Install

Try it (Docker, two minutes): docker compose -f deploy/compose/docker-compose.yml up -d --build, open http://localhost:8080, sign in as [email protected] / bezisync-demo. The Sandbox project is wired to a sample shop database with live orders, Kafka and a local Docker runtime.

Kubernetes (production): the charts are published as OCI artifacts:

helm install bezisync oci://ghcr.io/daun-gatal/charts/bezisync --version <version> \
  -n bezisync --create-namespace -f my-values.yaml

Use an external, highly available PostgreSQL (secrets.databaseUrl, or existingSecret), a master key (bezisync generate-master-key), an https publicUrl and cookieSecure: true. The controller can run connectors in the namespaces listed in kubernetesRuntime.namespaces (direct mode). Production refuses to start with development keys, insecure cookies or a non-https public URL — unless allowPlainHttp: true says the network itself encrypts traffic (e.g. a Service exposed only on a Tailscale tailnet). Useful values: imagePullSecrets, service.annotations / service.loadBalancerClass (e.g. the Tailscale operator), postgres.storageClass, ingress.*. appArmorProfile (e.g. { type: Localhost, localhostProfile: bezisync-default }) gives every pod of the chart an AppArmor profile loaded on each node; deploy/apparmor/ (kubectl apply -k deploy/apparmor) loads one at every boot for kernels whose default containerd profile blocks signals inside containers. The charts install the latest release images by default (image.tag / webImage.tag, pulled with pullPolicy: Always); pin image.tag and webImage.tag to a release (e.g. 0.1.0) for reproducible upgrades. The images (X.Y.Z, for linux/amd64 and linux/arm64) and the CLI share the release version; each chart has its own version (helm show chart oci://ghcr.io/daun-gatal/charts/bezisync shows it) and installs the release it was published with. Every release lists its chart versions; verify what you pull with gh attestation verify oci://ghcr.io/daun-gatal/bezisync:X.Y.Z --owner daun-gatal.

Private registry. To install from a mirror or a private registry, push the images there and create an image pull secret for the cluster: kubectl create secret docker-registry ghcr-pull-secret --docker-server=<registry> --docker-username=<user> --docker-password=<token>, listed in imagePullSecrets of both charts (and in a runtime's image pull secrets when connectors use a private image), and point image.repository and webImage.repository at it.

PostgreSQL holds BeziSync's metadata and each connector's offsets and schema history (debezium_state schema, or BEZISYNC_STATE_DATABASE_URL). It is on the data path: run it HA and back it up.