Deploy Agent Identity Security using the Quick Start script (Recommended)

Use the deploy-docker.sh script to deploy the Agent Identity Security self-hosted application interactively. The script guides you through all configuration choices and starts the application automatically.

Extract the bundle.
On Linux or macOS:
```
unzip ais-dp-bundle-vX.X.X.zip -d ais-dp-bundle-vX.X.X
```
Note: On Windows, extract the ZIP file contents to a folder from File Explorer. Replace X.X.X with the specific version number.

Navigate to the extracted folder.

On Linux or macOS:

cd <downloaded_folder_path>/ais-dp-bundle-vX.X.X

On Windows (Cygwin terminal):

cd /cygdrive/<DriveName>/[Users/<username>]/<downloaded_folder_path>/ais-dp-bundle-vX.X.X

Run the deployment script.
```
sudo ./deploy-docker.sh up
```
Follow the prompts to configure your deployment.
1. Configure ports.
  Accept the default ports by pressing Enter, or enter custom values.
```
Backend port (default: 8000): [Press Enter]
Frontend port (default: 3002): [Press Enter]
Postgres port (default: 5432): [Press Enter]
MCP proxy port (default: 8444): [Press Enter]
```
2. Configure Caddy for HTTPS (optional).
  When prompted, choose whether to enable the Caddy reverse proxy and enter your domain.
```
Do you want to setup Caddy reverse proxy with HTTPS? (default: Y):
Domain for Caddy (default: dp.aiscyber.ai): dp.aiscyber.ai
```
  Then select an SSL certificate option:
  - Option 1 - Customer's internal CA: Provide paths to your existing certificate and private key files.
```
Enter path to certificate file (full chain, PEM): <CERT>
Enter path to private key file (PEM): <PEM>
```
  - Option 2 - Private CA: The script generates a Root CA and signs a server certificate. You are prompted to provide the organization name, CA common name, and validity period. After the Root CA is created, distribute ssl-setup/ais-ca-installer.tar.gz to all client machines so they trust the CA.
    Important: Store the Root CA password securely. You cannot issue new certificates without it. Back up the CA files immediately:
    tar -czf ais-ca-backup-$(date +%Y%m%d).tar.gz ssl-setup/ca/root-ca
    Never copy the Root CA private key to the deployment VM.
  - Option 3 - Self-signed certificate: Generates a self-signed certificate for quick testing. Browsers display a security warning.
    Note: Since this runs on your local machine, the domain name is arbitrary. To access the application over the network from another system, use the host system's IP address or update your DNS configuration.
3. Set the admin username and password.
```
Admin username (default: [email protected]):
Enter Admin password:
Confirm Admin password:
```
  Username and password requirements:
  - Username must be a valid email address.
  - Password must be at least 8 characters and include at least one uppercase letter, one digit, and one special character.
4. Confirm the configuration.
  Review the displayed configuration summary and enter Y to proceed.
```
Configuration:
Backend Port: 8000
Frontend Port: 3002
Postgres Port: 5432
Admin username: [email protected]
Setup Caddy: Yes
Domain: dp.aiscyber.ai
Proceed with this configuration? (Y/n):
```
5. Select an encryption method.
```
Enable credential encryption? (Y/n): Y
Choose encryption method:
[1] File-based  — Simple, key stored on disk
[2] Vault-based — Advanced, uses HashiCorp Vault
Enter choice [1-2]:
```
  - File-based encryption: Encrypts credentials using a key file stored on the filesystem. To generate a new key, accept the default path. To use an existing key, enter its path.
```
# New key
Do you have an existing encryption key? (y/N): N
Enter path for new encryption key (default: ./encryption.key): [Press Enter]

# Existing key
Do you have an existing encryption key? (y/N): Y
Enter path to encryption key file: /path/to/existing/encryption.key
```
  - Vault-based encryption: Stores credentials in HashiCorp Vault with centralized secrets management, audit logs, and access controls. To deploy a new Vault container, accept the default. To use an existing Vault instance, enter its address and token.
```
# New Vault
Do you have an existing Vault instance? (y/N):
Vault port (default: 8200):

# Existing Vault
Do you have an existing Vault instance? (y/N): Y
Enter Vault address (default: http://localhost:8200): http://your-vault:8200
Enter Vault token: your-vault-root-token
```
    Important: Ensure the KV v2 secrets engine is enabled at the integrations path in your Vault:
    vault secrets enable -path=integrations -version=2 kv

Access your application.

After deployment completes, the script displays the access URLs:

HTTPS: https://your-domain.com/
HTTP:  http://localhost:3002
Backend: http://localhost:8000
Vault: http://localhost:8200 (if Vault enabled)

Verify the deployment.

# Check container is running
docker ps | grep ais-dp-bundle

# Check application health
curl http://localhost:8000/health

# View logs
docker logs ais-dp-bundle --tail 50