Deploy Agent Identity Security manually

Load the Docker image.

sudo ./load-and-verify.sh

The script outputs the image name, for example ais-dp-bundle:v1.0.x. Note this name for use in subsequent commands. The image supports the following architectures:

linux/amd64
linux/arm64

Create the configuration file.

cp config-env.template config.env
# Edit config.env with your settings

Note: The deployment script generates config.env automatically based on your selections. Use this step only for manual deployments.

Set up credential encryption.

Choose one of the following three options.

Option A: Vault-based encryption

Vault-based encryption stores credentials in HashiCorp Vault, providing centralized secrets management with audit logs and advanced access controls.

To deploy a new Vault container:

# Create Docker network
docker network create ais-network

# Start Vault container
docker run -d \
  --name ais-vault \
  --network ais-network \
  -p 8200:8200 \
  --restart unless-stopped \
  -e VAULT_DEV_ROOT_TOKEN_ID=vault-dev-root-token \
  -e VAULT_DEV_LISTEN_ADDRESS=0.0.0.0:8200 \
  -v vault_data:/vault/data \
  -v vault_config:/vault/config \
  hashicorp/vault:1.21

# Wait for Vault to start (10–15 seconds), then enable the KV v2 secrets engine
docker exec -e VAULT_ADDR='http://127.0.0.1:8200' \
  -e VAULT_TOKEN='vault-dev-root-token' \
  ais-vault vault secrets enable -path=integrations -version=2 kv

Update config.env for Vault-based encryption:

ENABLE_CREDENTIAL_ENCRYPTION=true
ENCRYPTION_METHOD=vault
VAULT_ADDR=http://ais-vault:8200
VAULT_TOKEN=vault-dev-root-token

To use an existing Vault instance, enable the KV v2 engine and update config.env:

vault secrets enable -path=integrations -version=2 kv

ENABLE_CREDENTIAL_ENCRYPTION=true
ENCRYPTION_METHOD=vault
VAULT_ADDR=http://your-vault-address:8200
VAULT_TOKEN=your-vault-token

Option B: File-based encryption

File-based encryption uses a key file stored on the filesystem to encrypt and decrypt credentials locally.

To generate a new key:

./generate_key.sh --output encryption.key
chmod 444 encryption.key

To use an existing key:

cp /path/to/existing/encryption.key ./encryption.key
chmod 444 encryption.key

Update config.env for file-based encryption:

ENABLE_CREDENTIAL_ENCRYPTION=true
ENCRYPTION_METHOD=file
ENCRYPTION_KEY_PATH=/app/secrets

Option C: No encryption

Disabling credential encryption is not recommended for production deployments.

Update config.env to disable encryption:

ENABLE_CREDENTIAL_ENCRYPTION=false

Start the container.

Run the command that matches your encryption method. Replace ais-dp-bundle:v1.0.x with the actual image name from step 1.

Vault-based encryption (container must be on ais-network):

docker run -d \
  --name ais-dp-bundle \
  --restart unless-stopped \
  --network ais-network \
  -p 8000:8000 \
  -p 3002:3002 \
  -v ais-dp-postgres-data:/var/lib/postgresql/data \
  -v ais-dp-logs:/var/log/supervisor \
  --env-file config.env \
  ais-dp-bundle:v1.0.x

File-based encryption:

docker run -d \
  --name ais-dp-bundle \
  --restart unless-stopped \
  -p 8000:8000 \
  -p 3002:3002 \
  -v ais-dp-postgres-data:/var/lib/postgresql/data \
  -v ais-dp-logs:/var/log/supervisor \
  -v $(pwd)/encryption.key:/app/secrets/encryption.key:ro \
  --env-file config.env \
  ais-dp-bundle:v1.0.x

No encryption:

docker run -d \
  --name ais-dp-bundle \
  --restart unless-stopped \
  -p 8000:8000 \
  -p 3002:3002 \
  -v ais-dp-postgres-data:/var/lib/postgresql/data \
  -v ais-dp-logs:/var/log/supervisor \
  --env-file config.env \
  ais-dp-bundle:v1.0.x

Verify the container is running.

# Check container status
docker ps | grep ais-dp-bundle

# Check logs
docker logs ais-dp-bundle --tail 50

# Test backend health
curl http://localhost:8000/health

# Test frontend (should return HTML)
curl http://localhost:3002

(Optional) Set up Caddy for HTTPS.

Caddy provides HTTPS with self-signed certificates or your own certificates, and routes traffic to the frontend on port 3002 and the backend on port 8000. It listens on ports 80 (HTTP) and 443 (HTTPS).

export LOCAL_BACKEND_PORT=8000
export LOCAL_FRONTEND_PORT=3002
sudo bash start-caddy.sh your-domain.com

When prompted, select your SSL certificate option (customer's internal CA, private CA, or self-signed certificate). See Deploy Agent Identity Security using the Quick Start script for details on each option.