Installation

Obtaining the delivery package, running the installer, enrollment and verifying the health of all 14 services.

Deployment methodThe commands on this page apply to the Docker Compose delivery. Open the matching Kubernetes and Helm procedure.
Terms used in this guide
  • A reverse proxy accepts external requests and forwards them to MassAccess services.
  • Transport Layer Security (TLS) encrypts connections to the public address.
  • A health check confirms that a service is ready to handle requests.
  • Enrollment binds an installed instance to the created license.

Obtaining the package

The delivery archive massaccess-compose.tar.gz is provided in the control panel at https://massaccess.net/dashboard/on-premise. The archive contains installation data, licensing data, installation and update scripts.

License blocking warningDo not modify the package service files before running and do not run the same licensed package on additional local or test instances — this may lead to license blocking.

Running the installer

The archive includes the complete Compose transport. The installer verifies trusted metadata, pulls 16 immutable images, creates unique local PKI and starts 17 services. Receiver/RabbitMQ/Agent and bot TLS do not require manual preparation before a first deployment.

bash
tar -xzf massaccess-compose.tar.gz
cd massaccess-compose
chmod +x install.sh
bash install.sh --manifest ./manifest.json

Pre-flight check (--dry-run)

Checks manifest, package/release metadata, environment and Docker inventory. It creates no .env, keys or lock/journal and performs no login/pull/up/down.

bash
bash install.sh --manifest ./manifest.json --dry-run

What the installer checks

Before pulling images, install.sh checks the Docker daemon, Docker Engine 24.0+, Docker Compose v2.24+, Linux kernel 5.x+, Bash, Python 3, curl, base commands, free disk space and ports. CPU and RAM are checked separately: on mismatch the installer prints required and actual values and asks for explicit confirmation. Critical errors are printed as a single list, and until they are fixed the installer does not pull images or start Compose.

Licensing and public webhook ingress

After license heartbeat/Core confirmation, the central infrastructure operator authorizes the Receiver endpoint. Supply explicit DNS and allow inbound TCP/443 only from the agreed jump IPs. Enroll and verify ingress readiness. See Diagnostics section).

Configure incoming MAX and Telegram messages for this installation. DNS name or permitted IP without https://, port or path. Uses TCP/443. Once ingress is ready, reconnect the bot and verify delivery of a real message separately.

First-login credentials

The private .env (0600) stores initial administrator credentials and installation settings. Reruns preserve admin/JWT/role keys, installation UUID/Core ID and volumes. The password is not written to logs.

Health check

local=ready requires all 17 services and an applied signed snapshot/durable receipt, including an empty installation with no bots. ingress=pending is allowed at first local startup. Add bots after successful installation; actual Telegram/MAX delivery is verified separately.

License blocking warningDo not run the same licensed installation package on multiple instances simultaneously. The installer does not delete existing containers or volumes; if the ms-onprem project already exists, installation fails — use upgrade.sh to update.