Deployed as a tenant of the Hill90 homelab — hill90.com serves the UI, and identity comes from the homelab’s Keycloak at auth.hill90.com, realm platform. Verified 2026-08-06 07:45 UTC: 23 containers running, 0 unhealthy — the homelab’s 16 and the application’s 7.Identity and data are the platform’s. The tenant’s databases sit on the homelab’s Postgres under a dedicated non-superuser role, and app-auth.hill90.com is not a live surface — it returns 404. Authorization uses client roles on the hill90-ui client rather than realm roles, so holding a homelab realm role does not by itself grant access to the application. A local stack runs its own Postgres, and --standalone its own Keycloak, so pages describing those locally remain accurate.Signing in was completed on 2026-07-30, reported by the operator who performed it. That is not independently re-verified here: realm platform has event storage disabled, so there is no server-side record left to read.Where a page in this section disagrees with AI Application, the overview is newer.

What is Hill90?

Hill90 is a production-ready microservices platform hosted on a single VPS. It provides:

A REST API for managing AI agents, model access, and user profiles
Sandboxed agent containers with configurable tools and resource limits
Policy-gated LLM inference with bring-your-own-key (BYOK) model management
Persistent agent knowledge — memory that survives across sessions, with full-text search
A Model Context Protocol (MCP) gateway for tool-augmented AI
A Next.js frontend with Keycloak-backed authentication
Full observability via the LGTM stack (Loki, Grafana, Tempo, Prometheus)

All services run as Docker containers, orchestrated with Docker Compose, behind a Traefik reverse proxy that provides automatic HTTPS.

Technology Stack

Layer	Technologies
Languages	TypeScript (Node.js), Python
Frameworks	Express, FastAPI, Next.js
Identity	Keycloak 26 (OIDC/OAuth2), Auth.js v5
Infrastructure	Docker Engine, Docker Compose, Traefik
Data	PostgreSQL, MinIO (S3-compatible)
Secrets	OpenBao (vault), encrypted backup
Observability	Prometheus, Grafana, Loki, Tempo, OpenTelemetry
CI/CD	GitHub Actions
DNS	Cloudflare (moved from Hostinger 2026-07-27; Hostinger remains the VPS host and mail provider)
Certificates	Let’s Encrypt (HTTP-01 + DNS-01)

Architecture at a Glance

Internet
   |
Traefik (reverse proxy, automatic HTTPS)
   |
   +-- API Service (Express, TypeScript)
   +-- MCP Gateway (FastAPI, Python)
   +-- Keycloak (Identity Provider)
   +-- UI (Next.js)
   |
Internal Network
   +-- AI Service / Model-Router (FastAPI, Python)
   +-- Knowledge Service / AKM (FastAPI, Python)
   +-- PostgreSQL
   +-- MinIO (S3 storage)
   +-- Observability Stack (Prometheus, Grafana, Loki, Tempo)
   |
Agent Network
   +-- Agentbox containers → AI Service, Knowledge Service

Traffic enters through Traefik, which handles TLS termination, routing, and load balancing. Public services use HTTP-01 certificates, while admin-only services use DNS-01 certificates and are restricted to the VPN network. The AI service and Knowledge service are internal-only — agent containers communicate with them on an isolated network.

Getting Started

Features

Architecture

API Reference

Endpoints

Overview

What is Hill90?

Technology Stack

Architecture at a Glance

Next Steps

Quickstart

Authentication

​What is Hill90?

​Technology Stack

​Architecture at a Glance

​Next Steps

Quickstart

Authentication

What is Hill90?

Technology Stack

Architecture at a Glance

Next Steps