Aarkam.IO Web Portal Installation

Aarkam.IO is the mandatory administrative backbone and client-facing control tower of the entire storage ecosystem. A deployment of Aarkam is incomplete without Aarkam.IO because it manages tenant organizations, generates S3 access credentials, hosts the cryptographic envelope encryption pipeline, and visualizes live cluster telemetry.

1. Prerequisites

Before installing the Aarkam.IO portal, ensure the host machine satisfies:

• Operating System: Linux (Ubuntu 22.04 LTS+, RHEL 9+, Rocky Linux) or Windows Server 2022+
• Runtime: .NET 10.0 ASP.NET Core Runtime

  # Check installed .NET runtime
  dotnet --list-runtimes
  # Must display: Microsoft.AspNetCore.App 10.0.x
  

• Relational Metadata Store: Microsoft SQL Server (2019, 2022, or Azure SQL Edge) for persistent tenant accounts, bucket metadata, audit logs, and IAM tables.
• Network Ports: Ports 7771 (HTTP redirect) and 57771 (HTTPS Web Portal & S3 API) accessible by clients.

2. Configuration (appsettings.json)

Configure database connection strings, coordinator gRPC endpoints, and encryption keys in /opt/aarkam-io/appsettings.json:

{
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "ConnectionStrings": {
    "DefaultConnection": "Server=127.0.0.1,1433;Database=AarkamStorageDb;User Id=sa;Password=YourStrongPassword!;TrustServerCertificate=True;"
  },
  "Rokka": {
    "CoordinatorAddress": "https://192.168.1.11:57774",
    "TimeoutSeconds": 30,
    "EnableMtls": true,
    "ClientCertificatePath": "/etc/ssl/certs/aarkam-client.pfx",
    "ClientCertificatePassword": "CertPasswordHere"
  },
  "Security": {
    "EnforceMfa": true,
    "TokenLifetimeMinutes": 60,
    "MaxConcurrentSessions": 3
  },
  "Kestrel": {
    "Endpoints": {
      "Http": {
        "Url": "http://0.0.0.0:7771"
      },
      "Https": {
        "Url": "https://0.0.0.0:57771",
        "Certificate": {
          "Path": "/etc/ssl/certs/aarkam-portal.pfx",
          "Password": "CertPasswordHere"
        }
      }
    }
  }
}

3. Database Migration & Initialization

Execute the EF Core migrations to bootstrap the system tables, IAM roles, and compliance audit schema:

cd /opt/aarkam-io
dotnet Aarkam.dll --migrate-database

4. Systemd Service Setup (Linux)

Create /etc/systemd/system/aarkam-io.service:

[Unit]
Description=Aarkam.IO Web Management Portal and S3 Gateway
After=network.target sqlserver.service

[Service]
WorkingDirectory=/opt/aarkam-io
ExecStart=/usr/bin/dotnet /opt/aarkam-io/Aarkam.dll
Restart=always
RestartSec=10
KillSignal=SIGINT
SyslogIdentifier=aarkam-io
User=aarkam
Environment=ASPNETCORE_ENVIRONMENT=Production
Environment=DOTNET_PRINT_TELEMETRY_MESSAGE=false

# Security Sandboxing
ProtectSystem=full
ProtectHome=true
NoNewPrivileges=true

[Install]
WantedBy=multi-user.target

Enable and start the service:

sudo systemctl daemon-reload
sudo systemctl enable --now aarkam-io
sudo systemctl status aarkam-io

5. Verification & Initial Bootstrap

1. Verify Web Portal: Open your browser to https://<portal-ip>:57771.
2. Initial Admin Setup: Follow the on-screen setup wizard to create the root sovereign administrator and enroll your hardware authenticator (TOTP MFA).
3. Connect Coordinator: The portal will immediately probe Rokka.Coordinator to verify consensus quorum health and display the initial empty hash ring.