Installing from the archive

Install with the script

install.sh is attached to every release. It downloads the archive and its .sha256 file, verifies it, unpacks it into the install directory, and runs deploy.sh. The host needs Docker Engine 24 or later with Docker Compose v2, and you run the script as root from an interactive terminal.

curl -fsSL https://github.com/Reallysec/RST-AI-Copilot-for-Elastic/releases/latest/download/install.sh | sudo bash

Every edition uses the same archive. Without a license it runs as the Community Edition; activating a license on the License tab in Settings unlocks that edition's features in place, with no reinstall.

Running the script again unpacks into the same directory and keeps .env and state/, so the license fingerprint does not change.

Install on an air-gapped host

Steps

1. On a host with access to GitHub, run:

   curl -fsSL https://github.com/Reallysec/RST-AI-Copilot-for-Elastic/releases/latest/download/install.sh | bash -s -- --download-only

2. Copy RST-AI-Copilot-for-Elastic-<version>.tar.gz from the current directory to the air-gapped host.

3. Install it as in Run deploy.sh below.

With bundled Elasticsearch and Kibana, also copy RST-AI-Copilot-for-Elastic-elk-images-<version>.tar.gz from the release page into the unpacked directory; see Bundled Elasticsearch and Kibana.

Get the archive

The archive is published on GitHub Releases as RST-AI-Copilot-for-Elastic-<version>.tar.gz with the checksum file RST-AI-Copilot-for-Elastic-<version>.tar.gz.sha256. Every edition uses this one archive, and the activated license decides the feature set.

The archive unpacks to:

RST-AI-Copilot-for-Elastic-<version>/
├── RST-AI-Copilot-for-Elastic-images-<version>.tar   # gateway and Caddy images, loaded by deploy.sh
├── deploy.sh                                     # interactive installer
├── docker-compose.prod.yml                       # standard form: Caddy, gateway, userdb
├── docker-compose.sso.yml                        # SSO form
├── Caddyfile / Caddyfile.sso
├── .env.example                                  # every configuration key, documented
├── deploy/rst-update.sh                          # online-update installer
├── scripts/backup.sh / restore.sh
└── docs/                                         # deployment and backup guides, release notes

Installation does not access any container registry. Verify the archive with sha256sum -c RST-AI-Copilot-for-Elastic-<version>.tar.gz.sha256 before unpacking.

Run deploy.sh

tar xzf RST-AI-Copilot-for-Elastic-<version>.tar.gz
cd RST-AI-Copilot-for-Elastic-<version>
sudo ./deploy.sh

The script runs seven steps.

Prompts in step 5:

state/machine-id and state/server_guid form the license hardware fingerprint and must never be regenerated.

Bundled Elasticsearch and Kibana

With Elasticsearch source 2 in step 4, deploy.sh writes ES_URL=http://elasticsearch:9200 and KIBANA_URL=http://kibana:5601 to .env and starts the elasticsearch and kibana services of docker-compose.prod.yml with --profile bundled-elk. This form is for a PoC or a host without ELK; production connects to an existing cluster.

The archive does not contain these images. If the host can reach docker.elastic.co, deploy.sh offers to pull the missing images. On an air-gapped host, put the optional release asset RST-AI-Copilot-for-Elastic-elk-images-<version>.tar.gz in the install directory next to deploy.sh, and step 2 loads it. Without the images and without pulling, the script stops.

deploy.sh decides the RST_ELK_VERSION it writes to .env in this order:

1. If .env already has a value, it is kept.
2. If there is no value but the host already has a bundled Elasticsearch data volume (es_data or sso_es_data), it writes 8.12.2. Installs from before 1.2.4 fall in this case.
3. Otherwise (a new install) it writes 9.5.3. The offline elk-images asset also contains 9.5.3.

Elasticsearch 9.x cannot open 8.x data directly. On a host with bundled Elasticsearch data, do not change only RST_ELK_VERSION to 9.5.3, or Elasticsearch will not start.

User account table

Users and their three roles (admin, analyst, viewer) are stored in a Postgres owned by the gateway, never in Elasticsearch. deploy.sh starts the userdb container and sets RST_USER_DB_URL, so you can add accounts on the Users page right after installation.

For a manual installation, set in .env:

RST_USER_DB_PASSWORD=<32-character random string>
RST_USER_DB_URL=postgresql://rst:<same>@userdb:5432/rst_users

Then run docker compose -f docker-compose.prod.yml up -d userdb gateway caddy. On first start the gateway creates the table and seeds RST_ADMIN_USERNAME with RST_ADMIN_PASSWORD_HASH as the first administrator. To use your own Postgres, point RST_USER_DB_URL at it and do not start userdb.

With SSO enabled, the IdP owns the accounts and RST_USER_DB_URL is ignored.

Verify the installation

curl -k https://<hostname>/healthz     # {"status":"ok"}
curl -k https://<hostname>/readyz      # {"status":"ready","es":"ok","es_write":"ok","timezone":"+08:00",...}
docker compose -f docker-compose.prod.yml ps

Open https://<hostname>/v2/ and sign in as admin with the password you set. The certificate is self-signed; for production, edit Caddyfile to use your own.

Manual installation

Without deploy.sh:

docker load < RST-AI-Copilot-for-Elastic-images-*.tar
cp .env.example .env            # fill LLM_*, ES_*, CADDY_SITE_ADDRESS, RST_GATEWAY_SHARED_SECRET, RST_ADMIN_TOKEN, RST_USER_DB_PASSWORD, GATEWAY_IMAGE_TAG
mkdir -p state
openssl rand -hex 16 > state/machine-id
cat /proc/sys/kernel/random/uuid > state/server_guid
chmod 644 state/*               # the gateway runs as uid 10001 and cannot read mode 600
docker compose -f docker-compose.prod.yml up -d

To create the administrator password hash, run docker exec rst-ai-copilot-for-elastic-gateway python -m backend.session_auth '<password>'. Put the output in .env as RST_ADMIN_PASSWORD_HASH, writing every $ as $$ so compose does not treat it as a variable.

Next step

1. To use the paid engines, activate a license.
2. Configure the index whitelist, masking mode, and audit in Settings.
3. Configure the knowledge-base embedding model in AI settings.
4. Back up ./state/, the gateway_state volume, and the userdb_data volume; see Upgrade and backup.