---
title: Charmhub | Deploy Enterprise Store using Charmhub - The Open Operator Collection
description: Deploy the latest version of Enterprise Store on any cloud.
url: https://charmhub.io/enterprise-store/docs/deploy-ha
---

# Enterprise Store

[Colin Christophe](https://charmhub.io/publisher/colin-c "View all packages from Colin Christophe")

* [Colin Christophe](https://charmhub.io/publisher/colin-c "View all packages from Colin Christophe")

Platform:

24.04

stable 7

```
juju deploy enterprise-store
```

[Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications)

---

Share your thoughts on this charm with the community on discourse.

[Join the discussion](https://discourse.charmhub.io/)

# Deploying for high availability

This page describes how to run the enterprise-store charm with multiple units
for high availability, fronted by the [haproxy charm](https://charmhub.io/haproxy)
which terminates client TLS at the edge and load-balances across the units.

It applies to both deployment modes: first deploy the charm as described in the
Proxy mode or Offline mode guide, then add the
haproxy integration and scale out as shown here. The snippets below show only the
haproxy-specific parts, to be combined with the base deployment.

## [TLS options](https://charmhub.io/enterprise-store/docs/deploy-ha#p-42306-tls-options)

If the registered store uses https, TLS can be handled in two ways:

* Let the charm terminate TLS, by setting the enterprise-store `certificate` /
  `private_key` config options (or set both to `selfsigned` for a self-signed
  certificate). This is suitable for a single-unit deployment.
* Put the haproxy charm in front of it via the `haproxy-route` interface, in
  which case haproxy terminates TLS at the edge and the enterprise-store is
  served over plain HTTP behind it. This is the recommended option for a
  multi-unit, highly available deployment.

## [Fronting with HAProxy](https://charmhub.io/enterprise-store/docs/deploy-ha#p-42306-fronting-with-haproxy)

The charm can be placed behind the haproxy charm (channel `2.8/stable`) using
the `haproxy-route` interface. In this mode haproxy terminates client TLS at the
edge and the enterprise-store snap is served over plain HTTP behind it. The snap
honours the `X-Forwarded-Proto` header, so it still advertises `https://` URLs
to clients.

Two constraints apply when fronting with haproxy:

* The registration bundle’s `domain` must be haproxy’s public hostname, and
  haproxy’s edge certificate must cover that hostname. Clients connect to
  whatever `domain` is in the bundle.
* Do not set the enterprise-store `certificate` / `private_key` config options
  while related via `haproxy-route`. The haproxy charm owns TLS termination in
  this mode so setting them is contradictory. In the case these charm configs are
  set, the integration of the `haproxy-route` will unset them at the snap level
  and the stale `certificate` / `private_key` configs will need to be unset manually.

## [Scaling out](https://charmhub.io/enterprise-store/docs/deploy-ha#p-42306-scaling-out)

The charm supports multiple units for high availability; deploy with
`num_units` / `units` greater than one, or scale later:

```
juju add-unit enterprise-store
```

Configuration, certificate and snap changes are coordinated across units through
the `rollingops-peers` peer relation so that at most one unit restarts its
services at a time. See the upgrading page for more detail on rolling
operations.

## [Deploy with the Juju CLI](https://charmhub.io/enterprise-store/docs/deploy-ha#p-42306-deploy-with-the-juju-cli)

In addition to the base deployment, deploy haproxy with a certificate provider,
relate both, and scale the enterprise-store to multiple units:

```
juju deploy haproxy --channel 2.8/stable
juju deploy self-signed-certificates
juju integrate haproxy:certificates self-signed-certificates
juju integrate enterprise-store:haproxy-route haproxy:haproxy-route
juju add-unit enterprise-store -n 2
```

## [Deploy with a Juju bundle](https://charmhub.io/enterprise-store/docs/deploy-ha#p-42306-deploy-with-a-juju-bundle)

Add the haproxy-specific applications and relations to your deployment bundle,
and set the enterprise-store to multiple units:

```
applications:
  haproxy:
    charm: haproxy
    channel: 2.8/stable
    num_units: 1
  self-signed-certificates:
    charm: self-signed-certificates
    num_units: 1
  enterprise-store:
    num_units: 3

relations:
- - haproxy:certificates
  - self-signed-certificates:certificates
- - enterprise-store:haproxy-route
  - haproxy:haproxy-route
```

## [Deploy with Terraform](https://charmhub.io/enterprise-store/docs/deploy-ha#p-42306-deploy-with-terraform)

Add the haproxy-specific resources to the module containing your base
deployment. They reference the `enterprise-store` application and the model
defined there (replace `<model>` with your model resource name):

```
resource "juju_application" "self-signed-certificates" {
  name       = "self-signed-certificates"
  model_uuid = juju_model.<model>.uuid
  charm {
    name = "self-signed-certificates"
  }
}

resource "juju_application" "haproxy" {
  name       = "haproxy"
  model_uuid = juju_model.<model>.uuid
  charm {
    name    = "haproxy"
    channel = "2.8/stable"
  }
}

resource "juju_integration" "haproxy-self-signed" {
  model_uuid = juju_model.<model>.uuid
  application {
    name     = juju_application.haproxy.name
    endpoint = "certificates"
  }
  application {
    name     = juju_application.self-signed-certificates.name
    endpoint = "certificates"
  }
}

resource "juju_integration" "haproxy-route" {
  model_uuid = juju_model.<model>.uuid
  application {
    name     = juju_application.haproxy.name
    endpoint = "haproxy-route"
  }
  application {
    name     = juju_application.enterprise-store.name
    endpoint = "haproxy-route"
  }
}
```

Set `units = 3` (or higher) on the `enterprise-store` application in your base
deployment to run multiple units behind haproxy.

---