Installing Aetheus

Three routes lead to the same running product. Pick the one that matches how you already operate services, then put the result behind a reverse proxy.

Choosing a method

Method	Good when	You provide
Binaries, without Docker	You run .NET services directly, or Docker is not an option on the host.	.NET runtime, PostgreSQL, a service manager, a web server for the frontend files.
Docker	You want the shortest path, and one command to upgrade.	Docker Engine with the Compose plugin.
Aetheus pipeline	You already run one Aetheus and want it to build and deploy the next one.	A running Aetheus, a registered agent on the target host, Docker on that host.

Prerequisites shared by every method

Two host names

The frontend and the backend are served from two distinct host names, for example app.example.com and api.example.com. Both must resolve to the machine and both must be covered by your TLS certificate. Serving both from one host name is not a supported layout.

PostgreSQL

An empty database and a user that owns it. The backend creates its own schema on first start by applying its migrations, so there is nothing to import beforehand.

Four secrets

These are inputs to the installation, not values the product invents for you. Generate them once, store them where you keep secrets, and never regenerate them on an existing installation.

Setting	Purpose	Regenerating it
`Auth__JwtKey`	Signs session tokens.	Logs everyone out.
`Auth__EncryptionKey`	Encrypts stored secrets, including vault values.	Makes existing vault values undecryptable.
`Auth__EncryptionSalt`	Salt paired with the encryption key.	Same as above.
`Auth__AdminPassword`	Password of the initial administrator account.	Safe to change; it is a password, not a key.

On Linux, a workable way to produce the first three:

openssl rand -base64 48

On Windows PowerShell:

[Convert]::ToBase64String((1..48 | ForEach-Object { Get-Random -Maximum 256 }))

A reverse proxy

Aetheus does not terminate TLS. Whichever installation method you choose, finish with one of:

Apache - the configuration Aetheus runs in production.
IIS untested
nginx untested

After the first start

Open the app host and sign in as admin with the password you set in Auth__AdminPassword.
Change that password from the account menu. The value in configuration seeds the account; it is not meant to stay in use.
Create a project, then register your first server: the app walks you through downloading the agent archive and generating a one-time registration token.
Check /health/ready on the API host. It answers 200 only when the database is reachable, which makes it the honest probe for "is this instance usable".

What to back up

Whatever the method, a restorable backup covers the PostgreSQL database plus three directories: the Git repositories, the artefacts, and the data-protection keys. The architecture page lists what losing each one costs you.