Chapter 7: Install Deslicer Automation Platform

← Back to Index | Previous: TLS certificates | Next: Post-install configuration →

7.1 Overview

Install DAP after Deslicer AI Control is reachable. Control issues an enroll token and a short-lived encrypted provision bundle for the DAP host. The DAP curl installer downloads that bundle, decrypts it with the host age identity, deploys Compose under /opt/deslicer/dap, and configures Deslicer Caddy for the DAP edge.

flowchart LR daiInstall[Install_DAI] --> controlLogin[Sign_in_Control] controlLogin --> enroll[Enroll_backend] enroll --> dnsReady[DNS_public_edge] dnsReady --> hostRun[Run_dap_install] hostRun --> installComplete[install_complete] installComplete --> probe[Control_probe_active]

7.2 Prepare the DAP host

On the DAP host:

Confirm prerequisites (supported OS, sudo-capable admin, outbound HTTPS). Python 3.13+, curl, tar, and acl are installed by deslicer-dap-install.sh — they are not manual pre-enroll steps
Install the age CLI from Control's enroll OS tabs (or Chapter 3 §3.3), then generate the age identity and paste the public key into Control
Ensure DNS for the public Observer hostname resolves to this host before you run the installer (ACME needs a working name)
Ensure firewall allows the edge ports you will publish
Docker is not required before enroll. After Control issues the bundle, download deslicer-dap-install.sh 1.9.32+ and run enroll as a non-root sudo-capable admin — shell bootstrap installs Python/curl/tar/age/acl; Ansible container_engine (with container_engine_manage=true) installs Docker (Docker CE on RHEL, distro packages on Ubuntu/Amazon Linux). If Docker ends up broken, repair by re-running the installer rather than hand-installing packages (§10.3). Ensure DAI has the matching DAP ansible bundle via install seed or Control → Updates → DAP → Apply before relying on this path (Chapter 3)

Default age identity path used by the installer:

~/.config/age/keys.txt

Override with --age-identity-file when Control’s command includes a different path.

7.3 Enroll from Control

Sign in at https://<dai-host>/control
Open Platform integrations → DAP → Enroll backend
Fill the wizard fields (see below)
Copy the generated host commands exactly

Enroll wizard fields

Field	What to enter
Name / slug	Human label and stable backend id (slug is used in install artifacts)
Public Observer hostname	FQDN operators and Deslicer AI will use (for example `dap-103.example.com`). This must resolve in public DNS to the DAP host
Age public key	Recipient key for the Control-minted `provision.enc.yml` (matches the host identity file)
Edge TLS mode	ACME (automatic HTTPS) or customer PEM, as prompted

On split installs (DAI and DAP on different hosts), Control stores the same public edge URL for both the server-side backend URL and the tenant-facing URL. Deslicer AI reaches DAP over that public hostname.

Update vs Fresh (token modes)

When you Issue install run command or Re-issue, Control chooses a token mode:

Mode	Use when	Effect
Update (keep data & secrets)	Stack already installed; you want new images / repair without wiping data	Injects installer `--update`. Live `/opt/deslicer/dap/.env` secrets win. DAP image pins from the token are applied into `.env`, then images are pulled
Fresh (rotate secrets)	Brand-new host, or you intentionally wipe volumes and start over	Rotates provision secrets. Conflicts with an existing Postgres volume when `/opt/deslicer/dap/.env` is missing or its password does not match the Fresh token

Prefer Update for every reinstall of an existing DAP host. Use Fresh only on a clean host or after an explicit volume wipe you planned with Deslicer.

Auto-resume: if a Fresh run left volumes + /opt/deslicer/dap/.env and you re-run the same Fresh token whose Postgres password still matches that .env, the installer resumes (preserves .env, re-runs bootstrap; brings the stack up without force-recreate if observer-api is down). Volume detection uses docker or passwordless sudo docker so an admin outside the docker group still hits this path. Mismatched Fresh secrets still refuse—wipe or use Update/Repair.

There is no host CLI flag named --fresh. Fresh vs Update is selected in Control when the token is issued.

Image channels (Control Updates)

Routine image upgrades keep the same DAI provision and the same Control Update token path. Deslicer publishes digests under two floating tracks on container-registry.deslicer.io:

Channel	Floating tip	Immutable pin
Enterprise (stable, default)	`:enterprise`	`:enterprise-<version>`
Preview (pilot)	`:preview`	`:preview-<version>`

Re-issue an Update token from Control → Updates → DAP, then run the printed command (or the equivalent below):

# enterprise tip (default)
bash /opt/deslicer/bin/deslicer-dap-install.sh --enroll-token-file ./dap-update.token --update --channel enterprise
# preview tip (pilot hosts)
bash /opt/deslicer/bin/deslicer-dap-install.sh --enroll-token-file ./dap-update.token --update --channel preview
# optional pinned tip within a channel:
bash /opt/deslicer/bin/deslicer-dap-install.sh --enroll-token-file ./dap-update.token --update --channel enterprise --release <version>

--channel enterprise|preview selects the container image tip for this host. Customer install-package discovery uses the production artifact channel (prod); do not change that for enterprise hosts. --update preserves Postgres/secrets and upserts DAP image pin keys into /opt/deslicer/dap/.env before pull/migrator — do not hand-edit .env image lines. Pilot hosts should track preview until Deslicer promotes to enterprise. Registry-side tip rollback: Deslicer re-promotes a prior digest; hosts re-run --update --channel ….

7.4 Download the installer and check the version

Run the download command Control prints (admin with sudo). Shape:

sudo mkdir -p /opt/deslicer/bin
sudo curl -fsSL https://artifact-registry.deslicer.io/install/linux/prod/deslicer-dap-install.sh \
  -o /opt/deslicer/bin/deslicer-dap-install.sh
sudo chmod 755 /opt/deslicer/bin/deslicer-dap-install.sh

Confirm the script before enroll:

bash /opt/deslicer/bin/deslicer-dap-install.sh --version

Use the download command and version pin Control shows for your engagement. Prefer Control-printed host commands over memorizing version numbers.

7.5 DAP Ansible install package updates

Greenfield: the Deslicer AI installer seeds the Control install-package cache from the artifact registry after the stack is healthy. You do not need a Control UI action before the first DAP enroll when the AI host can reach the artifact registry.

Control → Updates → DAP (install package)

Open Control → Updates → DAP:

Status	Meaning
Up to date	Cache matches the latest published install package for your channel
Update available	A newer package is published (or the cache is empty with discovery OK)—use Apply update
Unknown	Registry unreachable (typical air-gap)—use Import package with a Deslicer-provided tarball and checksum, or re-run `deslicer-dai-install.sh --repair` when registry access returns

Action	When to use
Apply update	Online hosts: download the versioned artifact, verify sha256, write the Control cache, store the pin. Next DAP enroll / `--update` serves that pin. No Deslicer AI image rebuild is required for playbook-only fixes
Import package	Air-gapped hosts: upload the tarball Deslicer shipped offline; Control applies the same verify + pin path. Confirm the checksum Deslicer provided before import
Roll back	Restore the previous verified package when a new apply causes install failures

If enroll fails because no install package is staged, re-run deslicer-dai-install.sh --repair (or Import package), then mint a fresh enroll token.

7.6 Run install with the enroll token

In Control, issue an Update or Fresh run command
On the DAP host, run that command as the sudo-capable admin (pipe the token; do not put it on argv)

Control shows commands similar to:

printf '%s' 'ENROLL_TOKEN' | bash /opt/deslicer/bin/deslicer-dap-install.sh \
  --dai-url https://<dai-host> \
  --enroll-token-file - \
  --age-identity-file ~/.config/age/keys.txt

Update tokens add --update automatically.

Security: Prefer --enroll-token-file - with a pipe, or a 0600 token file. Do not put the enroll token on the process command line in shared shell history.

7.7 What the DAP installer does

Probes Deslicer AI at --dai-url
Downloads the Control-issued provision.enc.yml
Decrypts with --age-identity-file
On --update, reconciles secrets from live compose .env and applies DAP image pins from the token
Runs the DAP Ansible deploy (Compose + edge proxy when enabled)
Signals install-complete back to Control

This provision.enc.yml is not your original Deslicer handoff package. It is minted for this enroll.

DNS and certificates during install

Publish the A/AAAA (or CNAME) for the public Observer hostname before the first install that enables ACME
If DNS was wrong during the first attempt, fix DNS, then restart Caddy on the DAP host so it can leave ACME backoff and obtain a certificate
Until TLS succeeds, browsers may show certificate warnings; Control probes may report TLS or DNS errors

7.8 Verify in Control

Check	Expectation
Install status	active (not stuck on failed)
Health badge	Healthy (backend `/health` + provisioning key)
Active	Backend marked Active
Observer health	Public HTTPS health URL from Control succeeds
Observer UI	UI URL from Control loads
Deslicer AI → DAP	From the AI host, Observer integration succeeds

Stuck “failed” with Healthy

If the header shows failed / Inactive / dns_error while the live probe is Healthy, an earlier enroll attempt failed (often DNS) and the row was not activated.

Reload Platform integrations → DAP
Use Retest connection or Retry probe
A green /health + provisioning check now sets install_status=active, clears the last error, and marks the backend Active

On split installs the probe label is Backend /health (the public Observer URL Deslicer AI uses server-side).

7.9 Update and proxy-only apply

For later stack image updates, use Control → Updates → DAP, re-issue an Update token, and run the printed command (§7.3).

When only certificates or Caddy routing change, use the proxy-only apply command Control prints (see Chapter 6).

7.10 Uninstall

Uninstall removes the DAP Compose project and local volumes on this host. Docker Engine remains installed.

Order:

In Control, delete or deactivate the DAP backend for this host (required before teardown; do not leave a live enroll pointing at a removed stack).
On the DAP host, run deslicer-dap-uninstall.sh.
Uninstall Deslicer AI only if you are retiring the AI host as well (Chapter 5 §5.8).

sudo mkdir -p /opt/deslicer/bin
sudo curl -fsSL https://artifact-registry.deslicer.io/install/linux/prod/deslicer-dap-uninstall.sh \
  -o /opt/deslicer/bin/deslicer-dap-uninstall.sh
sudo chmod 755 /opt/deslicer/bin/deslicer-dap-uninstall.sh
bash /opt/deslicer/bin/deslicer-dap-uninstall.sh \
  --compose-dir /opt/deslicer/dap

Option	Effect
`--compose-dir PATH`	Compose project to tear down (default `/opt/deslicer/dap`)
`--keep-workspace`	Retain the installer Ansible workspace under `/opt/deslicer/var/lib/dap-install`

This destroys local DAP data in Docker volumes for that project. Confirm with Deslicer before production teardown. If your engagement uses an external database you intend to keep, retain backups separately before uninstall.

This guide covers platform stack removal only. Splunk worker-host package uninstall is out of scope.

← Back to Index | Previous: TLS certificates | Next: Post-install configuration →