AarkamIO Sovereign Enterprise Cloud & Control Plane

Document Identifier ARK-DOC-AARKAMIO-INSTALL-V1.0.0

Standard Status

Production Standard

Architecture Tier Storage Centers Tier (SCT)

Release Version V-1.0.0-GA (Production Stable)

AarkamIO is the central Sovereign Enterprise Cloud & Control Plane for the Aarkam ecosystem. It houses the multi-tenant Web Management Console, OpenID Connect SSO/IAM identity subsystem, S3-compatible application ingress gateway, asynchronous Hangfire job pipeline, and the zero-trust Genesis Ceremony activation wizard (/genesis).

Architectural Scope: In standalone storage deployments (SAT: Rokka + Abodi), AarkamIO is optional. For enterprise sovereign clouds requiring centralized multi-tenant RBAC, audit compliance, and web console operations, AarkamIO orchestrates the underlying storage fabric.

1. Persistence & Database Options

AarkamIO uses an enterprise relational persistence layer for tenant accounts, bucket quotas, audit logs, and Hangfire background jobs:

Engine	Deployment Profile	Recommended Connection String
PostgreSQL 14+ / 16+	Production Enterprise (Recommended)	`Host=pg.internal;Database=AarkamDb;Username=aarkam;Password=<PWD>;`
Embedded SQLite WAL	Air-Gapped Standalone / Edge Enclave	`Data Source=/var/lib/aarkam/aarkam.db;Mode=ReadWriteCreate;Cache=Shared;`
Microsoft SQL Server	Legacy Windows Infrastructure	`Server=sql.internal;Database=AarkamDb;User Id=aarkam;Password=<PWD>;Encrypt=True;`

2. Automated Production Installation

2.1 Linux (Ubuntu 22.04/24.04, RHEL 8/9)

bash

# 1. Unpack release package
sudo mkdir -p /opt/aarkam/aarkamio
sudo unzip aarkamio-v1.0.0-linux-x64.zip -d /opt/aarkam/aarkamio
cd /opt/aarkam/aarkamio
sudo chmod +x aarkamio install-aarkamio.sh

# 2. Run automated production installer
sudo ./install-aarkamio.sh \
  --coordinator-url "https://localhost:57774" \
  --rokka-gateway-url "https://localhost:57772" \
  --abodi-url "https://localhost:57776" \
  --am-cli-path "/usr/local/bin/am" \
  --start-service

# 3. Check service status
sudo systemctl status aarkamio

2.2 Windows Server (PowerShell Administrator)

powershell

Expand-Archive -Path .\aarkamio-v1.0.0-win-x64.zip -DestinationPath "C:\Program Files\Aarkam\AarkamIO" -Force
Set-Location "C:\Program Files\Aarkam\AarkamIO"

.\install-aarkamio.ps1 `
  -CoordinatorUrl "https://localhost:57774" `
  -GatewayUrl "https://localhost:57772" `
  -AbodiUrl "https://localhost:57776" `
  -AmCliPath "C:\Program Files\Aarkam\AM\am.exe" `
  -StartServices

3. Configuration Deep-Dive (`appsettings.json`)

The core configuration file is located at /opt/aarkam/aarkamio/appsettings.json (or C:\Program Files\Aarkam\AarkamIO\appsettings.json):

json

{
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "AllowedHosts": "*",
  "ConnectionStrings": {
    "DefaultConnection": "Host=localhost;Database=AarkamDb;Username=aarkam;Password=<DB_PASSWORD>;",
    "HangfireConnection": "Host=localhost;Database=AarkamHFDb;Username=aarkam;Password=<DB_PASSWORD>;"
  },
  "Rokka": {
    "CoordinatorAddress": "https://localhost:57774",
    "CoordinatorUrl": "https://localhost:57774",
    "GatewayUrl": "https://localhost:57772"
  },
  "AmCli": {
    "BinaryPath": "/usr/local/bin/am"
  },
  "Abodi": {
    "ServerUrl": "https://localhost:57776",
    "TelemetryIntervalSeconds": 10,
    "HeartbeatIntervalSeconds": 15
  },
  "Kestrel": {
    "Endpoints": {
      "Https": {
        "Url": "https://0.0.0.0:57771",
        "Protocols": "Http1AndHttp2"
      },
      "Http": {
        "Url": "http://0.0.0.0:7771",
        "Protocols": "Http1"
      }
    }
  }
}

4. Post-Install Genesis Ceremony Activation

When booted for the first time, AarkamIO starts in an Unsealed Genesis State with zero default passwords:

Navigate to https://<gateway-node-ip>:57771/genesis in a browser.
Copy the unique hardware signature: ARK-FP-A7B8C9D0E1F2-...
Log in to the official customer licensing portal at https://aarkam.io/ → Current Subscription → Bind Fingerprint.
Download your signed .arkbundle and upload it at /genesis.
Provision the SuperAdmin master password. The system locks permanently: IsBootstrapped = true.