Self-hosting moves the Nokku control plane into your own infrastructure. Everything (identities, certificate authorities, access assignments, and audit logs) runs in your environment rather than in Nokku Cloud. This is the deployment for air-gapped or otherwise isolated networks.
The nk CLI and nokkud daemon connect to whichever core you point them at, so the rest of the product works the same way whether you use Nokku Cloud or self-host.
Requirements
- The
nokkucore binary and web application, from the releases page. - PostgreSQL: required; the core stores all state in PostgreSQL.
- Optionally an external KMS for envelope encryption (AWS KMS, Google Cloud KMS, HashiCorp Vault, or Scaleway KMS), instead of a local encryption secret.
The current, complete set of environment variables is maintained in the nokku README and in the core configuration reference.
Run
export NOKKU_BASE_URL=https://nokku.example.com
export NOKKU_SECRET=<32-byte-random-secret>
export NOKKU_TRUSTED_PROXIES=10.0.0.0/8
./nokkuSet NOKKU_SECRET to a 32-byte random value, or configure KMS_URI to use an external key-management service so secrets (CA private keys, OIDC/SAML credentials) are encrypted with a key the core does not hold locally.
Point your workstations and servers at this instance with --api / NK_API_URL (CLI) and --api / NOKKUD_API_URL (daemon).
Plan and license
Self-hosted instances work out of the box on the Community plan. To activate Enterprise features on your own instance, use a license key.
Related
- Core Configuration: environment variables and secret rotation
- Enterprise license keys: activate Enterprise features offline
- Data Subprocessors: which providers are not involved when you self-host