3 min read
Self-Hosted & Isolated VPC Deployments
Deploy dedicated single-tenant GitCaptain worker instances inside your private AWS, GCP, or Azure VPC for strict governance.
Deploy dedicated single-tenant GitCaptain worker instances inside your private AWS, GCP, or Azure VPC for strict governance.
VPC Architecture Overview
For financial institutions, healthcare organizations, and government contractors with strict compliance mandates, GitCaptain provides Single-Tenant Private VPC Deployments:
Isolated Compute: AST workers run inside your dedicated AWS VPC or Google Cloud Project.
No Outbound Code Routing: Source code never leaves your VPC network perimeter.
Outbound-Only Webhooks: Workers connect securely to your GitHub Enterprise Server via mutual TLS (mTLS).
text
┌──────────────────────────────────────────────────────────┐
│ Your Organization's Private VPC │
│ │
│ [GitHub Enterprise] ──(mTLS)──▶ [GitCaptain AST Runner] │
│ │ │
│ ▼ │
│ [Internal Azure OpenAI Endpoint] │
└──────────────────────────────────────────────────────────┘Private LLM Gateways (Azure / Bedrock)
Connect your AST runner directly to your internal enterprise LLM instances:
Azure OpenAI Service: Secure connection over Private Endpoint (no public internet traverse).
AWS Bedrock: IAM-role authenticated private VPC endpoints.
Self-Hosted vLLM / Ollama: Run open-weights models (DeepSeek, Llama 3.3) on your own GPU clusters.
Deployment via Docker & Helm
Deploy in minutes using our official Kubernetes Helm chart:
bash
helm repo add gitcaptain https://charts.gitcaptain.com
helm install gitcaptain-runner gitcaptain/runner \
--set licenseKey="${GITCAPTAIN_ENTERPRISE_KEY}" \
--set github.enterpriseUrl="https://github.internal.mycompany.com" \
--set llm.endpoint="https://azure-openai.privatelink.openai.azure.com"Enterprise SSO & Audit Logging
SAML 2.0 & OIDC: Native integration with Okta, Microsoft Entra ID (Azure AD), and Google Workspace.
Immutable Audit Logs: Comprehensive telemetry capturing user logins, rule updates, and webhook review executions exported to Datadog, Splunk, or AWS CloudWatch.