Choosing services
Choosing each service
Every infrastructure area and its options — database, auth, storage, realtime, scheduler, email, secrets, KMS, cache, log export and directory sync — with on-premises, AWS, Azure and Google Cloud support.
Each infrastructure area has its own provider, chosen with an environment variable (<AREA>_PROVIDER) or with usertasks-admin switch <area>. These pages list the options in each area, where each one runs, and when to pick it. For the combinations that work well together, see Choose your topology. For every setting, see Infrastructure and providers.
How to read the tables:
- On-prem: runs with no SaaS and no outbound internet.
- AWS / Azure / Google Cloud: native means the provider uses that cloud's own service and identity (task role, managed identity, service account). compatible means it works there through a generic protocol (PostgreSQL, SMTP, OIDC, Redis) with a password or key. — means not applicable.
- Switch: what
usertasks-admin switchdoes. data means it copies or converts data (objects, accounts, rows, data keys). config means a validated configuration change.
| Area | Variable | Default | Options | Page |
|---|---|---|---|---|
| Database | DB_PROVIDER | supabase | postgres | Database |
| Auth | AUTH_PROVIDER | supabase | builtin, oidc, saml | Auth |
| File storage | STORAGE_PROVIDER | supabase | local, s3, azure_blob, gcs | Storage |
| Realtime | REALTIME_PROVIDER | supabase | sse | Realtime |
| Scheduler | SCHEDULER_PROVIDER | pg_cron | worker, external | Scheduler |
EMAIL_PROVIDER | resend | smtp, ses, azure_communication, microsoft_graph, gmail, console | ||
| Secrets | SECRETS_PROVIDER | env | db, supabase_vault, hashicorp_vault, azure_key_vault, gcp_secret_manager, aws_secrets_manager | Secrets |
| KMS | KMS_PROVIDER | env | vault_transit, aws_kms, azure_key_vault, gcp_kms | KMS |
| Cache | CACHE_PROVIDER | memory | postgres, redis | Cache |
| Log export | per workspace | none | splunk_hec, datadog, otlp_http, webhook, syslog, azure_monitor, azure_event_hubs, gcp_logging, gcp_pubsub, aws_cloudwatch_logs | Log export |
| Directory sync | per workspace | none | entra, okta, ldap, google, scim | Directory sync |
usertasks-admin providers list [--on-prem] [--aws] [--azure] [--gcp] prints the same catalogue from the installed version, with each provider's capabilities.