Chapter 5: Install Deslicer AI

← Back to Index | Previous: Provisioning package | Next: TLS certificates →

5.1 Overview

On the AI host, download the published installer and run it with your provision package and host age identity. The installer:

1. Downloads the Deslicer AI Ansible bundle from the artifact registry
2. Reads provision.yml or decrypts provision.enc.yml in memory
3. Logs in to the container registry using credentials from the package
4. Deploys the Compose stack under /opt/deslicer/ai
5. Writes age-encrypted install state (install-state.enc.yml) for later updates
6. Configures Deslicer Caddy so https://<dai-host>/ and /control terminate TLS on this host
7. Seeds the Control DAP ansible install package cache from the artifact registry (same anonymous channel as this installer), so DAP enroll does not require a Control UI Apply step

Run as a sudo-capable admin. Do not run as root. On air-gapped hosts, use --skip-dap-bundle-seed and Import the DAP package later under Control → Updates → DAP.

5.2 Prerequisites on this host

Before downloading the installer:

1. Size the AI host to the capacity baseline: 8+ GiB RAM minimum (16+ GiB recommended for pilots), 4+ vCPU, 100+ GiB disk. The installer fails closed when /proc/meminfo reports less than ~7 GiB (cloud “8 GB” instances usually pass).
2. Install the age CLI (Chapter 3 §3.3) so age and age-keygen are on PATH
3. Generate the host age identity (Chapter 4 §4.2)
4. Confirm Python 3.13+ is available as python3 (see Chapter 3)
5. Docker is not required before first install — installer 1.4.19+ probes Docker only; Ansible container_engine installs Docker CE on RHEL (major-pinned repo) when missing (Chapter 3, §10.3)

awk '/^MemTotal:/ {printf "%.1f GiB\n", $2/1024/1024}' /proc/meminfo
command -v age && command -v age-keygen
age --version
test -f ~/.config/age/keys.txt
# Optional: python3 --version (installer installs 3.13+ when missing)
# After a successful install (or to verify an existing engine):
sudo docker info

5.3 Download the installer

sudo mkdir -p /opt/deslicer/bin
sudo curl -fsSL https://artifact-registry.deslicer.io/install/linux/prod/deslicer-dai-install.sh \
  -o /opt/deslicer/bin/deslicer-dai-install.sh
sudo chmod 755 /opt/deslicer/bin/deslicer-dai-install.sh

5.4 First install

Place the provision package on the host with mode 0600, then:

Encrypted package (filename contains .enc.):

bash /opt/deslicer/bin/deslicer-dai-install.sh \
  --provision ./provision.enc.yml \
  --age-identity ~/.config/age/keys.txt

Plaintext package:

bash /opt/deslicer/bin/deslicer-dai-install.sh \
  --provision ./provision.yml \
  --age-identity ~/.config/age/keys.txt

--age-identity is always required: the installer encrypts install-state to your host age recipient.

5.5 What success looks like

After the playbook finishes:

Sign in at:

https://<dai-host>/control

Use the admin credentials from your provision package. Change passwords on first login when prompted.

If sign-in returns 403 {"error":"Forbidden"}, the browser URL does not match NEXT_PUBLIC_APP_URL in /opt/deslicer/ai/.env (common after a hostname change or --proxy-only TLS apply). See Chapter 10 §10.12.

5.6 Status and troubleshooting (no provision file)

After install, use the same installer binary for guided host checks. Neither command needs --provision or --age-identity.

Fresh install (--provision), --update, --repair, and --troubleshoot compare this script’s SHA-256 to deslicer-dai-install.sh.sha256 on the artifact registry and replace + re-exec when it differs (same contract as the DAP installer). Use --skip-self-update (or DESLICER_DAI_SKIP_SELF_UPDATE=1) on air-gapped hosts.

If self-update prints mv: … Permission denied against /opt/deslicer/bin/deslicer-dai-install.sh, do not keep running that on-disk copy — re-download to a writable path and run from there (installer 1.4.11+ also continues from a verified temp copy when in-place replace fails; older copies can leave you on a stale version):

curl -fsSL https://artifact-registry.deslicer.io/install/linux/prod/deslicer-dai-install.sh \
  -o /tmp/deslicer-dai-install.sh
chmod 755 /tmp/deslicer-dai-install.sh
bash /tmp/deslicer-dai-install.sh --provision ./provision.enc.yml --age-identity ~/.config/age/keys.txt
sudo install -m 755 /tmp/deslicer-dai-install.sh /opt/deslicer/bin/deslicer-dai-install.sh

Prefer these over memorizing ad-hoc docker / ss / curl one-liners. See Chapter 10 for symptom → command mapping.

5.7 Updates and repair

Later runs need the same age identity and the install-state file from first success.

Customer images use two floating tracks on container-registry.deslicer.io:

--channel enterprise|preview selects the tip. Optional --release <version> pins to the immutable tag :<channel>-<version> (for example :enterprise-1.4.2 or :preview-1.4.2). Omit any enterprise- / preview- prefix from --release.

Keep the same provision file for upgrades: Deslicer moves the tip under the chosen floating tag, then --update preserves secrets/DB and refreshes image pin keys in /opt/deslicer/ai/.env before compose pull and migrator run. You do not re-issue a new provision YAML for routine image upgrades, and you do not hand-edit .env image lines.

Control → Updates → Deslicer AI

1. Sign in at https://<dai-host>/control
2. Open Updates → Deslicer AI
3. Choose enterprise or preview, optionally select a release
4. Copy the host command and run it on the AI host as the sudo-capable admin

Selecting an older release than currently running may be unsafe if an interim release already migrated the schema (migrations are forward-only).

Pilot path: run a pilot host on --channel preview and verify --update before Deslicer promotes the same digests to :enterprise.

Rollback (registry tip): Deslicer re-promotes a previous digest to the floating tip (and may publish a new :<channel>-<version>). Re-run --update --channel … on the host to follow the tip. Customer-side digest editing is not supported.

For certificate-only changes, use Control Web certificates and the host apply command it shows (see Chapter 6). Prefer that path over a full Compose recreate when only TLS material changed.

Hostname / public URL changes need a full --update (not --proxy-only alone) so compose .env and app containers get the new NEXT_PUBLIC_APP_URL.

5.8 Uninstall

Uninstall removes the Deslicer AI Compose project and local volumes on this host. Docker Engine remains installed. If DAP is enrolled against this Control instance, uninstall DAP first (Chapter 7 §7.10).

sudo mkdir -p /opt/deslicer/bin
sudo curl -fsSL https://artifact-registry.deslicer.io/install/linux/prod/deslicer-dai-uninstall.sh \
  -o /opt/deslicer/bin/deslicer-dai-uninstall.sh
sudo chmod 755 /opt/deslicer/bin/deslicer-dai-uninstall.sh
bash /opt/deslicer/bin/deslicer-dai-uninstall.sh \
  --compose-dir /opt/deslicer/ai

This destroys local application data in Docker volumes for that project. Confirm with Deslicer before production teardown. Preserve age identity and any backups you need before running uninstall.

5.9 Existing database

If you intentionally reuse an existing application database volume or external database, the installer supports an allow-existing-db flag. Only use it when Deslicer has documented that path for your engagement:

bash /opt/deslicer/bin/deslicer-dai-install.sh \
  --provision ./provision.yml \
  --age-identity ~/.config/age/keys.txt \
  --allow-existing-db

5.10 Next steps

1. Confirm TLS in Chapter 6
2. Configure SMTP and models in Chapter 8 as needed
3. Enroll DAP in Chapter 7

← Back to Index | Previous: Provisioning package | Next: TLS certificates →