tiCrypt 2.17.11

Deploy & Operate

System AdministratorRequires: Shell access to the tiCrypt backend hosts

Deploy & Operate enables you to install the tiCrypt backend, configure the services it is composed of, and keep the deployment healthy. It covers the layer beneath the application: the hosts, the microservices, the mail path, and the TLS termination that everything else depends on.

This is the only part of the documentation that assumes shell access to the servers. Everything a researcher or an administrator does happens through the browser; everything here happens through the operating system.

◆Why operating the platform grants no access to its data

Running the backend does not mean being able to read what it stores. tiCrypt encrypts file and drive contents with keys held by users, not by the server, so an operator with full root on every backend host still cannot decrypt research data. That property is what allows the platform to be operated by staff who are outside the compliance boundary of the data it holds.

Deploy & Operate contains the following functionality

• Components: every package in the tiCrypt repository, what it does, and how to install it.
• Architecture: an interactive map of a deployment and how its parts reach each other.
• Network: the three VLANs, the bridges that carry them across hosts, and the single exit point.
• Installation: prepare the environment, then deploy the backend with the Ansible-based installer.
• Backend Services: the architecture of the backend microservices and the full configuration reference for each.
• Operations: monitor system services, manage API keys, configure external SFTP servers, and run the offline Python package mirror.
• Inboxes: let outside senders deliver files into a user's Vault, through a browser link or over SFTP.
• NGINX & TLS: reference configuration and TLS verification for the reverse proxy.

Standing up a new deployment

Step	Action	Guide
1	Prepare the environment: hardware, operating system, network, DNS, and TLS	Pre-Installation Checklist
2	Install the backend with the Ansible installer	Install Guide
3	Configure the services: review every service's settings against the reference	Configuration
4	Terminate TLS: put NGINX in front and verify the certificate chain	NGINX & TLS
5	Prepare VM images so researchers have something to boot	Building VM Images
6	Configure governance: settings, teams, profiles, and escrow	Governance
7	Deploy audit if you need retained evidence	Audit Service

Installation

Prepare the environment, then deploy the backend with the Ansible-based installer.

Backend Services

Architecture overview and configuration reference for the backend microservices.

Network

The three VLANs, the bridges across hosts, and the single exit point.

Operations

System services, API keys, external SFTP, and the offline Python package mirror.

Inboxes

Let outside senders deliver files into a Vault, by browser link or SFTP.

NGINX & TLS

Reference configuration and TLS verification for the reverse proxy.

Config Reference

Every configuration parameter across all backend services, searchable.

Deep dives

These articles explore the infrastructure architecture underlying the components you deploy.

• Infrastructure Overview: components, connectivity, and deployment options.
• VM Network Isolation: how tiCrypt isolates virtual machines at the network level.
• OpenVSwitch Networking: the network architecture based on OpenVSwitch.
• Libvirt Storage Pools: network block devices over iSCSI and Ceph RBD.

Related

• Provisioning: set up the VM images and hardware setups that run on this infrastructure.
• Monitoring & Audit: deploy and use the audit platform.
• From Shared Computing Cluster to tiCrypt: how this architecture differs from a traditional HPC environment.
• VM Roles and Permissions: why operating the platform does not confer access to VMs.