# Hub deployment

Install, configure, secure, and operate a self-hosted Faros hub.

Source: https://faros.sh/docs/self-hosting/hub/


Run the Faros hub on your own infrastructure. Choose an installation path, configure access, and establish storage and recovery procedures before onboarding workspaces.

Start with [Hub installation](helm/), then review [authentication](authentication/) and [operations](operations/) for a production deployment.


## In this section

- [Install the hub](https://faros.sh/docs/self-hosting/hub/helm/): Choose embedded or external kcp and verify the console.
- [Static Tokens](https://faros.sh/docs/self-hosting/hub/static-token/): Pre-shared bearer tokens — the simplest way to secure a personal hub.
- [Ingress](https://faros.sh/docs/self-hosting/hub/ingress/): Make your hub reachable from the internet — Cloudflare Tunnel, port forwarding, mesh VPN, or cloud LB.
- [OIDC (Dex)](https://faros.sh/docs/self-hosting/hub/oidc/): Sign in to the hub with GitHub, Google, LDAP, or any OIDC provider via Dex.
- [Cloudflare Tunnel](https://faros.sh/docs/self-hosting/hub/cloudflare-tunnel/): Expose a hub through an outbound tunnel with DNS and TLS configuration.
- [Monitor, recover, and upgrade](https://faros.sh/docs/self-hosting/hub/operations/): Plan around the state each component owns.
- [Authentication](https://faros.sh/docs/self-hosting/hub/authentication/): Authentication, organizations and workspaces, service accounts, platform admins.