Docs / Install / On-prem

Install: on-prem

Run the whole pipeline inside your own infrastructure. Your build activity stays in your network; Protet only issues the signed detection bundle and the license your deployment verifies offline.

Availability. A new self-serve account is on the free cloud plan. On-prem accounts are set up by us, and the pipeline images and the Helm chart are provided to those deployments, not published publicly. If you want to run on-prem, write to hello@protet.io. This page shows how to fetch what your deployment needs.

What you receive
Fetch the bundle, license and public keys
Deploying the pipeline

What you receive

Item	What it is	Where it comes from
Pipeline images and Helm chart	The services that collect, window, evaluate and deliver findings.	Provided by us when your on-prem account is set up.
Pull token	A secret that authorises downloading your bundle. Used as `MODEL_BUNDLE_KEY`.	Dashboard, Pull tokens (on-prem accounts only), or `POST /portal/pull-tokens`.
Signed detection bundle	A `bundle.tar.gz` with a signed manifest. Your deployment verifies the signature before loading it.	`GET /v1/bundle` (the URL is `MODEL_BUNDLE_URL`).
`license.json`	An Ed25519-signed license, verified offline. An expired license makes the services refuse to start.	Dashboard, Download license.json, or `GET /v1/license`.
Public keys	The keys that verify the bundle and the license. They are public.	`GET /v1/public-keys`, no authentication.

Fetch the bundle, license and public keys

Set your pull token and download. The first request for a new bundle version returns 202 while it is built; the loop below repeats until the file arrives. Stop it with Ctrl-C if it keeps failing, and see Troubleshooting.

export MODEL_BUNDLE_URL=https://protet.io/v1/bundle
export MODEL_BUNDLE_KEY="<your pull token>"

until [ "$(curl -sL -o bundle.tar.gz -w '%{http_code}' \
    -H "x-license-key: $MODEL_BUNDLE_KEY" "$MODEL_BUNDLE_URL")" = 200 ]; do
  echo "bundle not ready (or request failed), retrying in 30s"; sleep 30
done
mkdir -p bundle && tar xzf bundle.tar.gz -C bundle

Get the license from the dashboard (Download license.json), or with a logged-in session token (see Quickstart for how to obtain one):

curl -fL -H "Authorization: Bearer $TOKEN" https://protet.io/v1/license -o license.json
mkdir -p license && mv license.json license/

Read the two public keys you will configure:

curl -s https://protet.io/v1/public-keys \
  | python3 -c 'import sys, json; d = json.load(sys.stdin); print("BUNDLE_PUBLIC_KEY=" + d["bundle"]); print("LICENSE_PUBLIC_KEY=" + d["license"])'

Air-gapped: do these downloads on a connected machine, then copy bundle/, license/ and the two key values to the isolated environment. Nothing else needs to leave or enter it.

Deploying the pipeline

The pipeline images, the Helm chart and the deployment steps for your environment are handed over with your on-prem account, so they match the version you were given. To plan ahead, every setting that takes the bundle, the license and the two public keys is listed in the Configuration reference (environment variables and Helm values). With license enforcement on, the services refuse to start on an expired license.

Questions before you are set up: hello@protet.io.