# Deploy Baserow on Yandex Cloud via the OpenNix Marketplace

> Deploy a highly available Baserow via the OpenNix marketplace listing: pick a dev or prod profile with managed PostgreSQL, Redis, and Lockbox secrets.

Source: https://opennix.org/en/docs/baserow/getting-started/set-up-baserow/


OpenNix publishes Baserow HA as a Cloud Apps product for the Yandex Cloud Marketplace: deployed onto your own infrastructure with no manual dependency installation, offered in a lightweight evaluation profile and a highly available production profile, in place of the baserow.io cloud service.

## Two Deployment Profiles

The product deploys in one of two profiles:

- **dev** - a single virtual machine with embedded PostgreSQL and Redis. Suitable for evaluation and testing, but it is a single point of failure and is not meant for production workloads.
- **prod** (recommended) - two stateless application nodes behind a network load balancer, with all state externalized to managed services: Managed Service for PostgreSQL (the database), Managed Service for Redis/Valkey (cache and background-job queue), and an S3-compatible Object Storage bucket (uploaded files). Because the nodes hold no data, any node can be rebuilt without losing anything.

The rest of this guide walks through the **prod** profile, since it is the one that provides high availability and is suitable for real workspaces.

## Before You Deploy: Lockbox Secrets

The deployment form accepts Yandex Lockbox secrets rather than plaintext passwords - no password is ever typed into a form field. Before deploying, create three required secrets - the database password, the Redis password, and the Django signing key - and, if you want your own certificate, a fourth one for TLS.

```bash
yc lockbox secret create --name baserow-db-password --folder-id <FOLDER_ID> \
  --payload '[{"key":"password","text_value":"'"$(openssl rand -hex 24)"'"}]'

yc lockbox secret create --name baserow-redis-password --folder-id <FOLDER_ID> \
  --payload '[{"key":"password","text_value":"'"$(openssl rand -hex 24)"'"}]'

yc lockbox secret create --name baserow-secret-key --folder-id <FOLDER_ID> \
  --payload '[{"key":"secret-key","text_value":"'"$(openssl rand -base64 48)"'"}]'
```

An operator TLS certificate is an optional secret; without it, each node serves a self-signed Caddy certificate:

```bash
yc lockbox secret create --name baserow-tls --folder-id <FOLDER_ID> \
  --payload '[{"key":"tls-cert","text_value":"<full PEM chain>"},{"key":"tls-key","text_value":"<PEM private key>"}]'
```

## Launch Parameters in the Marketplace Form

When deploying, the marketplace form asks for:

| Parameter | What it configures |
|---|---|
| Name prefix | Prefix for every resource created (used, for example, in the S3 bucket name - must be unique) |
| Subnet | The subnet for the nodes and the managed services |
| Public URL | A `https://...` address that drives the TLS host and generated links |
| DB / Redis / Django secrets | The Lockbox secrets created in the previous step |
| TLS secret | Optional Lockbox secret holding an operator certificate |
| Node sizing | vCPU, memory, and disk per node |
| Worker counts | Number of gunicorn and Celery workers per node |
| Managed PostgreSQL | Cluster version, host class, and disk size |
| Managed Redis (Valkey) | Cluster version, host class, and disk size |

## What Gets Created

Once deployment finishes, the folder contains: a Managed Service for PostgreSQL cluster, a Managed Service for Redis (Valkey) cluster, an S3 bucket for files, two compute nodes, a target group, and a network load balancer with a public IP address. The product's service account only holds the narrow `lockbox.payloadViewer` and `storage.editor` roles - no key files and no broad folder-editor permissions.

## First Login

1. Open the public URL you set during deployment (or the network load balancer's IP address) in a browser. Without your own TLS certificate, the browser will warn about Caddy's self-signed certificate - that is expected.
2. On the Baserow page that loads, create your first account through the normal web UI sign-up form - administrator credentials are not handed out during infrastructure deployment; the Lockbox secrets are only used to connect to the database, Redis, and to sign sessions.
3. Create your first [workspace](/docs/baserow/workspaces/) and continue with [How to Get Started with Baserow](/docs/baserow/getting-started/how-to-get-started-with-baserow/) if you have not gone through it yet.

## High Availability and Maintenance

In the prod profile, application nodes hold no data and are disposable: losing one node does not lose any data, because the database, cache, and files all live in external managed services. The Celery beat periodic-task scheduler runs on exactly one node - a leadership daemon holds a PostgreSQL advisory lock and automatically hands the role to another node on failure, so scheduled jobs never run twice. Backups for the database and Redis are handled by the standard Managed Service for PostgreSQL and Managed Service for Redis tooling, independent of the Baserow version running on the application nodes.

## Where to Go Next

From here, continue with [Baserow's basic concepts](/docs/baserow/getting-started/learn-baserow-basic-concepts/) and the [keyboard shortcuts](/docs/baserow/getting-started/baserow-keyboard-shortcuts/) that speed up day-to-day work.