Installation

Overview

The central platform (backend, frontend, Icinga 2, PostgreSQL, VictoriaMetrics, ClickHouse, Redis, Zeek, and Caddy) is deployed as a single Docker Compose stack. The production compose file uses the pre-built Eon Aethis images, keeps internal services off the host network (only Caddy’s ports are published), and reads all credentials from .env with no built-in defaults for secrets.

The Aethis Agent, Aethis Probe, and Perimeter Probe are installed separately on the hosts and networks they observe — see Agents & Probes.

Prerequisites

• Docker Engine with the Compose plugin (docker compose version works)
• A host that can reach the internet for Let’s Encrypt (if not using self-signed or a supplied certificate)
• Inbound access on the ports Caddy publishes (443/80 by default)

Installation

Eon Aethis ships as a package containing the Docker images (images.tar), docker-compose.yml, install.sh, upgrade.sh, and .env.example. On the target server:

tar xzf eonaethis-<tag>.tar.gz
cd eonaethis
./install.sh

install.sh loads the bundled images, installs the shipped docker-compose.yml (only if one doesn’t already exist — it never overwrites an existing install), and creates .env from .env.example if missing. It then stops and tells you to edit .env before starting the stack; at minimum, set:

• POSTGRES_PASSWORD
• JWT_SECRET (generate with openssl rand -hex 32)
• ICINGA2_API_PASSWORD
• CLICKHOUSE_PASSWORD
• SMTP_FROM
• CADDY_DOMAIN

Alternatively, run setup.sh for an interactive wizard that prompts for domain/TLS, email, the Anthropic API key, the network interface, and the admin account, and writes .env for you. Set CLICKHOUSE_DB, CLICKHOUSE_USER, and CLICKHOUSE_PASSWORD in the generated .env before starting the stack.

Once .env is filled in:

docker compose up -d

See Configuration for the full list of environment variables, and Configuration — First-boot admin account for creating the initial admin user.

Zeek interface

ZEEK_INTERFACE defaults to eth0; set it in .env to the interface you want Zeek to sniff. The zeek service runs with network_mode: host and needs NET_RAW/NET_ADMIN, so it sees the host’s real interfaces rather than a Docker bridge.

Ports

By default Caddy is the only service that binds host ports:

Override CADDY_HTTPS_PORT/CADDY_HTTP_PORT when another reverse proxy on the host already owns 443/80. All other services (backend, icinga2, postgres, victoriametrics, redis, zeek, clickhouse) are reachable only on the Compose network, not the host.

TLS

Caddy handles TLS for the platform, in one of three modes set via CADDY_TLS:

1. Self-signed (default): CADDY_TLS=internal.
2. Let’s Encrypt: leave CADDY_TLS empty and set CADDY_DOMAIN to a publicly resolvable domain, with port 80 reachable for the ACME challenge.
3. Your own certificate: CADDY_TLS="/etc/caddy/certs/fullchain.pem /etc/caddy/certs/privkey.pem" and point CADDY_CERTS_DIR at the directory containing those files on the host (mounted read-only into the container at /etc/caddy/certs).

Verifying the install

docker compose ps
curl -k https://localhost/health

The backend’s healthcheck depends on PostgreSQL, Icinga 2, VictoriaMetrics, and ClickHouse all reporting healthy first, so docker compose ps showing backend as healthy implies the whole storage/monitoring layer came up correctly.

Upgrading

tar xzf eonaethis-<newer-tag>.tar.gz
cd eonaethis   # same directory as the existing install
./upgrade.sh

upgrade.sh loads the new images, backs up the current docker-compose.yml and .env to a timestamped .upgrade-backup-* directory, adds any new env vars introduced since your last install (with defaults), shows a diff against the shipped compose file for manual merging if your live file has diverged, then runs docker compose up -d. Database migrations are applied automatically by the backend on startup, and the script waits for /health to go green before finishing.