Platform
ConceptControl plane and execution planeThe API, AAA, dispatcher, git-bot, UI, PostgreSQL, Gotenberg, and socket proxy form the control plane; runners and per-run agents form the execution plane.ConceptSupported deployment modelsFour shapes the platform is built for, and what each one implies for runtime and database.ReferenceFirst-install setupThe one-time bootstrap that unlocks the platform, and how to diagnose it when it will not complete.ReferenceEnvironment and service configurationEvery environment variable the platform reads, starting with the secrets and service URLs that must exist before GitOps can take over.How-toDocker Compose deploymentThe local and small single-host topology, its services, and its exposure defaults.How-toKubernetes and Helm deploymentCluster deployment, generated install artifacts, and the service accounts that separate platform from workload.ReferenceRunners and the dispatcherHow runners register, how work is routed to them, and what happens when one disconnects or is ejected.ReferencePrivate registry authenticationTwo separate mechanisms: infrastructure-owned pull secrets and NopsAI-owned runner credential assignments.ConceptNetworking and exposureWhat has to be reachable from where, and what should never be exposed.ConceptStorage and persistenceWhat is durable, what is per-run, and what the default topology does not persist.ReferenceGitOps and configuration repositoriesWhich resources Git can own, how sync applies them, and what happens when the UI edits a managed resource.ConceptTeams and resource ownershipTeam paths are the ownership boundary for access, notifications, and GitOps authority.ConceptAccess control and AAAHow authorization decisions are made, where grants come from, and what is audited.ReferenceAuthentication and SSOLocal login, OIDC and OAuth2 providers, and what actually constitutes identity.ReferenceTokens and service accountsPersonal access tokens, service accounts, and the internal service tokens components use.ConceptCredentials and secrets storeOne encrypted registry behind every credential reference, with versions, rotation, and GitOps envelopes.How-toBackups and data cleanupCreating backups, scheduling cleanup, and the restore boundary you need to plan around.ReferenceAgent rolesNamed personas and prompt instructions selected by pipelines and steps.ReferenceModelsProvider, model, endpoint, credential, and generation settings — the layer that decides which model actually runs.ReferenceMCP servers and profilesExternal tool access for LLM goals, constrained by an explicit server and tool allowlist.ReferenceKnowledge ContextDocuments injected into prompts, and the two kinds that can block execution outright.ReferenceGovernance levelsHow NopsAI acts on an AI policy review decision, and why the default is the strict one.