Keycyte PAM 3.2 · Deployment Guide
Preparing the Installation Package
Before you run the installer, copy the installation package to the Keycyte PAM host and add the certificate files to it.
Package Contents
The installation package is one folder with the following files:
| File | Description |
|---|---|
install.sh | Installer script. |
docker-compose.yml | Docker Compose file that defines the containers. |
.env | Environment file with the settings and secrets of the deployment. The installer adds the values it collects to this file. |
keycyte-pam.tar.gz | Archive with the container images of the PAM server, SSH proxy, Password Manager, RADIUS server and gateway (guacd). |
initdb/10-master-user.sql | Script that creates the first administrator account (master). |
localhost.p12 | PKCS#12 keystore for HTTPS. It can be delivered with the package, or you add your own. |
Note
.env is a hidden file. Use ls -la to see it. The installer stops if .env, docker-compose.yml or keycyte-pam.tar.gz is missing.
Warning
The .env file contains the database password, the encryption key for stored secrets, the session secret and the service access keys. Restrict access to it (for example chmod 600 .env), and keep a secure copy outside the host. Without the encryption key, encrypted data in the database and in backup files cannot be decrypted.
Preparing the Package
To prepare the installation package:
-
Copy the installation package folder to the Keycyte PAM host, for example to the home directory of the user who will run the installer.
The host directories (
~/keycyte,~/drive,~/record) are created in the home directory of the user who runssudo ./install.sh, not in the home directory ofroot. -
Copy the certificate files to the package folder, next to
install.sh:localhost.p12— the PKCS#12 keystore for HTTPS (if you use your own instead of the delivered one);cacerts.pem— the CA certificates for LDAP over TLS;keycyte-ca.crt— optional.
For details, see Certificates.
-
If you use your own
localhost.p12, make sure that its password matches the keystore password in.env(TLS_KEYSTORE_PASSWORD). -
Check the time zone in
.env(TZ), for exampleTZ=Europe/Istanbul. -
If the host has no internet access, load the PostgreSQL image on the host:
docker load -i postgres-17.tarThe image must be available as
postgres:17. You can create the archive on a host with internet access withdocker pull postgres:17anddocker save -o postgres-17.tar postgres:17. -
Make the installer executable:
chmod +x install.sh
The package is ready. Continue with Running the Installer.