Install on OpenShift

Prerequisites

• OpenShift 4.x and oc and helm (3.8 or newer) logged in with rights to create a project.
• The CloudNativePG operator installed on the cluster, unless you connect an external PostgreSQL.
• Registry credentials for ghcr.io/salusapp-ai with package read access, or your own mirror.
• The chart version you are installing, from the release notes.

The chart runs under the restricted-v2 security context constraint and fails at render time if the Route or CloudNativePG APIs are missing, so a mistake surfaces before anything is created.

1. Generate the secrets

export SALUS_VAULT_KEY="$(openssl rand -hex 32)"
export SALUS_FPE_KEY="$(openssl rand -hex 32)"
export SALUS_AUDIT_ENC_KEY="$(openssl rand -hex 32)"
export SALUS_GATEWAY_ASSERTION_KEY="$(openssl rand -hex 32)"
export SALUS_BOOTSTRAP_KEY="$(openssl rand -hex 32)"
export SALUS_BOOTSTRAP_SHA256="$(printf '%s' "$SALUS_BOOTSTRAP_KEY" | openssl dgst -sha256 | awk '{print $NF}')"

oc new-project salus
oc -n salus create secret docker-registry salus-ghcr \
  --docker-server=ghcr.io --docker-username="$SALUS_GHCR_USER" --docker-password="$SALUS_GHCR_TOKEN"
oc -n salus create secret generic salus-keys \
  --from-literal=vault-key="$SALUS_VAULT_KEY" \
  --from-literal=fpe-key="$SALUS_FPE_KEY" \
  --from-literal=audit-enc-key="$SALUS_AUDIT_ENC_KEY"
oc -n salus create secret generic salus-gateway-auth \
  --from-literal=assertion-key="$SALUS_GATEWAY_ASSERTION_KEY" \
  --from-literal=bootstrap-admin-sha256="$SALUS_BOOTSTRAP_SHA256"

Store the vault key and the audit key in your secrets management with the same care as a database master password. Losing either makes stored values unrecoverable. The bootstrap key is used once and then discarded.

2. Install the chart

printf '%s' "$SALUS_GHCR_TOKEN" | helm registry login ghcr.io --username "$SALUS_GHCR_USER" --password-stdin
helm upgrade --install salus oci://ghcr.io/salusapp-ai/charts/salus-app \
  --version "$SALUS_CHART_VERSION" --namespace salus \
  --rollback-on-failure --wait --timeout 20m

Common overrides:

--set route.host=salus.example.internal
--set postgres.storageClass=fast-ssd
--set ocr.enabled=true --set ocr.engine.variant=cpu   # scanned pages and images, without a GPU

To use a PostgreSQL you already run, create a secret salus-database with a key uri containing postgres://…?sslmode=require and install with --set postgres.mode=external --set postgres.connectionSecret.name=salus-database.

Secrets are read at pod start. After changing one, run oc -n salus rollout restart deployment.

3. Verify

ROUTE_HOST=$(oc -n salus get route salus -o jsonpath='{.spec.host}')
curl -fsS "https://$ROUTE_HOST/health"

Open https://$ROUTE_HOST/console/ for the management console. Port-forward 9090 from any Salus pod and fetch /metrics to see the OpenMetrics exposition.

4. Create the first administrator

The console’s first account is created once with the bootstrap key as a bearer token at POST /console/api/v1/bootstrap; the machine-API administrator key is created with the same bearer at POST /admin/v1/bootstrap. Both work exactly once per database. Then create a tenant and an API key for the first application; see Keys and tenants.

TLS and network

The route terminates TLS at the OpenShift router and redirects HTTP to HTTPS. Traffic from the router to the console service and between services is cluster-internal. The chart does not create network policies; add your own to restrict the namespace if your platform policy requires it.