Self host Uniffy
Uniffy self hosted runs on Kubernetes. There are two supported paths, and both end in the same product our cloud runs.
The VM path. One machine, one command. The installer brings k3s, every component, and Uniffy itself, makes the opinionated choices for you, and prints your admin password at the end. Start at Install on a VM.
The cluster path. You already run Kubernetes and a platform team. You install a Helm chart, bring your own object storage, and decide a short list of things like where Postgres lives. Start at Install on Kubernetes.
What we support
Section titled “What we support”Every release ships a pinset: the chart version, the image digests, and the component versions we tested together. Install from the pinset and you are running a combination that passed our release checks. Assemble your own combination and you are your own test lab.
Every image in the pinset is signed, and the pinset file itself is signed. You can refuse anything we did not build, by hand or with an admission policy in your cluster. Verify a Release has the commands.
The edge that fronts Uniffy has a strict contract. It must speak HTTP/2 in cleartext to the backend, pass websockets untouched, and carry streams that never time out and never buffer. We ship and test that contract as Envoy Gateway resources, and media for calls relays through STUNner. Other Gateway API implementations may meet the contract on paper. We do not test them and we do not support them. If calls are off, STUNner is optional; Envoy Gateway is not.
Fully isolated deployments
Section titled “Fully isolated deployments”Uniffy never calls home, fetches nothing from third party CDNs at runtime, and keeps telemetry off by default. A deployment that is fully isolated from the internet is a supported configuration. The VM installer takes an offline bundle, and the cluster path ships a mirror script for your private registry.
What is here
Section titled “What is here”- Install on a VM: one command on a fresh Ubuntu machine.
- Install on Kubernetes: the Helm chart on your cluster.
- Upgrades: pinsets, forward only migrations, and the honest rollback story.
- Verify a Release: check the signatures on the pinset, the images, and the SBOM before you trust them.
- Backups and Restore: continuous Postgres backups to S3, point in time recovery, the master key ritual.
- Configure Uniffy: every environment variable.
- System Architecture: services, data stores, scaling, and ports.
- Admins and Operators: the two admin jobs, the wall between them, one account or two.
- Harden the Edge: lock the operator API to your private network.
- Behind an Edge: Cloudflare, CDNs, and corporate load balancers in front of Uniffy.
- Account Recovery: the break glass command for a locked out admin, and unsaved edits after a Valkey restart, including planned Valkey maintenance.
- Licensing: what open source means here.
When you evaluate Uniffy against anything else, ask the other vendor one question. If I run this on my own hardware, fully isolated, do I get the same product you sell in your cloud? Our answer is yes.