Make self-hosted Pulumi Cloud a first-class story

content/case-studies/spear-ai.md

@@ -6,7 +6,7 @@ description: |
 meta_desc: Learn how Spear AI used Pulumi to achieve government Authorization to Operate in 3 months.
 
 customer_name: Spear AI
-industry: ai-ml
+industry: public-sector
 customer_logo: /logos/customers/spearAI.svg
 logo_bg_color: "#000031"
 logo_style: white

content/docs/_index.md

@@ -69,6 +69,10 @@ sections:
     heading: Administration
     description: Manage organizations, access, security, and self-hosting.
     link: /docs/administration/
+  - icon: hard-drives
+    heading: Self-Hosting
+    description: Run the full Pulumi Cloud platform in your own cloud account or data center.
+    link: /docs/administration/self-hosting/
   - icon: package
     heading: Registry ↗
     description: Browse and search Pulumi packages for 150+ cloud providers and services.

content/docs/administration/_index.md

@@ -46,10 +46,13 @@ sections:
     link: /docs/administration/security-compliance/
     description: Set up audit logs and customer managed encryption keys.
 
+- type: full-width-cards
+  heading: Self-hosting
+  cards:
   - icon: buildings
-    heading: Self-Hosting
+    heading: Run Pulumi Cloud in your own infrastructure
     link: /docs/administration/self-hosting/
-    description: Deploy Pulumi Cloud in your own infrastructure with the Business Critical edition.
+    description: Install and operate the full platform on AWS, Azure, Google Cloud, Kubernetes, or your own hardware, including fully air-gapped networks. Available with the Business Critical edition.
 
 - type: flat
   heading: Have questions?

content/docs/administration/self-hosting/_index.md

@@ -12,7 +12,7 @@ menu:
   administration:
     name: Self-Hosting
     parent: administration-home
-    weight: 40
+    weight: 25
     identifier: administration-self-hosting
 aliases:
   - /docs/guides/self-hosted/
@@ -32,6 +32,14 @@ sections:
 
     Pulumi can be deployed in any on-premise or cloud environment and integrated with your preferred identity provider: GitHub Enterprise, GitLab Enterprise, SAML SSO, or email/password authentication.
 
+- type: button-cards
+  heading: Get started
+  cards:
+  - icon: rocket-launch
+    heading: Install Self-Hosted Pulumi Cloud
+    link: /docs/administration/self-hosting/install/
+    description: Pick your platform and install. Evaluate with Docker Compose in minutes, or deploy to production on AWS, Azure, Google Cloud, or Kubernetes.
+
 - type: button-cards
   heading: Deployment options
   cards:

content/docs/administration/self-hosting/airgapped.md

@@ -8,7 +8,7 @@ menu:
         name: Air-Gapped
         parent: administration-self-hosting
         weight: 5
-        identifier: administration-security-compliance-self-hosted-airgapped
+        identifier: administration-self-hosting-airgapped
 aliases:
 - /docs/administration/self-hosting/airgapped/
 - /docs/pulumi-cloud/admin/self-hosted/airgapped/
@@ -19,7 +19,7 @@ pulumi_cloud_feature: self-hosting
 
 For organizations operating in highly regulated industries or environments with strict security requirements, deploying cloud infrastructure in an air-gapped environment is often a requirement. Such environments do not have network connectivity with the outside world, which many of Pulumi's default workflows assume.
 
-Pulumi can be configured to run in air-gapped environments through [self-hosting](/docs/administration/self-hosting/pulumi-cloud), enabling enterprises to manage infrastructure as code securely within their private networks, remaining compliant while gaining the benefits of modern infrastructure automation.
+Pulumi can be configured to run in air-gapped environments through [self-hosting](/docs/administration/self-hosting/), enabling enterprises to manage infrastructure as code securely within their private networks, remaining compliant while gaining the benefits of modern infrastructure automation.
 
 In this guide, we will explore how to deploy Pulumi Self-Hosted in an air-gapped environment, covering the key requirements, setup process, and best practices.
 
@@ -93,8 +93,8 @@ Pulumi Self-Hosted can be installed using Kubernetes, Docker, or virtual machine
 2. Download the [Pulumi Self-Hosted images](/docs/administration/self-hosting/components)
     * Retrieve the necessary installation files and images from a networked machine.
     * Transfer them to your air-gapped environment using an offline medium (USB drive, offline repository, etc.).
-3. Install Pulumi Self-Hosted (for instance, on Kubernetes) per [these instructions](/docs/administration/self-hosting/deployment-options)
-    * Deploy the Pulumi API server, database, and storage backend using Helm or static manifests.
+3. Install Pulumi Self-Hosted (for instance, on Kubernetes) per the [install guide](/docs/administration/self-hosting/install/)
+    * Deploy the Pulumi API server, database, and storage backend with the [bring-your-own-infrastructure installer](/docs/administration/self-hosting/deployment-options/byo-infra-hosted/), which applies Kubernetes manifests to a cluster you already operate.
     * Configure internal object storage (e.g., MinIO or an internal S3-compatible service) for state management.
 4. Configure Authentication and Access Control
     * Integrate with your organization's internal identity provider (OIDC, LDAP, SAML).

content/docs/administration/self-hosting/changelog.md

@@ -8,7 +8,7 @@ menu:
         name: Changelog
         parent: administration-self-hosting
         weight: 7
-        identifier: administration-security-compliance-self-hosted-changelog
+        identifier: administration-self-hosting-changelog
 aliases:
   - /docs/pulumi-cloud/self-hosted/changelog/
   - /docs/administration/self-hosting/pulumi-cloud/changelog/

content/docs/administration/self-hosting/components/_index.md

@@ -7,7 +7,7 @@ menu:
   administration:
     parent: administration-self-hosting
     weight: 2
-    identifier: administration-security-compliance-self-hosted-components
+    identifier: administration-self-hosting-components
 aliases:
 - /docs/guides/self-hosted/console/
 - /docs/guides/self-hosted/components/

content/docs/administration/self-hosting/components/api.md

@@ -6,9 +6,9 @@ h1: Pulumi Cloud self-hosted API
 menu:
   administration:
         name: Pulumi API
-        parent: administration-security-compliance-self-hosted-components
+        parent: administration-self-hosting-components
         weight: 1
-        identifier: administration-security-compliance-self-hosted-components-api
+        identifier: administration-self-hosting-components-api
 aliases:
   - /docs/guides/self-hosted/components/api/
   - /docs/pulumi-cloud/self-hosted/components/api/
@@ -26,9 +26,9 @@ The Pulumi API is one of the components required for self-hosting the Pulumi Clo
 
 * Provide a server or virtual machine to install and run the Pulumi components (see Minimum System Requirements below).
 * Provide a persistent volume for the service to store checkpoint objects.
-* Provider a persistent volume for the MySQL data (optional if you are providing your own DB.)
+* Provide a persistent volume for the MySQL data (optional if you are providing your own DB.)
 * If you are providing your own DB instance, ensure that it is accessible within the same Docker network that the service and the UI containers will be running in.
-    * The default DB endpoint is `pulumi-db:3306`. If you wish to change this, set `PULUMI_LOCAL_DATABASE_NAME` and `PULUMI_LOCAL_DATABASE_PORT` accordingly (see Script Variables.)
+    * The default DB endpoint is `pulumi-db:3306`. If you wish to change this, set `PULUMI_LOCAL_DATABASE_HOST` and `PULUMI_LOCAL_DATABASE_PORT` accordingly (see Script Variables.)
     * If you do not create this network prior to running `run-ee.sh`, it will create only a bridged network on your local host. Ensure that the DB can be accessed by the API service container.
 * Provide an external load balancer with TLS termination.
 
@@ -316,153 +316,19 @@ To use [AWS DynamoDB](https://aws.amazon.com/dynamodb) to persist Audit Logs, sp
   ],
 ```
 
-## OpenTelemetry
+## OpenTelemetry {#opentelemetry}
 
-The API service is configured to export OpenTelemetry metrics and traces to the vendor of your choice via the OpenTelemetry collector. You will need to manage your own OpenTelemetry collector.
-
-The following environment variables are needed to configure OpenTelemetry in the service:
+The API service exports OpenTelemetry metrics and traces to a collector you run, and exposes a `/metrics` endpoint for Prometheus. These are the variables the API container reads; for collector configuration, the metrics endpoint, and both Prometheus options, see [Telemetry](/docs/administration/self-hosting/operations/telemetry/).
 
 | Variable name | Description |
 | --- | --- |
 | OTEL_EXPORTER_OTLP_ENDPOINT | (Required) Used to configure the OTLP exporter. The base URL to which all telemetry will be sent. If not set, the API service will use no-op metrics and traces. |
 | OTEL_EXPORTER_OTLP_PROTOCOL | (Optional) Used to configure the OTLP exporter. Valid values are `http` or `grpc`. Defaults to `grpc`. |
 | PULUMI_ENABLE_DEPRECATED_METRICS | (Optional) Whether to continue emitting API service metrics in a log-based format. Defaults to `true`. |
-| METRICS_WEBHOOK_SECRET | Required to successfully authenticate to the `/metrics` endpoint. The Authorization header should be set as follows: `Authorization: webhook-token <METRICS_WEBHOOK_SECRET>`. |
+| METRICS_WEBHOOK_SECRET | Required to successfully authenticate to the `/metrics` endpoint. |
 
 OpenTelemetry is not yet available for the [console service](/docs/administration/self-hosting/components/console/).
 
-### Metrics endpoint
-
-The API service exposes a metrics endpoint (`https://api.pulumi.com/metrics`) that is secured by a bearer token. This token is configured using the environment variable `METRICS_WEBHOOK_SECRET`.
-
-{{% notes type="info" %}}
-The token type is `webhook-token`, not `Bearer`.
-{{% /notes %}}
-
-```sh
-curl -s GET https://api.pulumi.com/metrics -H 'Authorization: webhook-token <METRICS_WEBHOOK_SECRET>
-```
-
-### Prometheus
-
-The API service provides two options to get metrics into Prometheus:
-
-1. From the OpenTelemetry collector via a [Prometheus remote write exporter](#prometheus-remote-write-exporter). This is a push-based exporter.
-1. From a [Prometheus exporter](#prometheus-exporter) by scraping the `/metrics` endpoint. This is a pull-based exporter.
-
-#### Prometheus remote write exporter
-
-This option does not use the `/metrics` endpoint. Instead, it exports metrics from the collector to a [Prometheus remote write compatible backend](https://github.com/open-telemetry/opentelemetry-collector-contrib/blob/main/exporter/prometheusremotewriteexporter/README.md).
-
-Example OpenTelemetry collector configuration for a service using AWS and the AWS Distro for OpenTelemetry Collector:
-
-```yaml
-extensions:
-  sigv4auth:
-
-receivers:
-  otlp:
-    protocols:
-      grpc:
-        endpoint: localhost:4317
-
-processors:
-  memory_limiter:
-
-  batch:
-
-exporters:
-  logging:
-
-  prometheusremotewrite:
-    endpoint: https://aws-managed-prometheus-endpoint/v1/api/remote_write
-    auth:
-      authenticator: sigv4auth
-
-service:
-  telemetry:
-    logs:
-
-  pipelines:
-    traces:
-      receivers: [otlp]
-      processors: [memory_limiter, batch]
-      exporters: [logging]
-
-    metrics:
-      receivers: [otlp]
-      processors: [memory_limiter, batch]
-      exporters: [prometheusremotewrite]
-
-  extensions: [sigv4auth]
-```
-
-#### Prometheus exporter
-
-This option requires configuring the environment variable `METRICS_WEBHOOK_SECRET` to successfully authenticate to the [`/metrics` endpoint](#metrics-endpoint).
-
-Example OpenTelemetry collector configuration:
-
-```yaml
-extensions:
-  bearertokenauth:
-    scheme: webhook-token
-    token: ${env:METRICS_WEBHOOK_SECRET}
-
-receivers:
-  otlp:
-    protocols:
-      grpc:
-        endpoint: localhost:4317
-
-processors:
-  memory_limiter:
-
-  batch:
-
-exporters:
-  debug:
-
-  prometheus:
-    endpoint: api.pulumi.com:443
-    auth:
-      authenticator: bearertokenauth
-    namespace: pulumi
-    resource_to_telemetry_conversion:
-      enabled: true
-
-service:
-  telemetry:
-    logs:
-
-  pipelines:
-    traces:
-      receivers: [otlp]
-      processors: [memory_limiter, batch]
-      exporters: [debug]
-
-    metrics:
-      receivers: [otlp]
-      processors: [memory_limiter, batch]
-      exporters: [prometheus]
-
-  extensions: [bearertokenauth]
-```
-
-The bearer token also needs to be included in the Prometheus server configuration:
-
-```yaml
-scrape_configs:
-  - job_name: pulumi
-    scrape_interval: 15s
-    authorization:
-      type: webhook-token
-      credentials: <METRICS_WEBHOOK_SECRET>
-    scheme: https
-    static_configs:
-      - targets: ["api.pulumi.com"]
-```
-
 ## Pulumi Deployments
 
 In order to enable [Pulumi Deployments](/docs/pulumi-cloud/deployments), the following must be configured:

content/docs/administration/self-hosting/components/console.md

@@ -6,9 +6,9 @@ meta_desc: Pulumi console is one of the components required for self-hosting Pul
 menu:
   administration:
         name: Pulumi console
-        parent: administration-security-compliance-self-hosted-components
+        parent: administration-self-hosting-components
         weight: 2
-        identifier: administration-security-compliance-self-hosted-components-console
+        identifier: administration-self-hosting-components-console
 aliases:
   - /docs/guides/self-hosted/components/console/
   - /docs/pulumi-cloud/self-hosted/components/console/
@@ -43,7 +43,7 @@ You can run this container on the same host that your API container is running o
 ## What's In The Container?
 
 {{% notes type="info" %}}
-The container image repository is private. [Contact us](/contact/) if you would like to evaluate the Self-Hosted Pulumi Cloud.
+The console image is published publicly at [`pulumi/console`](https://hub.docker.com/r/pulumi/console). Running it still requires a license key — see [Components](/docs/administration/self-hosting/components/) for the full image list.
 {{% /notes %}}
 
 The Console container runs a web server using a Node 18-based image.

content/docs/administration/self-hosting/components/deployments.md

@@ -6,9 +6,9 @@ h1: Pulumi Cloud self-hosted Deployments
 menu:
   administration:
         name: Pulumi Deployments
-        parent: administration-security-compliance-self-hosted-components
+        parent: administration-self-hosting-components
         weight: 4
-        identifier: administration-security-compliance-self-hosted-components-deployments
+        identifier: administration-self-hosting-components-deployments
 aliases:
   - /docs/guides/self-hosted/components/deployments/
   - /docs/pulumi-cloud/self-hosted/components/deployments/

content/docs/administration/self-hosting/components/search.md

@@ -6,9 +6,9 @@ h1: Pulumi Cloud self-hosted OpenSearch cluster
 menu:
   administration:
         name: OpenSearch cluster
-        parent: administration-security-compliance-self-hosted-components
+        parent: administration-self-hosting-components
         weight: 3
-        identifier: administration-security-compliance-self-hosted-components-search
+        identifier: administration-self-hosting-components-search
 aliases:
   - /docs/guides/self-hosted/components/search/
   - /docs/pulumi-cloud/self-hosted/components/search/

content/docs/administration/self-hosting/deployment-options/_index.md

@@ -7,16 +7,19 @@ menu:
   administration:
     parent: administration-self-hosting
     weight: 1
-    identifier: administration-security-compliance-self-hosted-deployment-options
+    identifier: administration-self-hosting-deployment-options
 aliases:
   - /docs/pulumi-cloud/self-hosted/deployment-options/
   - /docs/administration/self-hosting/pulumi-cloud/deployment-options/
   - /docs/pulumi-cloud/admin/self-hosted/deployment-options/
 pulumi_cloud_feature: self-hosting
 ---
-Pulumi offers a number of deployment options for self-hosting the Pulumi Cloud.
 
-* [Docker Compose](quickstart-docker-compose/)
+{{< self-hosting-trial-note />}}
+
+Pulumi offers a number of deployment options for self-hosting the Pulumi Cloud. To get started, see [Install Self-Hosted Pulumi Cloud](/docs/administration/self-hosting/install/), which walks you through each platform. Use Docker Compose to evaluate on a single host in minutes; the other options are production deployments.
+
+* [Docker Compose](quickstart-docker-compose/) — evaluation and testing
 * [ECS](ecs-hosted/)
 * [EKS](eks-hosted/)
 * [AKS](aks-hosted/)

content/docs/administration/self-hosting/deployment-options/aks-hosted.md

@@ -6,16 +6,18 @@ h1: Pulumi Cloud self-hosted AKS install
 menu:
   administration:
         name: AKS
-        parent: administration-security-compliance-self-hosted-deployment-options
+        parent: administration-self-hosting-deployment-options
         weight: 4
-        identifier: administration-security-compliance-self-hosted-deployment-options-aks
+        identifier: administration-self-hosting-deployment-options-aks
 aliases:
   - /docs/guides/self-hosted/aks-hosted/
   - /docs/pulumi-cloud/self-hosted/deployment-options/aks-hosted/
   - /docs/pulumi-cloud/admin/self-hosted/deployment-options/aks-hosted/
 pulumi_cloud_feature: self-hosting
 ---
 
+{{< self-hosting-trial-note />}}
+
 The [AKS-Hosted Installer](https://github.com/pulumi/pulumi-self-hosted-installers/tree/master/aks-hosted) installer is used to deploy the self-hosted Pulumi Cloud in Azure Kubernetes Service (AKS)
 
 ## AKS-Hosted Deployment
@@ -40,10 +42,14 @@ To this end, you need to set up the following:
 
 See the [README](https://github.com/pulumi/pulumi-self-hosted-installers/tree/master/aks-hosted/README.md) file provided with the installer package for detailed deployment steps.
 
+{{< self-hosted-first-admin-note />}}
+
 ## AKS-Hosted System Management and Maintenance
 
 ### Pulumi Cloud Updates
 
+{{< self-hosting-schema-v2-note />}}
+
 When deploying the Service, it is recommended to pin the Pulumi Cloud image tag to a specific version. See the [installer's README](https://github.com/pulumi/pulumi-self-hosted-installers/tree/master/aks-hosted/README.md) file to set the `imageTag` configuration property for the installer to use.
 
 When ready to update the Pulumi Cloud containers to use a different version, do the following: