Deployment

ASP backend is Django, and the frontend is Vite + Ant Design. For single-host private deployment, use the Docker Compose release package.

The Docker Compose package is intended for single-host deployment, internal testing, and production environments. It contains deployment templates, initialization scripts, and customization directories. Backend and frontend images are pulled from GHCR.

1. Download the package

• GitHub Releases: https://github.com/FunnyWolf/agentic-soc-platform/releases
• Current release package: asp-compose-0.5.2.tar.gz

curl -fL -O https://github.com/FunnyWolf/agentic-soc-platform/releases/download/v0.5.2/asp-compose-0.5.2.tar.gz
tar -xzf asp-compose-0.5.2.tar.gz
cd asp-compose

2. Package contents

After extraction, the package creates the asp-compose/ directory. It mainly contains:

compose.yaml
.env.example
scripts/
custom/
logs/
certs/

• compose.yaml: Docker Compose definition.
• .env.example: Default configuration template. It is copied to .env during initialization.
• scripts/: Initialization, upgrade, diagnostics, and custom dependency scripts.
• custom/: User-defined Modules, Playbooks, SIEM YAML files, and dependencies.
• logs/: Mounted frontend Nginx and backend process logs.
• certs/: HTTPS certificate directory.

3. First initialization

For the default deployment, run:

./scripts/init.sh
docker compose exec asp-web python manage.py createsuperuser

If .env does not exist, init.sh creates it from .env.example and writes random values for DJANGO_SECRET_KEY, PostgreSQL password, Redis password, and RustFS/S3 Secret. After initialization, you can continue editing .env to use your own passwords, domain names, or ports.

If change-me-* placeholder passwords still exist in .env, initialization aborts to avoid starting services with default passwords.

If custom/requirements.txt already contains extra Python dependencies and you need to specify a PyPI index, append uv pip install arguments to init.sh:

./scripts/init.sh --index-url https://pypi.org/simple
docker compose exec asp-web python manage.py createsuperuser

init.sh runs asp-custom-deps only when custom/requirements.txt exists and contains non-empty dependencies. Arguments such as --index-url are passed only to uv pip install; package names still need to be listed in custom/requirements.txt.

Proxy configuration depends on the use case:

• GHCR image pulls are handled by Docker. If docker compose pull needs a proxy, configure it in Docker Desktop or the Docker daemon first.
• Python dependency installation from custom/requirements.txt runs inside the asp-custom-deps container. Pass proxy variables into that container with -e, or put them in .env.

docker compose run --rm \
  -e HTTP_PROXY=http://proxy.example:8080 \
  -e HTTPS_PROXY=http://proxy.example:8080 \
  asp-custom-deps --index-url https://pypi.org/simple

4. Default services

Compose includes:

• asp-frontend: Frontend HTTPS entrypoint.
• asp-web: Django HTTP API.
• asp-asgi: ASGI / WebSocket service.
• asp-worker-module: Module Worker.
• asp-worker-case-analysis: Case Analysis Worker.
• asp-worker-playbook: Playbook Worker.
• asp-worker-elk-action: ELK Action Worker.
• asp-worker-dashboard-cache: Periodically generates the Dashboard 24h, 7d, and 30d caches.
• postgres: PostgreSQL.
• redis-stack: Redis Stack.
• rustfs: RustFS / S3-compatible object storage.

5. HTTPS and certificates

Compose deployment listens on HTTPS only by default. The host bind address and port are controlled by ASP_BIND and ASP_HTTPS_PORT in .env.

Default values:

ASP_BIND=0.0.0.0
ASP_HTTPS_PORT=443

• If 443 is already in use, only change ASP_HTTPS_PORT.
• The frontend container always reads certs/asp.crt and certs/asp.key.
• If the certificate files do not exist, asp-frontend automatically generates a self-signed certificate on first startup.

For production, prepare certificates issued by an enterprise CA or public CA before startup and place them under the deployment directory:

certs/asp.crt
certs/asp.key

If formal certificates are not available yet, the automatically generated self-signed certificate can be used for initialization or internal testing. Browser security warnings are expected; do not use self-signed certificates long term in production.

After replacing certificates, restart the frontend container:

docker compose restart asp-frontend

6. Web API and upload limits

Adjust the Web API process and upload size in .env:

ASP_WEB_WORKERS=3
ASP_WEB_TIMEOUT=210
ASP_MAX_UPLOAD_SIZE=20m

7. Management UI ports

Redis Stack and RustFS provide their own web management UIs. To avoid reverse-proxy issues with static assets or WebSockets, the package exposes their official HTTP management ports directly.

Service	Default Address	Description
Redis Stack UI	http://<server>:8001	Redis management UI.
RustFS Console	http://<server>:9001	RustFS web console.

Configure ports and bind addresses in .env:

ASP_MANAGEMENT_BIND=0.0.0.0
ASP_REDIS_UI_PORT=8001
ASP_RUSTFS_CONSOLE_PORT=9001

The default bind address is 0.0.0.0, which is suitable for server deployment. In production, use firewall or VPN controls to restrict access to management UIs.

8. Compose customization

On first initialization, init.sh creates a compose.override.yaml with explanatory comments and an empty services: {} mapping. Docker Compose automatically merges it with the official compose.yaml.

• Keep supported passwords, ports, and image settings in .env.
• Edit compose.override.yaml for service-level additions such as volumes, environment variables, or command overrides.
• Managed upgrades replace the official compose.yaml but never overwrite .env or compose.override.yaml.

Do not edit the official compose.yaml directly; the next upgrade backs up and replaces those changes. See Upgrade for the complete behavior.

9. Custom directory

The package uses custom/ for user customizations:

Path	Purpose
custom/modules/*.py	Custom Modules.
custom/playbooks/*.py	Custom Playbooks.
custom/data/modules/<module_slug>/raw_alert_*.json	Module development samples.
custom/data/siem/*.yaml	Custom SIEM YAML files.
custom/data/playbooks/<playbook_slug>/*.md	Custom Playbook prompts.
custom/requirements.txt	Extra Python packages required by Modules / Playbooks.

• After changing scripts or YAML files, use Refresh / Validate in the corresponding Custom Console tab.
• After changing Python dependencies or shared helper modules, rerun asp-custom-deps and restart related containers:

docker compose run --rm asp-custom-deps --index-url https://pypi.org/simple
docker compose restart asp-web asp-worker-module asp-worker-playbook

10. Logs

Nginx and backend process logs are mounted to logs/:

logs/nginx/access.log
logs/nginx/error.log
logs/django.log
logs/asgi.log
logs/agentic-module-worker.log
logs/agentic-case-analysis-worker.log
logs/agentic-playbook-worker.log
logs/elk-action-worker.log
logs/dashboard-cache-worker.log

Container stdout and stderr are still available through docker compose logs.

Next Steps

• First Login — Log in and prepare the administrator account.
• Basic Configuration — Configure LLM, SIEM, Threat Intelligence, and LDAP.
• Mock Data — Import sample data to quickly experience Case, Alert, and Artifact.
• Alert Ingestion — Learn how Splunk, Kibana, and ELK Index Action ingest alerts.