> ## Documentation Index
> Fetch the complete documentation index at: https://docs.open-cluster.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Self-host OpenCluster

> Run the OpenCluster control plane with PostgreSQL and expose only the listeners you need.

OpenCluster runs as one static control-plane binary backed by PostgreSQL. Database
migrations run at startup. Alert intake, operator access, and Relay traffic use separate
listeners so you can expose each on the appropriate network.

## Requirements

* Go 1.26.6 to build from source
* PostgreSQL reachable from the control plane
* a TLS-terminating proxy for any public intake or Relay listener
* a model-provider account if you want to run investigations

## Start the control plane

Build the binary:

```bash theme={null}
CGO_ENABLED=0 go build -trimpath -o oc-controlplane ./cmd/controlplane
```

Write the PostgreSQL DSN to a secret file, then start a minimal instance:

```bash theme={null}
umask 077
printf '%s' 'postgres://user:password@postgres:5432/opencluster?sslmode=require' \
  > /tmp/opencluster-dsn

OC_HTTP_ADDRESS=0.0.0.0:8080 \
OC_PLACEMENTS=shared=/tmp/opencluster-dsn \
OC_DEFAULT_PLACEMENT=shared \
./oc-controlplane
```

Check startup and readiness:

```bash theme={null}
curl --fail http://127.0.0.1:8080/healthz
curl --fail http://127.0.0.1:8080/readyz
```

This minimal process exposes only health, readiness, and metrics. Configure the
[operator, intake, Relay, and investigation settings](/self-hosted/configuration) before
using the product workflow.

## Listener boundaries

| Listener              | Purpose                               | Recommended exposure                                             |
| --------------------- | ------------------------------------- | ---------------------------------------------------------------- |
| `OC_HTTP_ADDRESS`     | `/healthz`, `/readyz`, and `/metrics` | Internal monitoring network                                      |
| `OC_OPERATOR_ADDRESS` | Operator API and browser sign-in      | Private network, behind TLS                                      |
| `OC_INTAKE_ADDRESS`   | Alertmanager webhooks                 | Publicly reachable where needed, behind TLS                      |
| `OC_RELAY_ADDRESS`    | Outbound Relay sessions               | Publicly reachable from clusters, behind the pinned TLS endpoint |

Next: [Configuration](/self-hosted/configuration) and
[Operations](/self-hosted/operations).