Chapter 4: Deslicer provisioning package
← Back to Index | Previous: Prerequisites | Next: Install Deslicer AI →
4.1 What Deslicer delivers
Deslicer provides a provisioning package, typically named:
provision.enc.yml
or, when encryption is not used for your engagement:
provision.yml
Treat this file as a secret. It contains engagement answers, registry credentials, and related configuration for your install. The DAI installer reads this file as a read-only sidecar — it never writes back into it.
4.2 Age keypair on the DAI host
Install the age CLI first (Chapter 3 §3.3). Then generate a host keypair:
mkdir -p ~/.config/age && chmod 700 ~/.config/age
age-keygen -o ~/.config/age/keys.txt
chmod 600 ~/.config/age/keys.txt
age-keygen -y ~/.config/age/keys.txt
Send the public key (age1…) to Deslicer so they can encrypt provision.enc.yml for this host. Keep the identity file private. For a plaintext provision.yml engagement you still need this identity: the installer encrypts /opt/deslicer/ai/install-state.enc.yml with it.
4.3 Decrypt (optional)
If you received provision.enc.yml and want a local cleartext copy for inspection only:
age -d -i ~/.config/age/keys.txt -o provision.yml provision.enc.yml
The installer can decrypt provision.enc.yml in memory during install — you do not need a cleartext copy on disk to run the installer.
Keep provision.yml and the age identity on encrypted disks only. Delete cleartext copies when install answers are safely stored in the host install-state file.
4.4 What the installer needs from the package
The DAI curl installer reads provision.yml or provision.enc.yml directly.
| Field area | Purpose |
|---|---|
| AI hostname / app URL | Public FQDN for Deslicer AI and Control |
| Admin bootstrap | Initial Control admin identity |
| Container registry username / password | Image pulls from the Deslicer container registry |
| Optional LLM / engagement defaults | When included for your engagement |
Keep these hostname fields aligned with live DNS (same spelling):
| Provision field | Role |
|---|---|
deployment.urls.daiPublic |
Preferred source for the public DAI URL (Caddy site + app URL) |
app.domainName |
Keep identical to the daiPublic hostname for handoffs |
A mismatch between the URL operators open in the browser and NEXT_PUBLIC_APP_URL on the host causes local-db login 403 Forbidden (Chapter 10 §10.12).
If a required field is missing, contact Deslicer to re-export the provisioning package — do not hand-edit a parallel answers file.
The Registry product API key in the full package is for Control / product integration. Docker pulls use the Nexus (container registry) username and password from the provision package.
4.5 Install state (age-encrypted on the host)
On first successful install the installer writes:
/opt/deslicer/ai/install-state.enc.yml
This file is encrypted to your host age recipient and holds the generated master_seed (and related secrets) for --update / --repair. Keep the age identity and this file safe.
4.6 Two different encrypted bundles
Do not confuse these files:
| Bundle | Issued by | Used by |
|---|---|---|
Deslicer provisioning package (provision.enc.yml) |
Deslicer at engagement handoff | deslicer-dai-install.sh on the AI host |
Control-issued DAP provision bundle (provision.enc.yml on the DAP host) |
Deslicer AI Control at DAP enroll time | deslicer-dap-install.sh on the DAP host |
The DAP installer downloads and decrypts the Control-issued bundle with the host age identity. That is a separate ciphertext from the original Deslicer handoff package.
4.7 Handling secrets
- Store age identities and passwords in your secret manager
- Restrict filesystem permissions (
0600) on provision, identity, and install-state files - Do not paste registry passwords into tickets or chat
- After first successful DAI install, preserve the age identity and
/opt/deslicer/ai/install-state.enc.ymlfor--update/--repair
← Back to Index | Previous: Prerequisites | Next: Install Deslicer AI →