Self-hosted / Deployment guide
ScanDrix deploys as a set of services you operate: in a private VPC, on-prem, or in a network you have prepared without an internet path. The product surface is the same you use on our hosted plan — dashboard, Kody rules, Dry Runs, CLI, and Cockpit metrics.
A private deployment means the services run inside your network while a small set of egress paths — your Git provider, and either an internal model endpoint or an allow-listed provider — remain permitted. An air-gapped deployment removes that last dependency: no request in the review path needs to leave the network, which also means the Git host, the inference endpoint, and the release artifacts all have to exist inside it.
Git provider
Edge of your boundary
Your existing host delivers a signed webhook. ScanDrix reaches it outbound to fetch diffs and post results.
ScanDrix review services
Inside your boundary
Ingest validates the signature and writes an outbox record, the relay publishes to RabbitMQ, and workers run the review and post it back.
Model endpoint
You choose the endpoint
An internal vLLM or Ollama server keeps inference in the same network. An approved external provider works too, if your egress policy allows it.
Marked stage runs where you control the host
Egress exists only where you configure it
01Choose your boundary
The mode changes what you operate, not what the product does. Each one assumes the same six services and the same prerequisites below.
AWS, GCP, or Azure
Services run in your cloud network next to the databases, queues, and storage you already operate.
ScanDrix provides
You provide
Your data centre or host environment
Services run on hardware and a network you control, with no dependency on our infrastructure.
ScanDrix provides
You provide
A prepared network with no internet path
Nothing in the review path needs internet reachability — which moves most of the integration work onto your team.
ScanDrix provides
You provide
No mode removes configuration work. The difference is who performs it and how much of it sits inside your own change-control process.
02What runs where
Every review starts at a Git provider, runs through your deployment, and reaches a model endpoint you chose. Understanding those three positions is enough to reason about the data path.
01Git provider
Edge of your boundary
Your existing host delivers a signed webhook. ScanDrix reaches it outbound to fetch diffs and post results.
02ScanDrix review services
Inside your boundary
Ingest validates the signature and writes an outbox record, the relay publishes to RabbitMQ, and workers run the review and post it back.
03Model endpoint
You choose the endpoint
An internal vLLM or Ollama server keeps inference in the same network. An approved external provider works too, if your egress policy allows it.
03Deployment paths
Both paths run the same six services: api, worker, relay, web, and the PostgreSQL, MongoDB, and RabbitMQ instances they need. Choose the one that matches the environment you already operate.
Commands below are an illustrative starting point, not a substitute for the guide — version tags, hostnames, and secrets are yours to set.
Read the full deployment guideIllustrative starting point
Unpack the release bundle, set the environment file, and bring the stack up on one Linux host.
Terminal
release-bundle
# 1. Unpack the release bundle
tar -xzf scandrix-selfhosted-<version>.tar.gz && cd scandrix
# 2. Configure
cp .env.example .env
$EDITOR .env # set SCANDRIX_SECRET, DATABASE_URL, LLM_BASE_URL...
# 3. Start the stack
docker compose up -d
# 4. Create the first admin
docker compose exec api scandrix bootstrap-admin --email admin@example.comShowing the Docker Compose path.
Reverse proxy & TLS04Operational requirements
A self-hosted install is a long-lived service with a real runbook. This is the split we are asking you to accept before anything is installed.
05Security & compliance boundary
Running ScanDrix inside your environment lets your existing identity, network, logging, and retention controls apply to it directly. That is useful for regulated environments — but it is an enabler, not an attestation.
SOC 2 alignment documentation, the current subprocessor list, and a DPA are available under NDA. Security questions and vulnerability reports go to security@scandrix.dev.
06Next step
A deployment review covers your network, the inference endpoint you intend to use, and the requirements your own auditors will ask about.