Deploy in your VPC

1 · Prerequisites

• An AWS account with permission to create EC2, RDS, and IAM roles.
• A VPC with subnets for the control plane, data plane, and database.
• terraform ≥ 1.5 and AWS credentials.
• An SSH key pair for the two hosts.
• A DNS name for the dashboard (e.g. kavros.acme.com).

2 · Provision with Terraform

The Kavros Terraform module provisions RDS, the control plane host, the Nitro data plane host, security groups, and IAM. Fill in the required inputs and apply.

module "kavros" {
  source = "./terraform/kavros"

  region                  = "us-east-1"
  vpc_id                  = "vpc-xxxx"
  control_plane_subnet_id = "subnet-cp"
  data_plane_subnet_id    = "subnet-dp"
  db_subnet_ids           = ["subnet-a", "subnet-b"]
  key_name                = "my-keypair"

  db_username               = "kavros"
  db_password               = var.db_password
  dashboard_domain          = "kavros.acme.com"
  nexauth_secret            = var.nexauth_secret
  control_plane_service_token = var.service_token
  policy_signing_private_key  = var.signing_private_key
  policy_public_key         = var.signing_public_key
}

Outputs include the dashboard URL, the data plane endpoint, and the database endpoint.

3 · Policy signing key (decide up front)

Runtime policy changes are only enforced when signed by an Ed25519 keypair. Choose one custody model before onboarding:

4 · Operations