Skip to main content
Self-hosted images and charts are distributed from a private Fish Audio registry. Your team authenticates to it with a deploy token that you create in the fish.audio dashboard.

​
Prerequisites

  • Self-hosting enabled for your team under an enterprise agreement.
  • A fish.audio account that is a member of that team.
  • Docker, and Helm 3.8 or newer for the OCI chart commands.
If Developer → Self Host reports that self-host deployment is not enabled for your team, contact your account manager.

​
Collect your connection values

Sign in to fish.audio and open Developer → Self Host. The Connection Values card holds everything the commands below need, and every value has a copy button. The Granted Artifacts card lists exactly what your team may pull — the chart, the component images, and the All-in-One image where your agreement includes it — with the full reference for each one. Copy references and tags from that card rather than typing them by hand; it is the authoritative list for your team and it changes as your entitlement changes. If the card is empty, no artifacts have been granted yet.
Connection values are specific to your team and are only published in the dashboard, never in this documentation. Substitute the values you copied wherever a placeholder appears.

​
Create a deploy token

1

Open the Deploy Tokens card

On Developer → Self Host, select Create Deploy Token.
2

Name it for where it will be used

Use a name that identifies the consumer, such as prod-cluster or ci-mirror. The name appears in the token list alongside the creation date and last-used time.
3

Copy the token immediately

The token value is shown once, at creation. Store it in your secret manager before closing the dialog. If you lose it, rotate the token to issue a new one.
A team can hold up to five deploy tokens at a time. Tokens carry the grants of the team that owns them, not of the person who created them.

​
Authenticate Docker

Set your values once, then reuse them in the commands below.
Sign in with your account email as the username and the deploy token as the password:
Verify access by pulling one of your granted images:

​
Authenticate Helm

Charts are served as OCI artifacts, so Helm authenticates against the same registry host:
Confirm the chart is reachable, using the chart reference and version from Granted Artifacts:

​
Create the Kubernetes pull secret

The cluster pulls images with the same credentials. Create the pull secret the chart expects in the release namespace:
Reference it from the release so every workload uses it:

​
Managing tokens

Recommended practice:
  • Issue one token per consumer — production cluster, staging cluster, CI mirror — so a single revocation never takes down more than one of them.
  • Store tokens in your secret manager, not in values files or version control.
  • Rotate on your normal credential schedule and whenever someone with access to a token leaves the team.

​
Next step

With the registry reachable, continue to Kubernetes deployment or the All-in-One container.