Installing from the archive

What the delivery archive contains, what every step of deploy.sh does and how to answer each prompt, how to install by hand, and the post-install checklist.

The archive

RST-Elastic-AI-Copilot-<version>.tar.gz unpacks to:

RST-Elastic-AI-Copilot-1.1.21/
├── RST-Elastic-AI-Copilot-images-1.1.21.tar   # gateway + caddy images, docker-loaded by deploy.sh
├── deploy.sh                                   # interactive installer
├── docker-compose.prod.yml                     # standard shape: Caddy + gateway + userdb
├── docker-compose.sso.yml                      # enterprise SSO shape
├── Caddyfile / Caddyfile.sso
├── .env.example                                # every setting, documented
├── deploy/rst-update.sh                        # online-update installer
├── scripts/backup.sh / restore.sh
└── docs/                                       # offline copy of these docs

No registry access is needed. Verify integrity: sha256sum -c RST-Elastic-AI-Copilot-<version>.tar.gz.sha256.

What deploy.sh does

tar xzf RST-Elastic-AI-Copilot-<version>.tar.gz
cd RST-Elastic-AI-Copilot-<version>
./deploy.sh

Checks Docker / Compose and the four required files; generates state/machine-id and state/server_guid - the licence's hardware fingerprint, never regenerate. On an upgrade the existing server_guid is migrated out of the old gateway_state volume, so the fingerprint is unchanged.

[2/7] Images

docker loads the image tar and notes the gateway tag.

[3/7] Existing install

With an existing .env it asks "keep the existing .env and start?"; answer Y on upgrades. A fresh install skips this.

[4/7] Options

Auth: 1 = built-in login (standard); 2 = enterprise SSO (needs IdP details, see SSO). Elasticsearch: 1 = your existing ELK (standard); 2 = bundled ES + Kibana (PoC only, --profile bundled-elk).

[5/7] Configuration

Prompt	Answer
LLM endpoint URL	Default Volcengine Ark `https://ark.cn-beijing.volces.com/api/v3`; the coding plan uses `/api/coding/v3`
LLM API key	Not echoed
LLM model id	`ark-code-latest` on the Ark coding plan, `ep-xxx` for a custom endpoint
Timezone offset	Default `+08:00`; the model reads "today / yesterday" against it
Elasticsearch URL	`https://es.corp.local:9200`
ES user / password	Empty when security is off
Kibana URL	May be empty
Caddy site address	The hostname analysts open, `https://<this>/v2/`
Admin password	8+ characters, typed twice

[6/7] Write .env

Generates RST_GATEWAY_SHARED_SECRET, RST_ADMIN_TOKEN, RST_USER_DB_PASSWORD, RST_ADMIN_PASSWORD_HASH and writes .env (mode 600).

[7/7] Start

Writes GATEWAY_IMAGE_TAG, runs docker compose -f docker-compose.prod.yml up -d, waits up to 90 s for everything to be healthy, prints the URL.

Verifying

curl -k https://<hostname>/healthz     # {"status":"ok"}
curl -k https://<hostname>/readyz      # {"status":"ready","es":"ok","es_write":"ok","timezone":"+08:00",...}
docker compose -f docker-compose.prod.yml ps

`readyz` field	Expected	Otherwise
`es`	`ok`	ES URL / account / certificate; `docker compose logs gateway`
`es_write`	`ok`	`denied` = the account lacks create / write on `.rst_copilot_*`, see ES permissions
`timezone`	Yours	`RST_TIMEZONE` in `.env`
`sso`	`disabled` (single-user)	—

Open https://<hostname>/v2/, accept the self-signed certificate (swap in your own for production via Caddyfile), sign in as admin with the password you set.

Manual install (without deploy.sh)

docker load < RST-Elastic-AI-Copilot-images-*.tar
cp .env.example .env            # fill LLM_*, ES_*, CADDY_SITE_ADDRESS, RST_GATEWAY_SHARED_SECRET, RST_ADMIN_TOKEN, RST_USER_DB_PASSWORD, GATEWAY_IMAGE_TAG
mkdir -p state
openssl rand -hex 16 > state/machine-id
cat /proc/sys/kernel/random/uuid > state/server_guid
chmod 644 state/*               # the gateway runs as uid 10001; 600 is unreadable to it
docker compose -f docker-compose.prod.yml up -d

Both state/machine-id and state/server_guid must exist. Missing either, docker bind-mounts a directory there and the gateway either fails to start or activation reports "no hardware identifier available" - not a licence problem.

Admin password: docker exec rst-elastic-ai-copilot-gateway python -m backend.session_auth '<password>' prints a hash; put it in .env as RST_ADMIN_PASSWORD_HASH with every $ written as $$ (compose eats single $).

After install

Activate a licence.
Settings: index whitelist, masking mode, audit.
AI models: embedding model for the knowledge base.
Back up ./state/, the gateway_state volume and the userdb_data volume, see Upgrade and backup.