Documentation index
On-Premise Installation
Deployment Models
- Container stack - Workbench, PostgreSQL, and the reverse proxy run with Docker Compose. Use this for evaluation or approved smaller deployments where single-host availability is acceptable.
- Customer-managed PostgreSQL - The customer database team operates PostgreSQL, encryption, backup, monitoring, and high availability. The Workbench and reverse proxy run separately.
Supported Baseline
Use only vendor-supported components. The authorized release notes take precedence over this guide.
| Component | Customer baseline |
|---|
| Host OS | Supported Ubuntu LTS, Debian, RHEL, or Amazon Linux release receiving security updates |
| Container runtime | Current supported Docker Engine and Docker Compose plugin from the official repository |
| PostgreSQL | PostgreSQL 17.10+ or 18.4+ on a supported minor release |
| Application runtime | Supplied container with Node.js 24 LTS |
| TLS | Customer-controlled RSA 4096-bit certificate and private key; TLS 1.2 or newer |
| Browser | Current managed Chrome, Edge, Firefox, or Safari |
Obtain and Verify the Authorized Release
- Complete onboarding in the Project X IT client portal.
- Obtain the versioned package or container-registry entitlement, release manifest, hashes, image digest, release notes, and SBOM artifacts.
- Verify the package hash and container digest before extracting or pulling the release.
- Review the SBOM and release notes under the customer software-acceptance process.
- Store the release artifacts in an approved internal repository.
Do not substitute the tag latest, an unversioned archive, or an image from an unapproved registry.
Network Flows
| Source | Destination | Purpose |
|---|
| Managed user networks | Workbench TCP 443 | Authenticated portal access |
| Workbench | Customer PostgreSQL TCP 5432 | Encrypted database connection |
| Workbench | Approved identity, ERP, scanner, and cloud APIs TCP 443 | Read-only connectors selected by the customer |
| Collectors | Workbench TCP 443 | Token-authenticated evidence upload |
| Workbench | Approved SMTP relay | Account recovery and notifications |
| Customer administrators | Project X IT account portal TCP 443 | Hosted billing, license request, and renewal |
Block direct Internet access to PostgreSQL. Restrict connector egress to approved provider endpoints.
Secrets and Certificates
- Generate a unique database password with at least 32 random characters.
- Generate
ZTBIA_TENANT_RECOVERY_SECRET from at least 32 random bytes. - Store secrets in a customer-approved secrets manager or root-restricted file.
- Install the RSA 4096-bit certificate as
deployment/tls/server.crt. - Install the matching private key as
deployment/tls/server.key. - Restrict private-key and license-file access to the service account.
- Never commit
.env, license.json, database passwords, or private keys.
License Registration
- Sign in to the Project X IT client portal.
- Open Billing and select an enabled provider.
- Complete checkout on the provider-hosted page.
- Wait for the server-confirmed payment result.
- Request the 30-day trial or contracted license.
- Save the downloaded file as
config/license.json. - Mount the file read-only at
/run/secrets/projectxit-workbench-license.json.
Customer evidence and payment credentials are not sent through the licensing exchange.
Container Stack
cd deployment
cp .env.example .env
# Replace every placeholder and pin the authorized release version or digest.
docker compose config
docker compose pull
docker compose up -d
docker compose ps
docker compose logs --tail=100 app
Open the configured WORKBENCH_PUBLIC_ORIGIN, create the first local owner through the protected setup flow, enroll MFA, and complete the acceptance checklist before enabling imports.
Customer-Managed PostgreSQL
- Provision PostgreSQL in the customer database platform.
- Enable encryption at rest with customer-controlled keys where available.
- Create a privileged schema-setup role and a separate least-privilege runtime role.
- Apply the SQL files in numeric order.
Windows:
.\scripts\apply_schema.ps1 -DatabaseUrl "postgresql://setup_user:password@db.example.com:5432/projectxit_workbench"
Linux:
./scripts/apply_schema.sh "postgresql://setup_user:password@db.example.com:5432/projectxit_workbench"
- Configure
DATABASE_URL for the runtime role and require encrypted transport. - Start the external-database stack:
docker compose -f docker-compose.external-db.yml config
docker compose -f docker-compose.external-db.yml pull
docker compose -f docker-compose.external-db.yml up -d
Acceptance Checklist Before Real Data
- Release hash, image digest, signature, and SBOM reviewed.
- Supported OS, runtime, database, and proxy versions documented.
- TLS chain and RSA 4096-bit private-key custody validated.
- MFA enrolled for every real administrator.
- PostgreSQL encryption, least privilege, backup, and restore test completed.
- Firewall rules and connector egress reviewed.
- Audit logging, time synchronization, retention, alerting, and incident contacts configured.
- License validity and employee limit confirmed.
- Login, logout, session refresh, import authorization, tenant access, and evidence export smoke tests passed.
- Acceptance record approved by the customer system owner and security owner.