Skip to content

DEPLOY.md

Latest commit

 

History

History
212 lines (151 loc) · 7.89 KB

DEPLOY.md

File metadata and controls

212 lines (151 loc) · 7.89 KB
Raw

Deployment Guide — EAS Sentinel XDR

Publish the platform to the internet so it opens on any device, anywhere, with a permanent link. Free tier, roughly 20 minutes, no prior experience needed.

Developed & Engineered by: Abdualrhman Auqla Alanazi

What you will end up with
Console link https://sentinel-console.onrender.com — works on iPhone, laptop, anywhere
Runs 24/7, even when your laptop is off
Cost Free tier
On iPhone Installs to the home screen like a real app

Step 1 — Put the code on GitHub (5 minutes)

The hosting service needs to read your code from GitHub.

  1. Create an account at github.com if you do not have one.
  2. Go to github.com/new and create a repository:
    • Name: eas-sentinel-xdr
    • Visibility: Private (recommended) or Public
    • Do not tick "Add a README" — the project already has one.
  3. Click Create repository. GitHub shows a page with commands.
  4. Open a terminal in the project folder and run these three lines, replacing YOUR-USERNAME with your GitHub username:
git remote add origin https://github.com/YOUR-USERNAME/eas-sentinel-xdr.git
git branch -M main
git push -u origin main

If GitHub asks for a password, use a Personal Access Token instead (github.com → Settings → Developer settings → Personal access tokens → Generate new token, tick repo, copy it, paste it as the password).

Step 2 — Deploy on Render (10 minutes)

  1. Go to render.com and sign up with your GitHub account.
  2. Click New + → Blueprint.
  3. Choose your eas-sentinel-xdr repository and click Connect.
  4. Render reads render.yaml and shows three services:
    • sentinel-db — the database
    • sentinel-backend — the security engine
    • sentinel-console — the interface
  5. Click Apply. The first build takes about 5–10 minutes.

When it finishes, each service shows a link like https://sentinel-backend-a1b2.onrender.com. Copy both links.

Step 3 — Connect the two services (3 minutes)

The console needs to know where the backend lives.

On sentinel-console → Environment:

Key Value
NEXT_PUBLIC_API_URL https://YOUR-BACKEND-URL/api/v1
NEXT_PUBLIC_WS_URL wss://YOUR-BACKEND-URL/api/v1/ws

Replace YOUR-BACKEND-URL with your actual backend address, for example sentinel-backend-a1b2.onrender.com.

Note the wss:// on the second line — that is not a typo. It is the secure WebSocket protocol that carries live updates.

On sentinel-backend → Environment:

Key Value
SENTINEL_CORS_ORIGINS_RAW https://YOUR-CONSOLE-URL
SENTINEL_TRUSTED_PROXY_HOPS 1

SENTINEL_TRUSTED_PROXY_HOPS tells the backend how many proxies sit in front of it. Render is one. This is what stops a client from forging an X-Forwarded-For header to escape the sign-in rate limit — with it unset, every request looks like it came from a different address and the throttle never fires.

Click Save on each service. Render redeploys automatically (2–3 minutes).

Step 4 — Set the account passwords (required)

A first deploy will not finish without this. The passwords in README.md are published in the repository, so anyone who reads it could sign in as an administrator. Production refuses to create those accounts with a published value and fails the deploy with an explanatory message instead.

Generate three strong values — for example with openssl rand -base64 24, or any password manager — and add them on sentinel-backend → Environment:

Key Value
SENTINEL_SEED_ADMIN_PASSWORD (a value only you know)
SENTINEL_SEED_ANALYST_PASSWORD (a value only you know)
SENTINEL_SEED_VIEWER_PASSWORD (a value only you know)

Save them somewhere safe first — they are not recoverable from the service, and there is no self-service password reset.

Already deployed with the old defaults? Setting these variables only affects accounts that do not exist yet. On a database that has already been seeded, sign in with the old password and change it under Settings → Security → Change password, which also revokes every other active session.

Step 5 — Open it

Visit your console link and sign in with the administrator address admin@eas-sentinel.com and the password you set in Step 4.

The public demonstration account (demo@eas-sentinel.com) is read-only: it can browse the console and analyze files, but cannot change settings, act on devices, see other visitors' uploads, or alter its own password. It is safe to share.

Step 6 — Install it on your iPhone

  1. Open the console link in Safari (not Chrome — only Safari can install).
  2. Tap the Share button (square with an arrow, at the bottom).
  3. Scroll and tap Add to Home Screen.
  4. Tap Add.

The app icon now sits on your home screen and opens full-screen with no browser bars, exactly like a native app.

For the background video to play on iPhone: turn off Settings → Accessibility → Motion → Reduce Motion, and turn off Low Power Mode in Battery settings. Both block autoplaying video on iOS.

Free-tier behaviour worth knowing

Render's free services sleep after 15 minutes of no visitors. The first visit after that takes about 30 seconds to wake up; every visit afterwards is instant. To keep it always awake, upgrade a service to the paid Starter plan in its Render settings.

The free PostgreSQL database expires after 90 days. Render emails a reminder beforehand; creating a fresh one and redeploying takes a couple of minutes.

Updating the platform later

Any change you push to GitHub deploys automatically:

git add -A
git commit -m "Describe your change"
git push

Render rebuilds and publishes within a few minutes.

If something does not work

Symptom Cause and fix
Console loads but sign-in fails NEXT_PUBLIC_API_URL is wrong or missing /api/v1 at the end
Sign-in works, no live data NEXT_PUBLIC_WS_URL must start with wss:// and end with /api/v1/ws
"Network error" in the browser SENTINEL_CORS_ORIGINS_RAW on the backend must exactly match the console URL, with https:// and no trailing slash
First load is very slow The free service was asleep. Normal — wait 30 seconds.
Build fails on Render Open the service → Logs tab; the failing step is named there.
Backend exits at startup with "Refusing to start in production" Working as intended. The log lists exactly which variable is missing — usually one of the SENTINEL_SEED_*_PASSWORD values from Step 4.
Live updates stop after ~15 minutes Expected once, then it recovers: the socket closes when its access token expires and reconnects with a fresh one. Persistent failure means NEXT_PUBLIC_WS_URL or SENTINEL_CORS_ORIGINS_RAW does not match the console origin.
Sign-in says "too many requests" too readily SENTINEL_TRUSTED_PROXY_HOPS is higher than the number of proxies actually in front of the service, so every caller shares one bucket. On Render it is 1.

Running it locally instead

Double-click START.bat in the project folder. It launches both services and opens http://localhost:3000 automatically.

Reaching it from a phone on the same Wi-Fi

Windows blocks incoming connections by default, so a phone cannot reach the platform until the two ports are opened. This is a one-time step:

  1. Double-click FIX-PHONE-ACCESS.bat.
  2. Approve the administrator prompt (changing firewall rules requires it).
  3. Run START.bat and open the phone address it prints, in Safari.

If the phone still cannot connect, check that both devices are on the same network — phones sometimes join a guest or 2.4 GHz network that is isolated from the computer's. Deploying to the cloud avoids the issue entirely, and also works over cellular.