Deploy a TRE Layer

This page contains:

• a summary of what is involved when deploying a Five Safes TES TRE Layer
• a Sample Deployment Guide
  • with recommendations for deploying in Production

Component Summary

Here is a summary of the required components which make up the TRE Layer:

You may choose how to distribute your own deployment of these components, as long as they are able to communicate with each other over the network.

For some components, such as KeyCloak or MinIO, you may wish to use your own existing deployments.

User accessible components

A subset of the components will need to be accessible by users, outside of the TRE Layer environent:

Sample Deployment Guide

This guide deploys all the components of the TRE Layer (except the TES Backend) on a single host (e.g. a Virtual Machine) using Docker Compose.

All the components are deployed on suitable Docker networks and can communicate with each other as required.

It also automatically configures the necessary KeyCloak realms, ready for following our other guides.

User accessible components

Components which may need to be accessed from outside the host are forwarded to the host on specific ports

In this sample, where the TES Backend is deployed elsewhere, the TES Backend will also need access to some components:

This sample also includes some additional components useful for diagnostic purposes:

Production Recommendations

To use this sample as a starting point for a production deployment, some general recommendations should be considered.

The ports specified above can be used for configuring a reverse proxy for access to the necessary components.

Deployment steps

To deploy an instance of the TRE Agent and data Egress

cd TRE

# Set the following env vars to point to your machine's host:
KeycloakHostName=http://localhost:8085
MinioBrowser=http://localhost:9003
EgressKeyCloakClientUIRedirectURL=https//localhost:8100/
EgressKeyCloakTokenExpiredAddressUI=http://localhost:8100/Account/LoginAfterTokenExpired
 
# For example if running on a VM then change the hostname:
KeycloakHostName=http://<VMHost>:8085
MinioBrowser=http://<VMHost>:9003
EgressKeyCloakClientUIRedirectURL=https//<VMHost>:8100/
EgressKeyCloakTokenExpiredAddressUI=http://<VMHost>:8100/Account/LoginAfterTokenExpired
 
# Set SubmissionAPIAddressURL to the URL where the Submission API is hosted
# This is assuming you have deployed an instance of the Submission Layer, or that there is an existing Submission Layer you can connect the TRE Agent to.
 
# If you are using the default docker compose then the port is 5034
# So only the hostname needs to change
SubmissionAPIAddressURL=http://localhost:5034
 
# Set TesAPIUrl to the URL where the TES API executing agent is hosted. e.g Funnel or TES-K
TesAPIUrl=http://localhost:8000/v1/tasks
 
# Set output bucket prefix for the TES executing agent to write results to default is:
TesOutputBucketPrefix=s3://
 
# Optional: The TRE Agent syncs with the Submission Layer Projects every 10 minutes by default, adjust if needed:
syncSchedule=10
 
 

docker-compose up -d

Username: accessfromtretosubmission
Password: password123

Username: accessfromtretoegress
Password: password123

Username: accessfromegresstotre
Password: password123