Kubernetes

Production deployment uses the Helm chart at helm/epistom/.

InstallationCopy Anchor Link

helm install epistom ./helm/epistom \
  --namespace epistom \
  --create-namespace \
  -f helm/epistom/values.yaml

Values FilesCopy Anchor Link

Three values files support different environments:

Production (values.yaml)Copy Anchor Link

Default production configuration with recommended resource requests, replica counts, and security settings.

Development (values-dev.yaml)Copy Anchor Link

Lower resource requests, debug logging, and relaxed security for development clusters:

helm install epistom ./helm/epistom \
  --namespace epistom-dev \
  --create-namespace \
  -f helm/epistom/values-dev.yaml

Air-Gapped (values-airgapped.yaml)Copy Anchor Link

For deployments without internet access:

• Private container registry references
• No external network dependencies
• Local LLM (Ollama) configuration

helm install epistom ./helm/epistom \
  --namespace epistom \
  --create-namespace \
  -f helm/epistom/values-airgapped.yaml

Key ConfigurationCopy Anchor Link

DatabaseCopy Anchor Link

database:
  url: postgresql://user:pass@postgres:5432/epistom
  # Or use individual connection parameters
  host: postgres
  port: 5432
  user: epistom
  password: epistom
  name: epistom

LLM ProviderCopy Anchor Link

llm:
  provider: anthropic       # anthropic, openai, bedrock, ollama
  modelId: claude-sonnet-4-5
  apiKey: <from-secret>

OxigraphCopy Anchor Link

oxigraph:
  enabled: true              # Set false for Praxom-only
  persistence:
    enabled: true
    size: 10Gi

Rate LimitingCopy Anchor Link

rateLimiting:
  enabled: true
  requestsPerMinute: 100
  redis:
    url: redis://redis:6379/0  # Required for multi-pod

Production ChecklistCopy Anchor Link

• Set EPISTOM_AUTH_DISABLED=false
• Configure EPISTOM_JWT_SECRET (256-bit hex)
• Configure EPISTOM_ENCRYPTION_KEY (Fernet key)
• Configure EPISTOM_PRAXOM_ED25519_PRIVATE_KEY (Ed25519 private key). EPISTOM_PRAXOM_SIGNING_KEY is the HMAC dev key, not Ed25519.
• Enable Redis for rate limiting across pods
• Set up PostgreSQL with replication for high availability
• Configure HTTPS via ingress controller
• Set EPISTOM_ENV=production