Self-host the Gateway
Run the Gateway in your own network as one container image in Gateway-only mode, with your PostgreSQL and models. Set up with Crescendo Lab per engagement.
What you run#
The self-hosted Gateway is the same image as the hosted one, started in Gateway-only mode. It serves only the /v1 endpoints in the API reference, with the same keys, auto, limits, ledger and error codes. It has no sign-in, console or other Agent Lab product inside it.
| Part | Detail |
|---|---|
| Gateway container | Runs as a non-root user with a read-only file system. No outbound internet route, no Docker socket. |
| PostgreSQL | Yours. Holds keys, the ledger and usage records. Reachable only from the Gateway's storage network. |
| Models | Your own OpenAI-compatible model servers (vLLM, Ollama and similar) on the internal inference network. The profile has no route to the internet, so cloud models need a setup agreed with us. |
| Ingress | A separate proxy publishes the Gateway on a local port. A public name and TLS are added by your own reverse proxy. |
| Configuration | A deployment file naming the models and their endpoints, and secrets kept outside the image. |
Readiness#
GET /v1/gateway/readiness answers 200 once the server has a database and a published configuration, and 503 while it is starting, reloading or draining. It does not check that a model answers. When a new configuration is invalid, the server keeps serving the last valid one and reports configuration: rejected_replacement.
Getting set up#
Self-hosting is set up together with Crescendo Lab: we provide the verified image by digest, the deployment profile and the provisioning of your workspace, keys and model catalog, and agree on upgrades and backups with you. Write to info@cresclab.com.
What is stored, and the one recorder you must leave off, is in data handling.