Hiveram

Deploy

Kubernetes, container, workstation, airgapped — on infrastructure you control.

Hiveram runs on your own infrastructure against PostgreSQL you manage. The chart and the image are public: no registry credentials, no account. Pick the path that matches where the ledger has to live.

The commands below are the short form. The distribution README is authoritative — it moves with each release, this page does not.

Kubernetes with Helm

The OCI registry is the primary Kubernetes install. No download step:

helm install workledger oci://ghcr.io/obstalabs/charts/workledger \
  --namespace hiveram \
  --set-string secrets.existingSecret=workledger-runtime

The chart deploys the image against PostgreSQL you manage. It creates no Secret, Namespace, or cluster-scoped resource, and expects an existing Secret holding the connection string, licence, and API keys. It ships a values schema with per-value documentation, an optional migration preflight hook, and fixed restricted Pod Security defaults.

Start with the self-hosted deployment guide.

Hardened container image

A multi-architecture image for linux/amd64 and linux/arm64, designed for non-root, read-only operation under enforced Kubernetes restricted Pod Security. Only the documented state and temporary paths stay writable. Select its current immutable tag or digest from the release page rather than tracking a moving tag.

Runtime guarantees are enumerated in the container image facts; tags and digests are on Releases.

Workstation

For an operator machine rather than a cluster. The install script places the workledger binary on PATH, installs the public-safe skills, wires the MCP server for Claude Code, and prompts for connection details and custody mode.

curl -fsSL https://raw.githubusercontent.com/obstalabs/hiveram-dist/main/install.sh | bash

Package managers work too:

# Homebrew
brew install obstalabs/tap/workledger

# Scoop
scoop bucket add obstalabs https://github.com/obstalabs/scoop-bucket
scoop install workledger

If you prefer not to pipe to bash, the README carries a step-by-step manual install with checksum verification.

Airgapped and mirrored

Where the cluster has no route to a registry, install the chart from a downloaded release asset instead of the OCI path. Each release is verified by installing the published image onto a disconnected Kubernetes node that has no route to any registry, and requiring it to start — so the airgapped path is proven against the exact image being released rather than a rebuild of it.

Disconnected operators can also keep reading the shared backlog and queue delayed writes through the mirror and outbox flow, then apply them intentionally when a connection returns.

Asset resolution and the mirror/outbox transfer are documented in the distribution README.

What you bring