Deployment & Operations

Antemure meets your fleet where it is: signed native installers per OS, Linux packages with systemd, a single-host Docker stack, Helm charts and a Kubernetes operator, or a source build. This page covers each method, how endpoints enroll into the hub, updates, and the ports involved.

Ports: daemon 18900 (admission TLS 8443), hub 18901, SOAR 18902, MCP 18902. SOAR dependencies: Postgres 5433→5432, Temporal 7233 (UI 8233). Endpoints need no inbound ports — they dial the hub outbound.

Native installers (macOS / Linux / Windows)

The shell/PowerShell installers place the binaries, write ~/.antemure/config.yaml, and register a self-healing background service.

# macOS / Linux  (launchd agent / systemd service + watchdog timer)
sudo ./scripts/install.sh [--daemon-only] [--no-soar] [--enroll <hub_url> --token <join>] [--license cp_...]
#   binaries -> /usr/local/bin ; config/data -> ~/.antemure ; daemon :18900
#   Linux also installs antemure-watchdog.timer (restarts the daemon if killed)

# Windows  (run as Administrator; NSSM service or Scheduled Task)
powershell -ExecutionPolicy Bypass -File scripts\install.ps1 [-DaemonOnly] [-SkipService]
#   binaries -> %ProgramFiles%\Antemure\bin ; config -> %USERPROFILE%\.antemure

On a licensed engagement these ship as signed .dmg (macOS), .AppImage (Linux) and .exe (Windows) bundles for x86_64 and arm64, with a deployment runbook. Verify with the local console at http://localhost:18900/.

Linux packages (`.deb` / `.rpm`)

Two packages, built with nfpm from static musl binaries (run on any distro, no glibc/OpenSSL dependency):

antemure (endpoint) — installs antemure-daemon to /opt/aura-cyber/bin, config to /etc/antemure/config.yaml, and the antemure-daemon.service systemd unit (:18900). It auto-starts once /etc/antemure/antemure.env has an enrollment URL + token.
antemure-hub — installs antemure-hub, antemure-soar and antemure-mcp to /opt/aura-cyber-hub/bin, the dashboard UI, and antemure-hub.service (:18901). SOAR is not auto-started (it needs Docker — run install-soar.sh).

sudo apt install ./antemure_0.3.16_amd64.deb      # or: rpm -i antemure-0.3.16.x86_64.rpm
sudo editor /etc/antemure/antemure.env            # AURA_ENROLL_URL, AURA_ENROLL_TOKEN
sudo systemctl enable --now antemure-daemon

SOAR bundle (on the hub host)

scripts/install-soar.sh stands up SOAR's dependencies on the hub box, idempotently: installs Docker if missing, runs Postgres 16 (127.0.0.1:5433, split roles) and Temporal (:7233, namespace aura-soar) as containers, applies migrations, installs antemure-soar as a systemd unit on :18902 with secrets generated into /etc/antemure/soar.env (0600), and patches the hub unit with the SOAR URL + proxy secret so /api/soar proxying works. --uninstall keeps data; --purge removes volumes.

Docker Compose

deploy/compose/ is a single-host, production-shaped control plane: Postgres, Temporal (+UI on :8233), SOAR, the hub (:18901) and a demo endpoint (:18900).

cd deploy/compose
cp .env.example .env        # CHANGE EVERY SECRET
docker compose --env-file .env up -d --build
# hub :18901 · SOAR :18902 · Temporal UI :8233 · endpoint :18900
docker compose --env-file .env down -v   # teardown

Prerequisites: Docker 24+ / Compose v2, ~8 GB RAM. The root compose.yaml is a developer fleet (make dev-up) with the same pieces plus a mock-integrations service.

Kubernetes — Helm

Three charts under deploy/helm/:

antemure (umbrella) — the complete product: control plane (aura-soar subchart: hub, SOAR, Postgres, Temporal) + agents (antemure-k8s subchart). Hub Service is pinned to antemure-cp-hub and agents enroll into it with a shared join token.
```
helm dependency build deploy/helm/antemure
helm install antemure deploy/helm/antemure -n antemure --create-namespace \
  --set antemure-k8s.clusterId=<cluster-id> \
  --set aura-soar.images.hub.repository=<reg>/antemure-hub ...
```

antemure-k8s (agents only) — a privileged node-sensor DaemonSet (one antemure-daemon per node, mounts the CRI socket + host paths) and a cluster-agent Deployment with the admission webhook.

helm install antemure deploy/helm/antemure-k8s -n antemure --create-namespace \
  --set clusterId=prod-use1 \
  --set hub.url=https://cyber.secureinsights.ai \
  --set enrollment.token=<join-token-from-hub>

aura-soar (control plane only) — hub + SOAR + Postgres + Temporal + UI, with opt-in production hardening (external DB/Temporal, ingress + TLS, NetworkPolicy, PDB, HA, nightly backup).

Images are referenced by repository/tag; on single-node clusters whose runtime is the host docker daemon you can build locally and set imagePullPolicy accordingly. For CRI-O/Docker runtimes, point the sensor at the right socket (--set nodeSensor.criSocket=…).

Kubernetes operator (`AntemureCluster`)

A lightweight operator reconciles an AntemureCluster custom resource (group antemure.ai/v1alpha1) into the antemure-k8s release — one CR ↔ one Helm release, with scoped RBAC (not cluster-admin).

kubectl apply -f deploy/operator/crd/antemurecluster-crd.yaml
kubectl apply -f deploy/operator/deploy/operator.yaml
kubectl apply -f examples/antemurecluster-sample.yaml

Build from source

Prerequisites: Rust 1.94+, a C toolchain and the usual build deps (clang cmake libssl-dev protobuf-compiler pkg-config), and Node 22 to build the SOAR visual builder. SQLite is bundled; TLS is rustls.

make build      # debug
make release    # cargo build --release --all-targets
make test       # cargo test --all-targets
make install    # release build + scripts/install.sh
make docker     # build the container images
make dist       # cargo-dist bundles into target/distrib/

Fleet enrollment

Endpoints self-enroll outbound-only. Grab a hub URL + join token from the dashboard's Fleet → Add a node page, then use any of:

One-liner: curl -fsSL <hub>/install.sh | sudo sh -s -- --enroll <hub> --token <tok>.
Golden image / MDM: bake ~/.antemure/antemure-enroll.json ({hub_url, join_token}, 0600) — scripts/enroll-fleet.sh emits it and can SSH-loop an install across a host list.
Package: set AURA_ENROLL_URL+AURA_ENROLL_TOKEN in /etc/antemure/antemure.env and start the service.
Kubernetes: the DaemonSet gets the enroll URL + token from a Secret; the token must match the hub's join token.

Confirm the node appears within ~30 s: curl -s <hub>/api/endpoints. See Tokens, Auth & RBAC for the enrollment protocol.

Updates & rollback

Antemure self-updates from the control plane via a delta mechanism: it checks for a newer release, downloads only the components whose hash changed, verifies checksums, installs and restarts services — with version-pin and rollback. Drive it fleet-wide from the dashboard's Settings → Updates (Update now / Update fleet), or per host via the updater script.