Deployment Steps

Download the deployment files

There are a few ways to download the deployment files.

git clone https://github.com/SwanseaUniversityMedical/5S-TES-deployment.git

git clone git@github.com:SwanseaUniversityMedical/5S-TES-Deployment.git

gh repo clone SwanseaUniversityMedical/5S-TES-Deployment

curl -L -o 5S-TES-Deployment.zip https://github.com/SwanseaUniversityMedical/5S-TES-Deployment/archive/refs/heads/main.zip

Prepare the necessary files

If you would like to modify the services while keeping the original files structure (to make Git tracking easier, for example), you can follow the steps below.

• Create a new compose.yml file next to DeploymentStack and ServiceStack directories.

• compose.yml
• DeploymentStack
• ServiceStack

• Add the following content to the compose.yml file, to make the connection with the original TRE’s docker-compose.yml file:

include:
    - DeploymentStack/TRE/docker-compose.yml

• Add the override settings to the compose.yml file if there are any. For example, if you want to change the port of the TRE Agent UI to 8123, the content of compose.yml should be:

include:
    - DeploymentStack/TRE/docker-compose.yml
 
services: 
  tre-ui:
    ports: !override # To override the port of the TRE Agent UI, to 8123 in this example
      - 8123:8080

If you would like to change the directory structure (e.g., to have your own way of managing the files), there are some notes below.

• We recommend to move the following files and directories to a separate directory, e.g., /srv/tre:

  • DeploymentStack/TRE/docker-compose.yml
  • DeploymentStack/TRE/config/
  • ServiceStack/

The docker-compose.yml file in the DeploymentStack/TRE/ directory includes the services for the TRE Agent and Data Egress using relative paths to the compose manifests in the ServiceStack/ directory, where they are defined. The services inside the ServiceStack/ directory are using the configuration files in the config/ directory via CONFIG_PATH environment variable.

• Since the directory structure is changed, you need to update the relative paths in the docker-compose.yml and CONFIG_PATH in the .env file accordingly.

Configure the stack

3.1 Create a new .env file

Create a new .env file next to the compose.yml or the docker-compose.yml file. This can be based on the DeploymentStack/TRE/.env.example file in the repository.

3.2 Configure general app settings

Modify these environment variables in the .env file:

3.3 Set up Vault for secret management

You need to setup Vault and generate a root token. Run the following commands one by one in the terminal to setup Vault using Docker interaction mode:

     docker compose up -d vault   # start only the Vault server
     docker exec -it vault vault operator init -key-shares=1 -key-threshold=1  # this generates and shows on the console the unseal key and the initial root token
     docker exec -it vault vault operator unseal <UNSEAL_KEY>  # unseal the vault
     docker exec -it vault vault login <INITIAL_ROOT_TOKEN> # login to the vault
     docker exec -it vault vault secrets enable -path=secret kv-v2 # enable the secret engine

Copy the generated root token and paste it into the VaultRootToken environment variable of the .env file. Also, save the unseal key in a safe place to unseal the vault in the production mode.

3.4 Change passwords for the services

You are highly recommended to change the passwords for the services by the environment variables in the .env file.

3.5 Configure KeyCloak

Depending on where and how you want to deploy KeyCloak, the configuration is different.

docker compose up -d keycloak

3.6 Configure OpenID secrets

Follow the guide below to re-generate the OpenID secrets for services to use.

3.7 Configure URLs

You can set the following URLs to the hostname:port address for testing, but we recommend setting up SSL certs and subdomains for the user accessible components, and then set these to the URLs with HTTPS protocol. A guide to set up SSL certs and subdomains is coming soon.

3.8 Configure TES Backend

To complete the setup, you need to put the URL for the TES backend in the .env file.

If you have not set this up yet, setup a TES backend, e.g., Funnel (with the installation guide here), and configure it to use the TRE S3 storage of this deployment.

Run the Docker compose

At the directory where docker-compose.yml or compose.yml and .env files are located, run the following command to start the TRE Agent and Data Egress:

docker compose up -d