Deploy the platform
The Tenzir Platform is the control plane that manages Tenzir Nodes. The platform also provides a web interface to explore data, create pipelines, and build dashboards.
Tenzir offers a free and cloud-hosted version of the Tenzir Platform at app.tenzir.com. This guide explains how to run the platform on your own premises using the Sovereign Edition.
Download the Platform
Start with downloading the latest Tenzir Platform release and unpack the archive.
Set Up Docker Registry Access
As part of your distribution, you were provided an authentication token
(YOUR_DOCKER_TOKEN
below) to fetch the Docker images. Log in with the token
as follows:
Configure the Platform
You need to configure a few external services to run the platform, such as a HTTP reverse proxy, an identity provider, and a state database.
Scroll down to the configuration options and populate
a .env
file with your individual settings.
Run the Platform
After you configured all services, choose a pre-canned deployment template from
the examples
directory:
Change into one of these directories and start the platform in the foreground with
or docker compose up --detach
to run it in the background.
It may take up to a minute for all services to be fully available.
Manage the Platform
We provide a command-line utility that simplifies managing users, organizations, workspaces, and nodes.
Install the tenzir-platform
package from PyPI.
You must provide the following environment variables for interacting with the platform through the CLI:
Read our documentation on the Tenzir Platform CLI to learn more about managing your platform deployment.
Update the Platform
To update to the latest platform version, pull the latest images:
Configuration Options
The platform requires some external services that must be installed and configured separately by setting several environment variables described below.
HTTP Reverse Proxy
The platform uses four URLs that require a HTTP reverse proxy. These URLs may be mapped to the same or different hostnames.
- The URL that the user's browser connects to, e.g.,
app.platform.example.org
. This serves a web frontend where the user can interact with the platform. - The URL that the nodes connect to, e.g.,
nodes.platform.example.org
. Tenzir Nodes connect to this URL to establish long-running WebSocket connections. - The URL that the platform's S3-compatible blob storage is accessible at,
e.g.,
downloads.platform.example.org
. When using the Download button the platform generates download links under this URL. - The URL that the Tenzir Platform CLI connects to, e.g.,
api.platform.example.org
.
You must provide the following environment variables to the platform:
Identity Provider (IdP)
The platform requires an external Identity Provider (IdP) supporting the OIDC protocol. The IdP must provide valid RS256 ID tokens. The platform must be able to access the IdP's issuer URL.
You must provide the following environment variables for the OIDC provider configuration used for logging into the platform:
You must provide the following environment variable containing a JSON object containing the OIDC issuer and audiences that should be accepted by the platform.
You must provide the following environment variable containing a JSON list of
rules granting access to the admin API. The example rule grants admin access to
all users with a valid and signed id_token
containing the fields
{"connection": "google-oauth2", "tenzir/org": "TenzirPlatformAdmins"}
.
PostgreSQL Database
A PostgreSQL database stores the internal state of the platform.
You must provide the following environment variables: