Docs/Infrastructure/Deployment Guide
Deployment Guide
Deploy GovernanceAI to production with Docker Compose or Kubernetes.
Advanced8 min readUpdated June 2026
GatewayAll Services
GovernanceAI ships as Docker images for all fourteen services. This guide covers deploying with Docker Compose for small teams, and Kubernetes for large-scale production deployments.
Before deploying to productionSet
ENVIRONMENT=production in all services. This disables development authentication bypasses, enforces JWT signature verification, and enables strict rate limiting.Docker Compose
1
Clone and configure
git clone https://github.com/your-org/governance-ai.git cd governance-ai cp .env.example .env # Edit .env with your values
2
Configure environment
Set the required variables in
.env:DATABASE_URL=postgresql://gov:securepass@postgres:5432/governance REDIS_URL=redis://redis:6379 JWT_SECRET_KEY=replace-with-64-char-random-string ENVIRONMENT=production OPENAI_API_KEY=sk-... RATE_LIMITING_ENABLED=true
3
Start the stack
docker compose up -d # Run database migrations docker compose exec api-gateway alembic upgrade head # Verify all services are healthy curl http://localhost:8000/health | jq .
Kubernetes
Helm charts are provided for each service. Deploy the full stack to a Kubernetes cluster:
# Install with Helm helm repo add governance-ai https://charts.governance-ai.io helm repo update helm install governance-ai governance-ai/full-stack \ --namespace governance \ --create-namespace \ --set global.environment=production \ --set global.database.url=$DATABASE_URL \ --set global.redis.url=$REDIS_URL \ --set global.jwt.secret=$JWT_SECRET_KEY \ -f values.production.yaml
TLS and reverse proxy
In production, expose only the API gateway (port 8000) through your reverse proxy (nginx, Caddy, or a cloud load balancer). All internal service-to-service communication stays on the private network.
server {
listen 443 ssl;
server_name gateway.your-org.com;
ssl_certificate /etc/ssl/certs/cert.pem;
ssl_certificate_key /etc/ssl/private/key.pem;
location / {
proxy_pass http://localhost:8000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_read_timeout 60s;
}
}Health check endpointsConfigure your load balancer to poll
GET /health every 10 seconds. The gateway returns 503 if any critical dependency (database, Redis) is unhealthy, triggering automatic traffic failover.