Installing from the archive

What is in the delivery archive, what each step of deploy.sh does, how to answer each prompt, how to install by hand, and the post-install checklist.

The archive

RST-Qradar-AI-Copilot-<version>.tar.gz unpacks to:

RST-Qradar-AI-Copilot-1.0.0/
├── RST-Qradar-AI-Copilot-images-1.0.0.tar     # gateway + caddy images, docker load'ed by deploy.sh
├── deploy.sh                                   # interactive installer
├── docker-compose.prod.yml                     # standard stack: Caddy + gateway + userdb
├── docker-compose.sso.yml                      # enterprise SSO stack
├── Caddyfile / Caddyfile.sso
├── .env.example                                # every setting, documented
├── deploy/rst-update.sh                        # online-update installer
├── scripts/backup.sh / restore.sh
└── docs/                                       # offline copy of this documentation

No registry access is needed. Verify with sha256sum -c RST-Qradar-AI-Copilot-<version>.tar.gz.sha256.

What deploy.sh does

tar xzf RST-Qradar-AI-Copilot-<version>.tar.gz
cd RST-Qradar-AI-Copilot-<version>
./deploy.sh

Checks Docker / Compose and the required files; generates state/machine-id and state/server_guid (the licence's hardware fingerprint, never regenerate). On an upgrade from an older install it migrates server_guid out of the old gateway_state volume so the fingerprint stays the same.

[2/7] Images

docker loads the image tar and records the gateway tag.

[3/7] Existing state

With an existing .env it asks "keep existing .env and start?"; answer Y on upgrades. Fresh installs skip this.

[4/7] Options

Auth: 1 = built-in login (standard); 2 = enterprise SSO (needs IdP details, see SSO). There is only one data source, the customer's QRadar Console, so nothing is asked.

[5/7] Configuration

Prompt	Answer
LLM endpoint URL	Default Volcengine Ark `https://ark.cn-beijing.volces.com/api/v3`; `/api/coding/v3` on the coding plan
LLM API key	Not echoed
LLM model id	`ark-code-latest` on the Ark coding plan, `ep-xxx` for a custom endpoint
Timezone offset	Default `+08:00`. The model resolves "today / yesterday" with it
QRadar Console URL	`https://qradar.corp.local`, no path
Authorized-service SEC token	Not echoed; created under Admin → Authorized Services
Trusted TLS certificate on the Console?	Default N (self-signed, not verified). Y writes `RST_QRADAR_VERIFY_CERTS=true`; for a private CA add `RST_QRADAR_CA_CERT` afterwards
Caddy site hostname	Analysts open `https://<this>/v2/`; use a domain name
Admin password	At least 8 characters, typed twice

[6/7] Write .env

Generates RST_GATEWAY_SHARED_SECRET, RST_ADMIN_TOKEN, RST_USER_DB_PASSWORD, RST_ADMIN_PASSWORD_HASH and writes .env (mode 600). QRADAR_API_VERSION is written as 20.0.

[7/7] Start

Writes GATEWAY_IMAGE_TAG, runs docker compose -f docker-compose.prod.yml up -d, waits up to 90 s for everything to be healthy, prints the URL.

Verify

curl -k https://<hostname>/healthz     # {"status":"ok"}
curl -k https://<hostname>/readyz      # {"status":"ready","qradar":"ok","qradar_version":"7.5.0 ...","qradar_configured":true}
docker compose -f docker-compose.prod.yml ps

`readyz` field	Expected	Otherwise
`qradar`	`ok`	On a 503 this is the reason: `not_configured` = no Console yet; 401 = token; connection error = `QRADAR_URL`, port 443, certificate verification; `docker compose logs gateway`
`qradar_version`	What the Console reports	Empty means `/api/system/about` is not permitted; the token's user role lacks read on system endpoints. Queries still work
`qradar_configured`	`true`	`false` = `QRADAR_URL` or `QRADAR_SEC_TOKEN` is empty in `.env`; the UI opens the connection dialog

Open https://<hostname>/v2/, accept the self-signed certificate (swap in your own for production by editing Caddyfile), log in as admin with the password you set.

Manual install (without deploy.sh)

docker load < RST-Qradar-AI-Copilot-images-*.tar
cp .env.example .env            # fill LLM_*, QRADAR_URL, QRADAR_SEC_TOKEN, CADDY_SITE_ADDRESS, RST_GATEWAY_SHARED_SECRET, RST_ADMIN_TOKEN, RST_USER_DB_PASSWORD, GATEWAY_IMAGE_TAG
mkdir -p state
openssl rand -hex 16 > state/machine-id
cat /proc/sys/kernel/random/uuid > state/server_guid
chmod 644 state/*               # the gateway runs as uid 10001; 600 is unreadable
docker compose -f docker-compose.prod.yml up -d

Both state/machine-id and state/server_guid must exist. If one is missing, docker mounts a directory in its place; the gateway fails to start or activation reports "no hardware identifier available". That is not a licence problem.

Admin password: docker exec rst-qradar-ai-copilot-gateway python -m backend.session_auth '<password>' prints the hash; put it in RST_ADMIN_PASSWORD_HASH in .env (write $ as $$, compose swallows a single $).

After install

Activate a licence.
Settings: log-source whitelist, masking mode, audit forwarding, offense sync.
Put ./state/, the gateway_state volume and the userdb_data volume into your backups, see Upgrade and backup.