Skip to main content

Running it

The rule that overrides every other​

Do not install Kastell inside the perimeter it must rescue

Same hypervisor, same Active Directory domain, same backup, same identity provider: the day that perimeter falls, Kastell falls with it.

A separate host, separate DNS, a separate alerting path. It is the one operating constraint that is not negotiable.

Backups​

No backup mechanism is built into the product. The root console says so rather than showing a reassuring state with nothing behind it.

Three volumes to back up: the database, the object store, the recordings.

docker compose -f docker/compose.yaml --env-file .env exec -T postgres \
  pg_dump -U kastell --format=custom kastell > kastell-$(date +%F).dump
A restore never tested is a hypothesis

Test it quarterly. A restored database must pass the root console's integrity check — otherwise the backup was not one.

Monitoring​

GET /api/etat

A public probe, no account needed, deliberately poor: it says whether the service works, never who is using it.

Host the status page elsewhere

A status page served by the service it monitors says nothing on the day that service goes down. This probe is what a page hosted elsewhere queries.

GET /api/administration/metriques

The same figures in Prometheus format, root-only: an instance's volumetry says how many crises are open in it.

The root console also offers a diagnostic that actually queries every component — database, storage, media, antivirus, real-time — with its latency. The antivirus probe presents the EICAR test file and requires the verdict "infected": a scanner that answers "clean" to everything is more dangerous than no scanner, because it reassures.

Upgrading​

git pull
KASTELL_REVISION=$(git rev-parse HEAD) \
  docker compose -f docker/compose.yaml --env-file .env up -d --build
docker compose -f docker/compose.yaml --env-file .env logs app | head -30

Migrations run at startup. The application only declares itself ready once migration has succeeded.

The root account​

It administers the instance and does not read crisis content. Crossing from one register to the other exists — an operator must be able to help a customer whose incident log is unreadable after a restore — but it is a break-glass act: justified, capped at eight hours, traced, and visible to the organisation concerned.

A single root locks you out

Grant the right to a second account as soon as you can. A root who loses their phone locks the operator out, and the product refuses to remove the last one.

If you modify Kastell​

The AGPL, in its section 13, says that running a modified version over a network counts as distribution: your remote users are entitled to that version's source.

KASTELL_SOURCE_URL=https://git.example.org/our-kastell

An internal repository your users can reach is enough; it need not be public. See Licence.

What is on you, and the product will not do​

  • Keeping the preparedness dossier current. The indicator measures it; nobody will fill it in for you.
  • Printing the paper export. It is what remains when everything is encrypted.
  • Getting everyone to open the tool at least once. A tool discovered on the day of the crisis does not get used.