Zwall
Talk to an Engineer
Talk to an Engineer
Documentation
Docs Home › Getting Started › Deployment Models

Deployment Models

Status: SUPPORTED for the paths below. Other install folklore is NOT_SUPPORTED.

SharedAudience: deployment engineer

Community (source)

Verified direction:

  1. Clone https://github.com/zwall-net/zwall-community
  2. Build Manager, Agent, zwallctl, eBPF objects, and the web console
  3. Provide PostgreSQL and TLS files
  4. Copy example YAML from configs/
  5. Run Manager -migrate before first start (Community Manager flag -migrate)
  6. Optionally use scripts/setup.sh (interactive; supports Full / Core / Agent-only in the Community script)

Community installation guide also lists health checks /health, /health/live, /health/ready.

Not in Community: signed-release verifier, Hosting Agent v2 systemd profile, AI, cluster, product ACME.

Enterprise (verified release)

Verified direction from Manager database installation authority:

  1. Independently install the release verifier and pinned trust root
  2. Admit PostgreSQL schema from a verified release (scripts/setup.sh --manager-database-only delegate / scripts/install-manager-database.sh)
  3. Admit Manager secrets/service (systemd unit zwall-manager.service runs /opt/zwall-manager/bin/zwall-manager -config /etc/zwall-manager/manager.yml as zwall-manager)
  4. Install Agents:
    • Virtualization: zwall-agent.service → /opt/zcs/bin/zwall-agent --config /etc/zcs/agent.yml as root
    • Hosting: zwall-hosting-agent.service plus zwall-hosting-ebpf-loader.service

The database installer does not start the Manager. Schema admission and service start are separate.

--allow-test-release is restricted to disposable non-production validation.

Historical / unsupported Manager install paths

Enterprise operations docs state that historical full/core source modes and several guarded helpers are not a production or commercial Manager install path.

NOT_SUPPORTED for public docs:

  • curl | sudo bash
  • native Terraform/Ansible/Puppet
  • Kubernetes as the shipping install
  • checkout-based production Manager install as the commercial path
  • “one-click zero-downtime rolling updates”