Deploying

The server, its image, the Helm chart and the install scripts come with the Self-hosted licence. On the hosted service there's nothing to deploy.

ALIAS runs as one deployment per tenant: each customer or organisation gets its own server and its own database, and shares nothing with any other. Within a deployment, a tenant can run as many products as it likes.

Nothing is ever run inside a container to set ALIAS up. The database schema is created and migrated at start, products come from the configuration file or the panel, and the first administrator is whoever holds the instance's role at your OpenID Connect provider.

Configuration

Everything except the products can be set in the environment, and the environment wins over the file. A container's whole configuration can be environment variables, with products made on the panel.

Variable
ALIAS_DATABASE_URL	the Postgres URL. Unset: in memory, gone when the server stops
ALIAS_CONFIG	the configuration file, if there is one
ALIAS_LISTEN	the address to serve on (:8080)
ALIAS_TRUST_PROXY	take the client's address from X-Forwarded-For (true, false)
ALIAS_PUBLIC_URL	where browsers reach it (https://support.example.com): the sign-in returns to /auth/callback there
ALIAS_SESSION_KEY	seals the panel's sessions: openssl rand -base64 32, the same on every replica
ALIAS_ADMIN_ISSUER, ALIAS_ADMIN_CLIENT_ID	the panel's OpenID Connect provider, and its client
ALIAS_ADMIN_CLIENT_SECRET	the client's secret, if it's confidential
ALIAS_ADMIN_AUDIENCE	what an access token's aud must hold (the client id if unset)
ALIAS_ADMIN_ROLE_CLAIMS, ALIAS_ADMIN_PRESET	where the roles are (roles,groups if unset); keycloak for Keycloak's own places
ALIAS_ADMIN_INSTANCE_ROLE	the role that manages the instance (or grant permissions: alias:admin, alias:<product>:support)
ALIAS_METRICS_LISTEN	Prometheus metrics at /metrics on an address of their own (:9090)
OTEL_EXPORTER_OTLP_ENDPOINT	send OpenTelemetry traces to a collector over OTLP/HTTP
ALIAS_ENV_FILE	a file of these, one KEY=value a line
ALIAS_LOG_FILE	write the log there instead of to standard output

Remote assistance

Remote assistance needs a relay, swsrs, which you run yourself beside ALIAS: one relay per deployment. It's free (MIT), one program or the image ghcr.io/emdzej/swsrs. Deploy it as its own guide describes:

• Quickstart: the program or the image, signed in to your OpenID Connect provider;
• Your provider (Keycloak): the swsrs:session:* scopes and the relay's audience;
• TLS and CORS: allow the panel's origin, since the panel views a screen straight over the relay;
• Configuration: every setting.

Then give ALIAS a service account at your provider, with the three scopes, and point ALIAS at the relay:

Variable
ALIAS_REMOTE_RELAY	the relay (https://relay.example.com); devices and the panel dial wss:// on the same host
ALIAS_REMOTE_CLIENT_ID, ALIAS_REMOTE_CLIENT_SECRET	ALIAS's service account (client credentials)

With no relay, remote assistance is off. On the hosted service, the relay is ours.

Monitoring

Prometheus metrics come from a port of their own, never the public one: requests by route, reports and answers per product, open live streams, webhook outcomes and the database pool. OpenTelemetry traces follow each request through its queries and webhook deliveries. Neither ever carries a path, a user or ticket id, an address or a user agent, so watching the service doesn't watch its users. The Helm chart has a ServiceMonitor for the Prometheus Operator.

Kubernetes

The Helm chart runs two replicas with probes, a disruption budget and a spread over nodes. Give it a database, either as a URL or as a Secret you already have, plus your OpenID Connect provider and an ingress.

helm install acme oci://ghcr.io/emdzej/charts/alias-support \
  --namespace alias-acme --create-namespace \
  --set database.existingSecret.name=acme-pg-app \
  --set admin.issuer=https://auth.example.com/realms/acme

Answers reach users over server-sent events, so the ingress mustn't buffer them. With ingress-nginx, set nginx.ingress.kubernetes.io/proxy-buffering: "off".

Docker Compose

deploy/compose runs ALIAS with its own Postgres. Copy .env.example to .env, fill it in, and run docker compose up -d. For another tenant, use another project: docker compose -p tenant-b --env-file tenant-b.env up -d.

On a server

The install scripts set ALIAS up as a service on Linux (systemd), macOS (launchd) or Windows. Each instance is a tenant with its own configuration directory and port. You provide Postgres and a reverse proxy with TLS.

sudo ./install.sh --version 0.1.0 --instance acme --port 8081

.\install.ps1 -Version 0.1.0 -Instance acme -Port 8081

Fill in the instance's alias.env and start the service. Running the script again updates the program and leaves your configuration alone.