On-Premises Edition Setup Guide

About this guide

This guide walks through installing the Power Viewer on-premises album database (the “on-premises edition”) on your own server.

Audience: the engineer building the server (such as your IT department). Linux command-line work is involved.

To see where the on-premises edition sits in the overall layout, see System Layout & Where Things Live. If you are still choosing between deployments, start there.

Estimated time: about one hour once the prerequisites are in place.

For the post-install acceptance testing (IQ/OQ) see Acceptance Validation Guide; for day-to-day administration see the Admin Console Guide.

1. Prerequisites

Not sure how to obtain the items in this table? Start with the Server Preparation Guide, which covers provisioning the server, installing Ubuntu, installing Docker, DNS registration and obtaining a TLS certificate — with no prior Linux experience assumed.

Tip: if Docker is not installed yet, use the official repository build (distribution packages can be outdated).

curl -fsSL https://get.docker.com | sudo sh

2. What to prepare in advance

Important: the server licence’s customer_company_keys and the Power Viewer licence key’s companyKeys must be issued for the same customer. If they do not match, setup aborts as a safety measure.

3. Extract and verify the distribution

Place the archive in a working directory (e.g. /opt/rad-onprem) and verify its integrity first.

sha256sum power-viewer-remotealbumdb-onprem-<version>.zip

Confirm the value exactly matches the one in the SHA-256 file (.zip.sha256) downloaded from the member portal, then extract:

unzip power-viewer-remotealbumdb-onprem-<version>.zip -d /opt/rad-onprem
cd /opt/rad-onprem
sha256sum -c CHECKSUMS.txt

Every line must report OK. Then load the bundled container images:

docker load < images/rad-onprem-images-<version>.tar

4. Site configuration (onprem.env)

All configuration lives in a single file, onprem.env. Copy the template and edit it:

cp onprem.env.example onprem.env

At minimum, set the following keys (see the comments inside the template for details):

Both verification public keys (server-license-pub.pem / power-viewer-pub.pem) are bundled in the archive and work with the default settings.

Note (editing while running): onprem.env is mounted directly into the running container. sed -i and editors that save by writing a new file and swapping it will NOT reach the container. After editing, always run docker compose --env-file onprem.env restart app.

5. Install the TLS certificate

mkdir -p certs
cp <your certificate> certs/tls.crt
cp <your private key>  certs/tls.key
chmod 600 certs/tls.key

Confirm the certificate CN matches the FQDN and it has not expired:

openssl x509 -in certs/tls.crt -noout -subject -dates

6. Run first-boot setup

./scripts/setup.sh

The script performs the following automatically (it is safe to re-run):

1. Start the three containers (database / application / web server)
2. Generate the encryption key (appended to onprem.env)
3. Initialise the management and album databases
4. Verify and register both licences (including the customer-key cross-check)
5. Create the initial administrator and initial user

Setup succeeded when the last line reports ✓ Setup complete. with exit code 0. A full log is kept at backups/logs/setup-<timestamp>.log.

7. Verify the installation

1. Open https://<FQDN>/admin-console/login in a browser and confirm the login page above renders
2. Confirm http://… access redirects automatically to https://…
3. Log in with INITIAL_ADMIN_USERNAME / INITIAL_ADMIN_PASSWORD → the password-change page appears; set a new password
4. After the password change the dashboard appears; confirm every sidebar menu (Dashboard / db_registry / Backups / Administrators / Audit log / Server licence) opens

8. Schedule daily backups

Register the daily backup in root’s crontab (root is required — the script writes to backups/logs/, which is root-owned):

sudo crontab -e

0 3 * * * /opt/rad-onprem/scripts/backup-cron.sh

Run it once manually and confirm two dumps (management DB / album DB) appear under backups/:

sudo ./scripts/backup-cron.sh

Store a copy of the auto-generated encryption.key value from onprem.env in a safe place off the server (a physical safe, etc.). Losing this key makes stored connection secrets unrecoverable.

9. Next steps

• For GxP acceptance testing: follow the Acceptance Validation Guide to run IQ/OQ
• For daily operation: Admin Console Guide / Operations Guide
• Power Viewer client connection: in the client’s album-database settings, choose the on-premises database, then set https://<FQDN> and the Power Viewer licence key