Self-Hosting

Docker Compose

The fastest way to self-host EvalGuard. Includes the web app, worker, Supabase (PostgreSQL + Auth), and Redis.

1. Clone the repository

Requires the read grant above; the clone fails with Repository not found without it.

git clone https://github.com/EvalGuardAi/evalguard.git
cd evalguard

2. Configure environment variables

cp .env.example .env
# Edit .env with your values

3. Start services

# Development mode (with hot reload)
docker compose -f docker-compose.yml -f docker-compose.dev.yml up

# Production mode
docker compose -f docker-compose.prod.yml up -d

4. Access the dashboard

Open http://localhost:3000 in your browser. Create an account and start evaluating.

Kubernetes + Helm

For production deployments at scale, use the Helm chart included in the repository.

1. Add the chart

cd helm/evalguard

2. Configure values

web:
  replicaCount: 2
  resources:
    requests:
      cpu: 500m
      memory: 512Mi
    limits:
      cpu: 2000m
      memory: 2Gi

image:
  repository: evalguard/evalguard
  tag: latest
  pullPolicy: IfNotPresent

env:
  NEXT_PUBLIC_SUPABASE_URL: "https://auth.yourdomain.com"  # or https://your-ref.supabase.co
  NEXT_PUBLIC_SUPABASE_ANON_KEY: "your-anon-key"
  SUPABASE_SERVICE_ROLE_KEY: "your-service-role-key"
  DATABASE_URL: "postgresql://..."
  REDIS_URL: "redis://redis:6379"
  NEXT_PUBLIC_APP_URL: "https://evalguard.yourcompany.com"

ingress:
  enabled: true
  className: nginx
  hosts:
    - host: evalguard.yourcompany.com
      paths:
        - path: /
          pathType: Prefix

worker:
  replicaCount: 2
  resources:
    requests:
      cpu: 1000m
      memory: 1Gi

3. Deploy

helm install evalguard ./helm/evalguard \
  --namespace evalguard \
  --create-namespace \
  -f values.yaml

4. Upgrade

helm upgrade evalguard ./helm/evalguard \
  --namespace evalguard \
  -f values.yaml

5. Backups and restore

The chart backs up the one stateful workload it deploys — the bundled Redis (queue and job state). Snapshots are verified with redis-check-rdb before they are kept, written to a PVC and/or S3-compatible object storage, and pruned by age. Enabling backups with no durable destination is refused at render time rather than silently discarding every snapshot.

backup:
  enabled: true
  schedule: "17 3 * * *"     # daily 03:17 UTC
  retentionDays: 14
  persistence:
    enabled: true
    size: 10Gi
  s3:                         # survives losing the cluster
    enabled: true
    bucket: evalguard-backups
    region: eu-central-1
    endpoint: ""              # set for Hetzner / R2 / MinIO
    existingSecret: evalguard-backup-s3

Restores run as a Job whose default mode is a non-destructive drill: it fetches the snapshot, verifies it, loads it into a throwaway Redis inside the Job pod and reports the key count without ever contacting the live instance. Run it on a schedule — a backup nobody has restored is not a backup. Add --set backup.restore.mode=restore to move the keys into the live instance (batched, no downtime, no extra RBAC).

helm upgrade evalguard ./helm/evalguard -f values.yaml \
  --set backup.restore.enabled=true \
  --set backup.restore.source=redis-20260805T031700Z.rdb

kubectl logs -l app.kubernetes.io/component=restore --tail=50

Your database is not in scope. This chart deploys no Postgres — EvalGuard reaches Supabase (or your own managed Postgres) over HTTPS, so its backups and PITR belong to whoever operates it. Configure them there; “the Helm chart has backups” does not mean your data is covered.

Supabase Setup

EvalGuard uses Supabase for authentication and database storage. You can use Supabase Cloud or self-host Supabase.

Supabase Cloud

1. Create a project at supabase.com
2. Copy the project URL and anon key from Settings > API
3. Copy the service role key from Settings > API
4. Run the migrations: npx supabase db push

Self-Hosted Supabase

# The Supabase directory includes all migrations
cd supabase
npx supabase start

# This outputs your local Supabase URL and keys
# Use these in your .env file

Redis Setup

Redis is used for job queues (eval/scan workers), caching, and real-time monitoring streams.

# Local Redis
docker run -d --name redis -p 6379:6379 redis:7-alpine

# Or use a managed service (Upstash, Redis Cloud, ElastiCache)
# Set REDIS_URL=redis://your-host:6379

Environment Variables Reference

Architecture

EvalGuard consists of three main services:

• Web App -- Next.js application serving the dashboard, marketing pages, and API routes
• Worker -- Background job processor that runs evaluations, security scans, and benchmarks
• Database -- Supabase (PostgreSQL + Auth + Storage) for persistent storage

Redis connects the web app and worker for job queuing and real-time updates. The worker scales horizontally -- add more replicas to increase throughput.