# ACI Config Tool -- Server Edition

Runs as a single container on your own server. Everyone on your team uses it
through a browser; nothing is installed on their machines and no data leaves
your network.

---

## 1. Requirements

- Linux with systemd (RHEL, Rocky, Ubuntu, Debian, SUSE, Fedora)
- Docker Engine or Podman
- Docker Compose v2 or podman-compose
- 2 GB RAM, 2 vCPU, 5 GB disk
- Network access from the server to your APIC

Windows is supported through Docker Desktop -- see "Windows" at the end.

---

## 2. Download and install

Download the package straight onto the server and run the installer:

    cd /opt
    curl -L -o aci-configtool.zip "https://license.madolka.com/download/file?product=configtool-docker"
    unzip aci-configtool.zip
    cd aci-configtool-<version>
    bash install.sh

`<version>` is the folder the zip creates, for example `aci-configtool-1.0.1`.

If the server has no internet access, download the zip on your workstation
from the same link and copy it over:

    scp aci-configtool-<version>.zip user@server:/opt/

Use `bash install.sh`, not `./install.sh`. The package is built on Windows,
so the files arrive without Unix execute bits.

The installer detects Docker or Podman, loads the image, generates a
self-signed TLS certificate, creates `.env`, and starts the container.

---

## 3. Activate

Open the app in a browser:

    https://<server-ip>:5009

It is a self-signed certificate, so your browser warns once. Accept it.

The activation page shows your **Machine ID**. Copy it, submit it at
https://license.madolka.com with your order number, and you will be emailed a
`license.dat`. Upload that file on the same activation page -- there is
nothing to copy into a folder and nothing to restart.

To print the Machine ID from the terminal instead:

    bash install.sh machine-id

---

## 4. Ports and firewall

| Port | Purpose                     |
|------|-----------------------------|
| 5009 | ACI Config Tool (HTTPS)     |

The installer does **not** open this port. It reports whether your firewall
is blocking it and leaves your rules alone. To open it:

    sudo bash install.sh firewall

Better, restrict it to your management network:

    sudo ALLOW_FROM=10.0.0.0/8 bash install.sh firewall

A cloud provider's firewall (Vultr, AWS, Azure) sits outside the machine and
must be opened in their console as well.

---

## 5. Commands

    bash install.sh start        Start
    bash install.sh stop         Stop
    bash install.sh restart      Restart
    bash install.sh status       Container status + firewall check
    bash install.sh logs         Live logs
    bash install.sh machine-id   Print the Machine ID
    bash install.sh firewall     Open the app port (opt-in)
    bash install.sh update       Load a new image and restart
    bash install.sh uninstall    Remove the container and its data

`uninstall` deletes the data volume, which includes your licence. The app
will need re-activating afterwards.

To upgrade, download the new zip the same way, unzip it beside the old one,
and run `bash install.sh update` from the new folder. Your `.env`, licence
and TLS certificate are left untouched.

---

## 6. Seats

Your licence sets how many people can use the app at once:

| Tier              | Concurrent users |
|-------------------|------------------|
| Server - 5 users  | 5                |
| Server - 25 users | 25               |
| Enterprise        | Unlimited        |

Seats are concurrent sessions, not named accounts. When the limit is reached
the next person is asked to try again shortly.

---

## 7. Options

**Your own TLS certificate.** Copy the files into `data/tls/` and set the
container-side paths in `.env`:

    TLS_CERT=/app/data/tls/corp.crt
    TLS_KEY=/app/data/tls/corp.key

**Behind your own reverse proxy.** Set `TLS_DISABLE=1` in `.env` to serve
plain HTTP, and terminate TLS at the proxy.

**Choosing the runtime.** With both Docker and Podman installed, Podman is
used. Override it:

    CONTAINER_RUNTIME=docker bash install.sh

**Windows (Docker Desktop).** There is no `/etc/machine-id` to identify the
host, so set it yourself in `.env` before activating:

    HOST_MACHINE_ID=<any stable string for this machine>

Changing that value after activation invalidates the licence.

---

## 8. Support

support@madolka.com -- include the output of `bash install.sh status`.
