Installing from the archive

The gateway is published on GitHub Releases as the archive RST-AI-Copilot-for-QRadar-<version>.tar.gz, with a .sha256 file of the same name for verification. The archive carries every image and deployment file, and its deploy.sh does the installation: it loads the images, collects the configuration, writes .env and starts the containers. Starting with 1.0.1, install.sh combines download, verification, unpacking and deploy.sh into one command.

Archive contents

RST-AI-Copilot-for-QRadar-<version>/
├── RST-AI-Copilot-for-QRadar-images-<version>.tar   # gateway, Caddy and PostgreSQL images
├── deploy.sh                                    # interactive installer
├── docker-compose.prod.yml                      # built-in login
├── docker-compose.sso.yml                       # SSO
├── Caddyfile, Caddyfile.sso
├── .env.example                                 # every setting, with notes
├── deploy/rst-update.sh                         # online update installer
├── scripts/backup.sh, scripts/restore.sh
└── docs/                                        # DEPLOYMENT.md, BACKUP.md, RELEASE-NOTES.md

Before it starts the containers, deploy.sh checks that every image the compose file uses is present on the host. If any is missing, it lists the image names and asks whether to pull them. On an air-gapped host, answer no and the installation stops.

Install with one command

Available starting with 1.0.1.

Prerequisites

• Docker Engine 24 or later and Docker Compose v2 are installed.
• The host can reach github.com.
• You run the command from an interactive terminal, because deploy.sh reads input.

Steps

1. Run the installer:

   curl -fsSL https://github.com/Reallysec/RST-AI-Copilot-for-QRadar/releases/latest/download/install.sh | sudo bash

   Every edition uses the same archive: without a license it runs as Community, and activating a license under Settings > License unlocks that edition in place, with no reinstall.

2. Answer the deploy.sh prompts. See deploy.sh prompts below.

The script unpacks the archive into /opt/rst-ai-copilot-for-qradar and runs deploy.sh there. Hosts installed with 1.1.15 or earlier are upgraded in their existing directory /opt/rst-qradar-ai-copilot. When you run it again on the same host, .env and state/ in that directory are kept, and the license's host fingerprint does not change. The same command therefore upgrades an install.

Install on an air-gapped host

Steps

1. On a machine that can reach GitHub, download and verify the archive:

   curl -fsSL https://github.com/Reallysec/RST-AI-Copilot-for-QRadar/releases/latest/download/install.sh | bash -s -- --download-only

2. Copy RST-AI-Copilot-for-QRadar-<version>.tar.gz and its .sha256 file from the current directory to the air-gapped host.

3. On the air-gapped host, follow Install the archive by hand.

Install the archive by hand

Steps

1. Download RST-AI-Copilot-for-QRadar-<version>.tar.gz and its .sha256 file from GitHub Releases. Every edition uses the same archive; the activated license decides which features are on.

2. Verify and unpack it:

   sha256sum -c RST-AI-Copilot-for-QRadar-<version>.tar.gz.sha256
   tar xzf RST-AI-Copilot-for-QRadar-<version>.tar.gz
   cd RST-AI-Copilot-for-QRadar-<version>

3. Run sudo ./deploy.sh and answer the prompts.

deploy.sh prompts

The script runs in seven steps: preflight, image load, check for an existing .env, authentication mode, configuration, write .env, start. The preflight generates state/machine-id and state/server_guid, the license's hardware fingerprint, or reuses them if they exist. If .env already exists, the script asks whether to keep it and start; keep it when upgrading.

The script generates RST_GATEWAY_SHARED_SECRET, RST_ADMIN_TOKEN, RST_USER_DB_PASSWORD and the admin password hash, and writes them to .env with mode 600. After starting, it waits up to 90 seconds for every container to become healthy, then prints the running version and the URL.

Verify the installation

Steps

1. Check health and readiness:

   curl -k https://<hostname>/healthz     # {"status":"ok"}
   curl -k https://<hostname>/readyz
   docker compose -f docker-compose.prod.yml ps

2. Open https://<hostname>/v2/ and sign in as admin with the password you set during installation.

A ready gateway returns {"status":"ready","qradar":"ok","qradar_version":"<Console version>","qradar_configured":true}. On a 503, qradar holds the reason: not_configured means no Console has been entered; any other value is the error from connecting to the Console. qradar_configured is false when QRADAR_URL or QRADAR_SEC_TOKEN is empty in .env, and the connection dialog opens after sign-in.

The default certificate is self-signed. For production, edit Caddyfile to use your own certificate.

Install without deploy.sh

Steps

1. Load the images and prepare .env:

   docker load < RST-AI-Copilot-for-QRadar-images-<version>.tar
   cp .env.example .env

2. In .env, set LLM_API_KEY, LLM_MODEL, QRADAR_URL, QRADAR_SEC_TOKEN, CADDY_SITE_ADDRESS, RST_GATEWAY_SHARED_SECRET, RST_ADMIN_TOKEN, RST_USER_DB_PASSWORD and GATEWAY_IMAGE_TAG=<version>.

3. Generate the admin password hash and write it to RST_ADMIN_PASSWORD_HASH in .env, doubling every $ as $$:

   docker run --rm rst-ai-copilot-for-qradar-gateway:<version> python -m backend.session_auth '<password>'

4. Generate the host fingerprint files:

   mkdir -p state
   openssl rand -hex 16 > state/machine-id
   cat /proc/sys/kernel/random/uuid > state/server_guid
   chmod 644 state/*

5. Run docker compose -f docker-compose.prod.yml up -d.

Next steps

1. To use the paid engines, activate a license on the License page.
2. Configure the log-source whitelist, masking mode and audit in Settings.
3. Include ./state/, the gateway_state volume and the userdb_data volume in backups. See Upgrade, rollback and backup.