Self-hosting
Run Surface inside your own infrastructure. Arranged with us, and here is what it takes.
Surface is a hosted service. Everything else in these docs assumes the console at console.superalign.ai and endpoints reporting to *.superalign.ai.
If your policy says the console and its database have to stay inside your own network, we support that. It is arranged with us rather than self-served: there is no public installer, and the images are not on a public registry.
Talk to us first
Write to SuperAlign support before you plan the infrastructure. Tell us:
- How many endpoints you expect to enrol, and over how long. This is the number that decides the sizing.
- Where it will run: cloud provider and region, or on-premise.
- Whether the endpoints will have any internet access at all.
We size the deployment with you and give you the images, the Helm chart, and the licence.
Minimum specification
Everything runs as a container. This is a floor for a small fleet, not a target for a large one.
| Component | Pods | Each pod | What it does |
|---|---|---|---|
| Backend | 2 | 2 vCPU, 4 GB RAM | The HTTP API: sign-in, enrolment, scan ingest, actions |
| Gateway | 2 | 2 vCPU, 4 GB RAM | Holds one live WebSocket per endpoint, for actions that arrive in seconds instead of at the next scan |
| Console | 1 | 2 vCPU, 4 GB RAM | The web interface |
| Postgres | 1 | 2 vCPU, 4 GB RAM, 50 GB disk | Every asset, failed policy, action, and session |
Two backend pods and two gateway pods are a minimum for availability rather than for throughput: either can be restarted or lost without the fleet noticing.
What is not in that table
You provide these, and they are sized separately. Authentication is not among them: the backend handles sign-in itself, so there is no identity provider to stand up.
| You need | Why |
|---|---|
| An ingress that terminates TLS and passes WebSocket upgrades | Endpoints reach the backend and the gateway through it |
| The configuration API and its own small Postgres database | Endpoints fetch their discovery rules from it. It is a separate service with a separate hostname |
| Backups of Postgres | Everything Surface knows lives there. Losing it means re-enrolling the fleet |
A read replica is worth having for failover and for backups without touching the primary. The application does not read from one today: the backend takes a single database URL, so a replica is a resilience measure, not extra query capacity.
How much load this handles
Each gateway pod holds 10,000 endpoint WebSockets. Two pods carry 20,000 endpoints connected at once, and every further 10,000 endpoints takes one more pod. The cap is exact: past it an endpoint’s connection is refused, rather than everyone’s slowing down. An endpoint with no live connection still scans on its own, so its actions arrive at the next 15-minute scan instead of within seconds.
Related
- Requirements for what the endpoints themselves need
- Data handling for what is stored and for how long