Self-hosted deployment overview
Loambase Foundry is an ontology-driven agent platform designed for complex enterprise network environments. We offer a standard on-premise deployment that runs in your own datacenter, a private cloud (VPC), or a managed Kubernetes cluster.
This guide explains the overall architecture, network planning and environment requirements for self-hosted deployment — aimed at IT administrators and DevOps architects.
1. Deployment architecture
Loambase Foundry is fully cloud-native and containerized. All services are stateless; persistence relies entirely on the underlying storage components.
A standard self-hosted deployment contains these core logical layers:
- Ingress & routing Built on an NGINX Ingress Controller — handles HTTPS termination, certificate management, and wildcard-tenant routing.
- Identity provider Ships with Keycloak as the unified identity center, bridging to your existing LDAP/AD domain or external OIDC providers.
- Foundry core The Foundry Backend API and Frontend web console — metadata management, pipeline scheduling and the app builder.
- Storage & lakehouse A relational metadata database (PostgreSQL) plus a massive data lake (Iceberg/S3) — stores system configuration, ontology models and business data.
2. Delivery artifacts
The standardized delivery package for self-hosted Loambase Foundry includes:
- Container registry: the private image list for all core components.
- Kubernetes manifests: a standard Kustomize configuration bundle or Helm Chart for declarative Infrastructure-as-Code (IaC) management.
- Bootstrap jobs: automated scripts started with the cluster — register the initial tenant, write default system configuration and built-in demo accounts.
3. Domain & routing plan
To support a securely isolated multi-tenant architecture, the platform enforces strict subdomain routing at the network layer. Before requesting a deployment, your IT department allocates one primary domain (e.g. foundry.yourcompany.com) and configures the DNS records:
| Domain record | Type | Purpose |
|---|---|---|
foundry.yourcompany.com | A record | Platform main entry and operations portal. |
auth.foundry.yourcompany.com | A record | Unified identity center entry (points at the bundled Keycloak). |
*.foundry.yourcompany.com | Wildcard | Tenant-level wildcard. When a new tenant (e.g. tenant-1) is assigned, the system automatically takes over that domain’s traffic routing. |
Next step
Read Environment & requirements for concrete server specs, Kubernetes versions and port exposure requirements.