Features
Production deployment
Choose a profile based on state ownership and availability requirements. Use matching immutable images and charts, provision persistent storage and Secrets, and keep customer-facing TLS at your ingress/load balancer.
| Profile | State | Deployment boundary |
|---|---|---|
single | Embedded Turso control state, DuckDB history, telemetry/audit outboxes | One active process, one complete persistent state volume |
ha active-active | External PostgreSQL/ClickHouse, replicated cache/control coordination, private per-replica stores | 3–7 production replicas with provisioned identities/networking |
ha active-passive | External stores and explicit role/promotion policy | Follow the separate role configuration and failover contract |
The standard chart installs Eden; customer-managed external databases, ingress and monitoring are provisioned separately. Redis/Valkey is an application data endpoint, not an internal dependency. The standard single profile does not require external databases unless you enable DBOS durable workflows.
The current HA chart's shared node-bound license key conflicts with its per-pod UUID identities. A qualified HA licensing integration is required before a normal licensed production installation can proceed; see the HA installation gate. The profile table describes topology, not proof that the current public license/image path can start that topology.
Start with Install Eden Service and the release's helm/charts/eden/examples/production-single-values.yaml or production-ha-values.yaml. Replace placeholder endpoints, image digests, storage classes, network UUIDs and Secret names. Render before installation.
Persistence, readiness and shutdown
Each process exclusively owns its state/outbox volume. Keep it encrypted and persistent. Never share an embedded database or outbox between active processes. Durable admission failure can make /ready fail without making /health fail. Monitor cache-sync, consensus-control and NAT relay separately when enabled.
Provision enough space for control state, telemetry retention, outboxes, DuckDB temporary files and database overhead. Size termination grace for the configured listener shutdown and exporter drains, and verify the total bound for the selected image. A single exporter timeout is not the whole shutdown budget. Rotate externally managed Secrets through a controlled rollout.
Use backup and recovery, upgrade and rollback, configuration, monitoring, and recovery runbooks before production admission.
For HA installation, configuration, identities, licensing and verification, follow Deploy Eden with high availability. Use Local high availability for the architecture and active-passive behavior. For migration participant sets and all-participant barriers, use HA Redis migrations. The chart's accepted shape is a configuration constraint, not a throughput or failover qualification result.