# Operator (https://docs.vitrinka.ai/operator)



## The shape of the job [#shape]

vitrinka self-hosted is one static Go binary in one container on one host, with SQLite and blobs in a single `/data` volume — deliberately the only supported topology. Configuration is environment variables, upgrades are a tag change, and the whole estate — including an air-gapped one — is served by the same bundle.

## In this tab [#pages]

| Page                                             | What it covers                                                                                                                          |
| ------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------- |
| [Installing on your own host](/operator/install) | The self-hosted bundle on a single host with Docker Compose — and why that is the only supported topology.                              |
| [Configuration](/operator/configuration)         | Everything is environment variables: where data lives, sign-up and plan metering, observability, which integrations are active.         |
| [Single sign-on](/operator/sso)                  | OIDC against your own directory — on your internal network too — configured in-product, with MFA vitrinka verifies rather than assumes. |
| [Operations](/operator/operations)               | Upgrades, backups, air-gapped installs, the operator verbs and the admin console — the things you do after it is running.               |
| [Connectors](/operator/connectors)               | The GitHub App, the Jira mirror, Plane, the AI backend, meeting transcription, and how hosted agents connect through OAuth.             |
| [Mail and notifications](/operator/mail)         | One mailer per install, changed in Settings or from the CLI by whoever holds deployment authority, and the keys web push needs.         |
| [Licensing](/security/licensing)                 | Obtaining, installing and renewing the enterprise licence, and what an expired one gates.                                               |

## Read this before anything else [#first]

* **Make yourself platform admin, then close sign-up** — any account that signs up can own an organization, so being first grants nothing: grant `/admin` from the server binary and gate new accounts, as [the first admin](/operator/install#admin) shows.
* **Back up `/data` before every upgrade** — and through compose, not with a bare `docker run`. The exact commands are in [Operations](/operator/operations#backup).
* **Your licence is not in `/data`** — it lives in the bundle's `./license/` directory; back up both. See [Licensing](/security/licensing).
* **Offline deployment** — `AIR_GAP=1` disables configured outbound integrations. The bundle includes the server image and CLI binaries; use network controls for complete isolation and check [air-gap mode](/security/airgap) for exceptions.