, and what is not available today.

Anthara is installed with an Ansible project. Today, Anthara staff run that installer for you from a separate control machine over SSH. It is not a self-service installer, so this page has no install commands.

What gets deployed

Section titled “What gets deployed”

Everything runs on one Ubuntu virtual machine.

  • The services run as containers under Docker Compose.
  • A single-node k3s cluster runs on the same machine. k3s is a small Kubernetes distribution. Each workflow step runs there as its own short-lived worker.
  • nginx sits in front and routes requests by path.
Service Purpose Port on the VM
nginx Public entry point 80 and 443
Web app The dashboard 3000
API Backend for the web app 8080
Fabric Memory and standards, served over MCP 8000
Fabric worker Processes queued memory writes None
LLM Proxy Proxy for model traffic 8081
Presidio analyzer Detects personal data 5001
Presidio anonymizer Masks personal data 5002
PostgreSQL Application data for the API, Fabric, and the proxy 5432
FalkorDB The memory graph 6379
Redis Queues 6380

When nginx is installed, which is the default, only ports 80 and 443 are reachable from outside. The database ports and the service ports listen on 127.0.0.1.

Public paths

Section titled “Public paths”
Path Goes to
/ Web app
/api/ API
/fabric/ Fabric
/llm-proxy/ LLM Proxy. This path is published only when TLS is on.

What you provide

Section titled “What you provide”
Item Notes
An Ubuntu VM With SSH access and a user that has sudo.
A domain name Pointing at the VM.
A TLS certificate Either a Let’s Encrypt certificate or your own certificate and key. The certificate must be on the VM before TLS is turned on. The installer checks that it exists and does not request one.
At least one sign-in OAuth app With GitHub, Google, or Microsoft. See Sign-in providers.
The first admin’s email address and name This person becomes the first admin.
An Anthropic API key Repository assessments use it.
An OpenAI API key Fabric uses it to extract and search memory.
A GitHub App (optional) Needed for workflows that react to GitHub events. See GitHub.
An Azure DevOps organization URL and webhook secret (optional) Needed for workflows that react to Azure DevOps events. See Azure DevOps.
A Microsoft Teams bot (optional) Needed for Teams cards. See Microsoft Teams.

What the installer does

Section titled “What the installer does”

In outline, the installer does the following on the VM:

  1. Installs Docker, nginx, and a firewall.
  2. Installs k3s for workflow workers.
  3. Copies the Anthara images to the VM. The control machine pulls each image, saves it to a file, and transfers the file, so the VM does not sign in to Anthara’s image registry.
  4. Writes the configuration and starts the services.
  5. Runs database migrations.
  6. Creates the first admin, the standards packs that ship, and the default governance rules.
  7. Runs a health check against every service.

Separate playbooks exist to upgrade the whole deployment, update one service, update the configuration, and repeat the health check.

Each deployment serves one organization.

What is not available

Section titled “What is not available”
  • No rollback. There is no playbook that returns a deployment to an earlier version. Database migrations only move forward.
  • No backup or restore. The installer has no backup or restore playbook. Back up the VM’s volumes with your own tooling.
  • No air-gapped install. During installation the VM needs internet access to download Docker, k3s, the Claude Code CLI from the npm registry, and third-party images such as PostgreSQL, Redis, FalkorDB, the LLM Proxy, and Presidio.
  • No version pinning. The only release definition in the installer points every Anthara image at the latest tag.
  • No Kubernetes deployment of the services. k3s runs workflow workers only. There is no Helm chart.
Section titled “Related pages”