init-deployment.sh Script Reference#

This reference describes the init-deployment.sh script that initializes a Dioptra deployment. The script is located in the root of the deployment folder generated by the cookiecutter template.

See also

Prepare Your Deployment - Step-by-step guide for creating and customizing your deployment.

Overview#

The init-deployment.sh script automates the following initialization steps:

  • Generates random passwords used to secure Dioptra’s services

  • Copies and bundles extra CA certificates for the containers

  • Copies configuration files and certificates into named volumes

  • Sets appropriate file and folder access permissions

  • Creates Minio S3 accounts and configures their access permissions

  • Syncs built-in task plugins from the Dioptra GitHub repository

  • Enables SSL/TLS in PostgreSQL (if applicable)

Credential Files#

Credential generation requires a POSIX environment with descriptor-relative file operations, same-directory hard links, and file and directory synchronization. The deployment user must be able to read the credential files, set their permissions, and create files in their containing directories.

The following paths, relative to the deployment directory, form one credential set:

  • .env

  • secrets/postgres-passwd.env

  • secrets/<deployment-slug>-minio-accounts.env

When all three paths are absent, initialization generates the complete set with mode 0600 (owner read/write only). When all three files exist and are nonempty, initialization preserves their contents and ownership, repairs permissions to 0600, and reports any repairs without logging credentials. An incomplete or empty set, a symbolic or hard link, a nonregular file, or an inability to secure a credential path stops initialization. Existing credential values are not checked for consistency with each other or with running services. The generated systemd unit contains no credentials and is outside this permission policy.

A caught generation failure attempts to remove all files created by that attempt; failures to complete cleanup are reported. Forced termination or power loss can leave partial credentials or protected temporary files named .<credential-name>.<random-token>.tmp beside the destinations. Those temporary files contain secrets and are not removed automatically by a later run. The set does not become visible atomically, and synchronization does not guarantee recovery after hardware failure. See Recover Deployment Credentials for recovery instructions.

Command-Line Options#

Usage: init-deployment.sh [--enable-nginx-ssl] [--enable-postgres-ssl]
                          [--skip-minio-setup] [--branch <branch-name>]
                          [--worker-ssl-service [tfcpu|pytorchcpu]]
                          [--python <cmd>] [-h|--help]
–enable-nginx-ssl

Enable the SSL-enabled configuration settings for the NGINX container. Use this if you copied a server certificate and private key into the ssl/nginx/ folder.

–enable-postgres-ssl

Enable the SSL-enabled configuration settings for the PostgreSQL container. Use this if you copied a server certificate and private key into the ssl/db/ folder.

–skip-minio-setup

Skip Minio service setup. Useful when making configuration changes after the initial deployment, as the script may freeze when trying to reconfigure an already-running Minio container.

–branch <branch-name>

The Dioptra GitHub branch to use when syncing built-in task plugins and frontend files. Replace <branch-name> with the branch you want to use (e.g., main, dev). (default: main)

–python <cmd>

Command for invoking the Python interpreter. Must be Python 3.11 or greater with the jinja2 package installed. (default: python)

–worker-ssl-service [tfcpu|pytorchcpu]

Container image to use when bootstrapping the SSL named volumes for worker containers. (default: tfcpu)

-h, –help

Print the help message and exit.

Examples#

Note

Replace <branch-name> with the Dioptra branch that matches your container images (e.g., main for releases, dev for development builds).

Basic initialization:

./init-deployment.sh --branch <branch-name>

With NGINX SSL enabled:

./init-deployment.sh --branch <branch-name> --enable-nginx-ssl

With both NGINX and PostgreSQL SSL enabled:

./init-deployment.sh --branch <branch-name> --enable-nginx-ssl --enable-postgres-ssl

Rerunning after configuration changes:

./init-deployment.sh --branch <branch-name> --skip-minio-setup

Important

You must specify the --enable-nginx-ssl and --enable-postgres-ssl options each time you run the init-deployment.sh script. If you omit them on a subsequent run, SSL/TLS will be disabled for those services.

See also