You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
|[One-line script](../getting-started/one-line-install.md)|:green\_circle: Easy, single command installation |:x: Doesn't follow the [recommendations](hardware-os-network-and-firewall-recommendations.md)| For testing purposes only |
51
-
|[Standalone packages](standalone-package-based-installation.md)|:green\_circle: Easy, using apt and dpkg |:white\_check\_mark: If you followed the [recommendations](hardware-os-network-and-firewall-recommendations.md)| Small to medium deployment |
52
-
|[Docker Compose](docker-compose.md)|:yellow\_circle: Medium, Docker knowledge required |:white\_check\_mark: If you followed the [recommendations](hardware-os-network-and-firewall-recommendations.md)| Small to medium deployment |
53
-
|[Kubernetes](kubernetes.md)|:red\_circle: Advanced, requires a k8s cluster and administrator |:white\_check\_mark: If you followed the [recommendations](hardware-os-network-and-firewall-recommendations.md)| Large or enterprise deployments |
54
-
|[Terraform](terraform.md)|:red\_circle: Advanced, requires an AWS account and knowledge |:white\_check\_mark: | Large or enterprise deployments |
55
-
|[AMI and AWS CloudFormation](amis-and-aws-cloudformation.md)|:red\_circle: Advanced, requires an AWS account and knowledge |:white\_check\_mark: | Large or enterprise deployments |
44
+
| Strategy name | Difficulty | Production readiness | Purpose |
|[One-line script](../getting-started/one-line-install.md)|:green\_circle: Easy, single command installation |:x: Doesn't follow the [recommendations](hardware-os-network-and-firewall-recommendations.md)| For testing purposes only |
47
+
|[Standalone packages](standalone-package-based-installation/)|:green\_circle: Easy, using apt and dpkg |:white\_check\_mark: If you followed the [recommendations](hardware-os-network-and-firewall-recommendations.md)| Small to medium deployment |
48
+
|[Docker Compose](docker-compose.md)|:yellow\_circle: Medium, Docker knowledge required |:white\_check\_mark: If you followed the [recommendations](hardware-os-network-and-firewall-recommendations.md)| Small to medium deployment |
49
+
|[Kubernetes](kubernetes.md)|:red\_circle: Advanced, requires a k8s cluster and administrator |:white\_check\_mark: If you followed the [recommendations](hardware-os-network-and-firewall-recommendations.md)| Large or enterprise deployments |
50
+
|[Terraform](terraform.md)|:red\_circle: Advanced, requires an AWS account and knowledge |:white\_check\_mark: | Large or enterprise deployments |
51
+
|[AMI and AWS CloudFormation](amis-and-aws-cloudformation.md)|:red\_circle: Advanced, requires an AWS account and knowledge |:white\_check\_mark: | Large or enterprise deployments |
Copy file name to clipboardExpand all lines: deployment-strategies/standalone-package-based-installation/README.md
+17-11Lines changed: 17 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,11 +7,11 @@ This guide will walk you through the process of installing and running Defguard
7
7
We will cover system requirements, additional dependencies, installation steps, and examples of configuration files and step by step running all services. In this example we will use NGINX for a web server (proxy) exposing and securing web based services.
8
8
9
9
{% hint style="info" %}
10
-
Make sure you understand [Defguard's architecture](../in-depth/architecture/), especially the division into the main components: Core, Proxy, Gateway.
10
+
Make sure you understand [Defguard's architecture](../../in-depth/architecture/), especially the division into the main components: Core, Proxy, Gateway.
11
11
{% endhint %}
12
12
13
13
{% hint style="warning" %}
14
-
This is a simple guide installing all components on a single server. For production make sure your infrastructure is prepared by following our [recommendations](hardware-os-network-and-firewall-recommendations.md).
14
+
This is a simple guide installing all components on a single server. For production make sure your infrastructure is prepared by following our [recommendations](../hardware-os-network-and-firewall-recommendations.md).
15
15
{% endhint %}
16
16
17
17
## System Requirements
@@ -25,7 +25,7 @@ Before proceeding with the installation, ensure your system meets the following
25
25
* Administrative (sudo) privileges.
26
26
* A server with a public IP address (and you know what that IP address is and to which interface it's assigned) - in this example we use: 185.33.37.51.
27
27
* You have a domain name and know how to assign IP and manage subdomains, in our example: Defguard main url will be _my-server.defguard.net_ (and the subdomain is pointed to 185.33.37.51).
28
-
* Defguard [enrollment service](https://defguard.gitbook.io/defguard/help/enrollment) (run by proxy) that will enable [remote onboarding, enrollment](https://defguard.gitbook.io/defguard/help/enrollment) and [easy configuration for our Desktop Clients (by adding Defguard instances)](../using-defguard-for-end-users/desktop-client/instance-configuration.md#adding-instance) with instance URL and one simple token - in this tutorial we use: _enroll.defguard.net_ (this subdomain also points to 185.33.37.51).
28
+
* Defguard [enrollment service](https://defguard.gitbook.io/defguard/help/enrollment) (run by proxy) that will enable [remote onboarding, enrollment](https://defguard.gitbook.io/defguard/help/enrollment) and [easy configuration for our Desktop Clients (by adding Defguard instances)](../../using-defguard-for-end-users/desktop-client/instance-configuration.md#adding-instance) with instance URL and one simple token - in this tutorial we use: _enroll.defguard.net_ (this subdomain also points to 185.33.37.51).
29
29
* If you have a **firewall**, we assume you have **open port 443** in order to expose both Defguard and enrollment service, but also to automatically issue for these domains SSL Certificates. Port 444 (used for internal GRPC communication) **should not be exposed public.**
30
30
* System clock is synchronized using Network Time Protocol (NTP). This is important for time-based one-time password (TOTP) codes.
31
31
@@ -61,6 +61,10 @@ defguard=# exit
61
61
62
62
## Installing packages
63
63
64
+
{% hint style="info" %}
65
+
Defguard also have public APT repository, if you want know how to set it up, follow [this guide](defguard-apt-repository.md).
66
+
{% endhint %}
67
+
64
68
### Core
65
69
66
70
You can find the URL to your package from the releases of the Core component on [GitHub](https://github.com/DefGuard/defguard/releases).
**If you have configured your postgres with different names than in**[**PostgreSQL guide**](standalone-package-based-installation.md#postgresql)**, you can change it in DB configuration part. LDAP configuration is not part of this tutorial, you can also commented those lines.**
273
+
**If you have configured your postgres with different names than in**[**PostgreSQL guide**](./#postgresql)**, you can change it in DB configuration part. LDAP configuration is not part of this tutorial, you can also commented those lines.**
268
274
269
-
**We will back to this configuration to connect Defguard core with proxy in the**[**Run proxy**](standalone-package-based-installation.md#run-proxy)**section. For now `DEFGUARD_PROXY_URL` is commented.**
275
+
**We will back to this configuration to connect Defguard core with proxy in the**[**Run proxy**](./#run-proxy)**section. For now `DEFGUARD_PROXY_URL` is commented.**
270
276
271
277
After changes, you can simply enable and start your Defguard core service:
272
278
@@ -302,7 +308,7 @@ To run gateway, we should do two things:
302
308
303
309
#### Setup location for gateway
304
310
305
-
Follow [this guide](gateway.md) for setting up the location in Defguard Core web interface. You should leave the guide with a token for your new Gateway instance and use it in the following configuration.
311
+
Follow [this guide](../gateway.md) for setting up the location in Defguard Core web interface. You should leave the guide with a token for your new Gateway instance and use it in the following configuration.
306
312
307
313
#### Create config file
308
314
@@ -403,7 +409,7 @@ On the other side, core service should print those informations:
403
409
404
410
### Proxy
405
411
406
-
To run proxy service (for [remote onboarding & enrollment](../using-defguard-for-end-users/enrollment/)), we can do it by:
412
+
To run proxy service (for [remote onboarding & enrollment](../../using-defguard-for-end-users/enrollment/)), we can do it by:
407
413
408
414
```
409
415
# on systems with systemd (like Debian, Ubuntu, Fedora/Red Hat Linux/SUSE)
@@ -430,7 +436,7 @@ Check the logs afterwards. Should look like this:
430
436
431
437
The reverse proxy acts as an intermediary between users and Defguard services, handling HTTPS requests, routing internal gRPC communication, and ensuring encrypted connections between all components.
432
438
433
-
Follow our additional guide on [configuring reverse proxy for for Core and Proxy service](reverse-proxy-configuration-using-nginx.md). After having the reverse proxy configured and running you can continue with this guide.
439
+
Follow our additional guide on [configuring reverse proxy for for Core and Proxy service](../reverse-proxy-configuration-using-nginx.md). After having the reverse proxy configured and running you can continue with this guide.
You can [configure your desktop client using the enrollment](../using-defguard-for-end-users/desktop-client/instance-configuration.md#adding-instance) service and use your VPN.
513
+
You can [configure your desktop client using the enrollment](../../using-defguard-for-end-users/desktop-client/instance-configuration.md#adding-instance) service and use your VPN.
508
514
509
515
If you would like to use the feature in the desktop client to route **All traffic** through the VPN please configure your firewall to enable Internet access through your VPN - [here you can find exaples how to do it](https://defguard.gitbook.io/defguard/tutorials/step-by-step-setting-up-a-vpn-server#enabling-to-access-internet-through-your-vpn).
510
516
@@ -523,7 +529,7 @@ After the installation please make sure that **only the following ports are open
523
529
* 50055
524
530
{% endhint %}
525
531
526
-
Also this setup provides only communication encryption between Defguard components, if you additionally like for core/proxy and gateway to have authorization - [please setup a custom SSL CA](grpc-ssl-communication.md#custom-ssl-ca-and-certificates).
532
+
Also this setup provides only communication encryption between Defguard components, if you additionally like for core/proxy and gateway to have authorization - [please setup a custom SSL CA](../grpc-ssl-communication.md#custom-ssl-ca-and-certificates).
527
533
528
534
## Upgrading packages
529
535
@@ -541,7 +547,7 @@ Also this setup provides only communication encryption between Defguard componen
541
547
# or Proxy package
542
548
pkg delete defguard-proxy
543
549
```
544
-
2. Install a newer version (as described [above](standalone-package-based-installation.md#installing-packages)).
550
+
2. Install a newer version (as described [above](./#installing-packages)).
sudo tee /etc/apt/sources.list.d/defguard.list > /dev/null
21
+
22
+
sudo apt update
23
+
```
24
+
25
+
Afterward running these commands, you can install and update Defguard via APT. 
26
+
27
+
After new release, simply use `sudo apt update` to update repository.
28
+
29
+
### Using pre-release builds
30
+
31
+
Defguard has two separate components on one APT repository, **release** and **pre-release.** If you want to install packages from pre-release, simply change `release` to `pre-release` in the installation steps described above, or run the following line.
0 commit comments