Quickstart

Pick the row that matches what you have. Profiles compared: dev, pilot, production.

You have	Page	Profile	Connector route	What you need
One Linux host with a public name	One Linux host	pilot	tunneled: public_join on 50061	systemd PostgreSQL on the host a certificate pair for the name an OIDC client
One Linux host, IP address only	One Linux host, IP address only	pilot	tunneled through the join relay on 50064	systemd PostgreSQL on the host an OIDC client
Authority internal, Proxy in a DMZ	Separate hosts	pilot	tunneled	two hosts with a private route a firewall on the Authority host PostgreSQL a certificate pair an OIDC client
Docker Compose	Docker Compose	pilot	tunneled	Docker Engine with Compose v2 the release image a certificate pair an OIDC client
Kubernetes	Kubernetes	pilot	tunneled	a cluster with a LoadBalancer implementation Helm or kubectl PostgreSQL a certificate pair an OIDC client
Docker Swarm	Docker Swarm	pilot	tunneled through the client port	Docker Engine, one node the release image a certificate pair an OIDC client
A connector to an existing gateway	One command for a connector	the cluster's own	the route the cluster already uses	a one-time connector token the backend address
A client to an existing gateway	Connect to the cluster	the cluster's own	n/a	the transport CA fingerprint or a public certificate an OIDC account

Certificate modes for any row (IP address only, Let's Encrypt, your own CA): Certificates. Every connector route, in full: split deployment, routes. Changing something after the first start: What a change affects. Every scenario, including what each needs: Deploy.

Install and verify

1. Acquire and verify the supplied build.
2. Follow the deployment page selected above, including its Verify table.
3. Complete the access checks from a client workstation and keep the results with the deployment record.