Vintner

Self-Hosted Mode

Running Tendril on your own infrastructure for on-premises or air-gapped environments.

Self-Hosted Mode

While the default deployment is cloud-hosted (ECS Fargate), Tendril can also run on any machine with the required dependencies. This is useful for on-premises environments, air-gapped networks, or development/testing.

Prerequisites

The self-hosted Tendril binary requires these tools installed on the host:

ToolPurposeMinimum Version
TerraformInfrastructure provisioning1.7+
kubectlKubernetes cluster access1.28+
HelmChart installation (ArgoCD, components)3.12+
AWS CLIAWS credential handling (if targeting AWS)2.x
gcloudGCP credential handling (if targeting GCP)Latest
Azure CLIAzure credential handling (if targeting Azure)Latest

The cloud-hosted Docker image bundles all of these. In self-hosted mode, you must install them yourself.

Registration

Before running, the Tendril must be registered with Trellis:

  1. Register via the Trellis API or CLI (grape worker register)
  2. Receive a WORKER_ID and WORKER_TOKEN
  3. Pass these as environment variables

Running

Set the required environment variables and start the binary:

export TRELLIS_URL=https://trellis.example.com
export GRAPE_WORKER_ID=<worker-id>
export GRAPE_WORKER_TOKEN=<worker-token>
export GRAPE_WORKER_MODE=self-hosted
export SUPABASE_S3_ENDPOINT=<s3-endpoint>
export SUPABASE_S3_REGION=<s3-region>
export SUPABASE_STORAGE_KEY_ID=<s3-key>
export SUPABASE_STORAGE_SECRET_KEY=<s3-secret>

# Optional
export INFRACOST_API_KEY=<key>

./tendril

The Tendril will:

  1. Start the heartbeat goroutine
  2. Begin polling for jobs
  3. Execute jobs using locally installed tools

Environment Variables

VariableRequiredDescription
TRELLIS_URLYesTrellis API base URL
GRAPE_WORKER_IDYesAssigned worker ID
GRAPE_WORKER_TOKENYesAuthentication token
GRAPE_WORKER_MODEYesMust be self-hosted
SUPABASE_S3_ENDPOINTYesTerraform state S3 endpoint
SUPABASE_S3_REGIONYesS3 region
SUPABASE_STORAGE_KEY_IDYesS3 access key
SUPABASE_STORAGE_SECRET_KEYYesS3 secret key
INFRACOST_API_KEYNoEnables cost estimation

Use Cases

On-Premises Infrastructure

For organizations that need infrastructure provisioned from within their network (e.g., private cloud, bare metal):

  • Run Tendril on a bastion host or CI/CD runner
  • Tendril polls Trellis over HTTPS (outbound only — no inbound ports required)
  • Terraform provisions resources accessible from the internal network

Air-Gapped Environments

For high-security environments without internet access:

  • Pre-download Terraform providers and modules
  • Configure Terraform to use a local mirror
  • Tendril communicates with Trellis via an approved network path

Development and Testing

For local development:

  • Run Tendril alongside the Trellis dev server
  • Point TRELLIS_URL to http://localhost:3000
  • Test job execution without deploying to Fargate

Differences from Cloud-Hosted

AspectCloud-HostedSelf-Hosted
DeploymentAutomatic (ECS Fargate)Manual (user manages)
Scale-to-zeroLambda scalerNot applicable
Tool managementBundled in Docker imageUser installs
UpdatesAutomatic (ECS force-redeploy)Manual binary update
MonitoringCloudWatch logsLocal stdout/stderr
NetworkRuns in platform VPCRuns in user's network

On this page