Backend Installation (Docker)

import { Steps, Aside } from ‘@astrojs/starlight/components’;

Docker Compose (recommended)

The production deployment uses Docker Compose to run SurrealDB and the Bastion backend together.

1. Download the release bundle

   curl -Lo bastion-server.tar.gz \
     https://github.com/halden-technologies/bastion/releases/latest/download/bastion-server-linux-x86_64.tar.gz
   tar -xzf bastion-server.tar.gz
   cd bastion-server

2. Edit configuration

   Copy the example config:

   cp config/backend.example.toml config/backend.toml

   Set your JWT secret and any optional settings (SMTP, SIEM, etc.) in config/backend.toml. See Backend Configuration.

3. Start services

   docker compose up -d

4. Verify

   curl http://localhost:8080/health
   # {"status":"ok","version":"13.0.0"}

Ports to expose

Port	Expose to	Purpose
8080	Console workstations	REST API
50051	Endpoints	gRPC agent connections
8000	localhost only	SurrealDB

Never expose port 8000 (SurrealDB) to the network. It should be accessible only from the Bastion backend container.

TLS (production)

For production deployments, terminate TLS at a reverse proxy (nginx, Caddy, or Cloudflare Tunnel) in front of port 8080. The gRPC port (50051) supports optional mTLS — see Backend Configuration.

Updating

docker compose pull
docker compose up -d

Bastion uses zero-downtime rolling updates. Existing agent connections are maintained during restarts.

Backup

SurrealDB data is in the ./data/ directory. Back it up with any standard file backup:

# Stop, snapshot, restart
docker compose stop surrealdb
tar -czf backup-$(date +%Y%m%d).tar.gz ./data/
docker compose start surrealdb