Self-host OpenCluster

Run the OpenCluster control plane with PostgreSQL and expose only the listeners you need.

OpenCluster runs as one static control-plane binary backed by PostgreSQL. Database migrations run at startup. Alert intake, operator access, and Relay traffic use separate listeners so you can expose each on the appropriate network.

Requirements

• Go 1.26.6 to build from source
• PostgreSQL reachable from the control plane
• a TLS-terminating proxy for any public intake or Relay listener
• a model-provider account if you want to run investigations

Start the control plane

Build the binary:

CGO_ENABLED=0 go build -trimpath -o oc-controlplane ./cmd/controlplane

Write the PostgreSQL DSN to a secret file, then start a minimal instance:

umask 077
printf '%s' 'postgres://user:password@postgres:5432/opencluster?sslmode=require' \
  > /tmp/opencluster-dsn

OC_HTTP_ADDRESS=0.0.0.0:8080 \
OC_PLACEMENTS=shared=/tmp/opencluster-dsn \
OC_DEFAULT_PLACEMENT=shared \
./oc-controlplane

Check startup and readiness:

curl --fail http://127.0.0.1:8080/healthz
curl --fail http://127.0.0.1:8080/readyz

This minimal process exposes only health, readiness, and metrics. Configure the operator, intake, Relay, and investigation settings before using the product workflow.

Listener boundaries

Listener	Purpose	Recommended exposure
OC_HTTP_ADDRESS	/healthz, /readyz, and /metrics	Internal monitoring network
OC_OPERATOR_ADDRESS	Operator API and browser sign-in	Private network, behind TLS
OC_INTAKE_ADDRESS	Alertmanager webhooks	Publicly reachable where needed, behind TLS
OC_RELAY_ADDRESS	Outbound Relay sessions	Publicly reachable from clusters, behind the pinned TLS endpoint

Next: Configuration and Operations.