Zwall
Talk to an Engineer
Talk to an Engineer
Documentation
Docs Home › Getting Started › Before You Deploy

Before You Deploy

SharedStatus: SUPPORTED as a checklist of real decisionsAudience: deployment engineer, Manager administrator

Purpose

Force the decisions that change install path, privileges, and edition.

Decisions

  1. Edition. Community source build vs Enterprise verified-release. Do not mix binaries.
  2. Agent job. Observation on a hosting/panel node vs enforcement on a KVM/libvirt host. Do not attach a drop-capable firewall profile to a shared hosting node if you intend Hosting observation.
  3. TLS. Example Manager config enables TLS and expects cert_file / key_file. Community does not automate issuance.
  4. PostgreSQL. Host, database, role, ssl_mode. Enterprise database admission expects literal host, port, name, user, ssl_mode and a protected password contract — not a password on the command line.
  5. Manager URL as Agents and zwallctl will call it. Example is https://manager.example.com:8443. zwallctl default is http://localhost:8080 until configured.
  6. CORS origins. Example requires explicit server.cors.allowed_origins. Wildcard is blocked in production/TLS mode.
  7. Auto-register. Example agents.auto_register: false and comments say it must remain false in production. Plan pre-registration / admin-created enrollment.
  8. AI Preview (Enterprise only). Off by default. Requires customer-provided OpenAI-compatible credentials. Do not enable until you have read AI Preview status.
  9. Backup. PostgreSQL logical backup scripts exist. Licensed Enterprise recovery also needs deployment identity and license files. See Backup.
  10. Path layout. In-tree units and examples do not use one filesystem prefix. Do not assume /etc/zcs everywhere. The canonical filesystem layout remains an unresolved engineering gap, not a published customer contract.

What not to do

  • Do not use curl | sudo bash from get.zwall.net. That installer is not a supported path.
  • Do not clone a private-source repository name as if it were Community.
  • Do not enable allow_insecure_remote_tls except as break-glass (Agent example).
  • Do not store AI keys or Manager JWT secrets in YAML on Enterprise production (example YAML keeps those fields empty for systemd credentials).