Self-hosted

Self-host Lettuce. Keep the source inside.

Codebase intelligence behind your perimeter. Docker or Helm. Your auth, your secrets, your IdP.

What you get.

Every bullet ships today.

Docker + Helm install

One-command Compose for a single-node POC. Helm chart for the real cluster.

Customer-issued license key + admin UI

Signed offline license. Expiry, seats, and feature flags live at /admin.

OIDC auth, BYO secret store

Plug your IdP. Pull secrets from Vault, AWS Secrets Manager, or GCP Secret Manager.

GitHub Enterprise, GitLab self-hosted, Bitbucket Cloud

Configurable base URLs, your CA bundle, your service accounts.

OpenTelemetry traces + logs

Ship to your existing OTLP collector. No metrics leave your network.

Cosign-signed images + SBOM

Every image signed with cosign keyless. SPDX-JSON SBOM attested to the image, plus a grype vulnerability scan per release.

That's the install.

1
Get a license key from sales.
We issue an offline-signed Ed25519 JWT tied to your org — book a call or email us. License checks happen offline; a daily heartbeat and telemetry ping run by default and can each be disabled with one env var.

lettuce-init compose \
  --license-key-file ./license.key \
  --domain https://lettuce.acme.com

The honest list. If any of these are blockers — tell us.

No air-gap support. Planned year-2 if a customer asks.
Bitbucket Data Center support is config-only today — a real DC API client is in progress as LET-41.
Pricing and SLA are case-by-case until product decisions land.

Pricing — talk to us.

Sized to your repos, users, and SLA. No public list price until we're ready to stand behind one.