Customer deploy handbook

Run GovernX on your servers

Any Linux VM, Kubernetes cluster, or OCI runtime. You pull private images. You never receive source, and you never copy keys from Pravadh HQ.

Why images-only

You receive

A license pack from Pravadh: LICENSE_INSTANCE_ID, INSTALL_TOKEN (once), LICENSE_SECRET
A GitHub PAT with read:packages only, so you can pull private images
Image names and a release tag (usually stable)
This handbook — orchestration only, never application source

You generate on the box

JWT_SECRET and TOKEN_ENCRYPTION_KEY on the new server
Superadmin / admin passwords for this instance
Your own LLM API key in /admin/instance after login
Your own mailer key if you want email (Resend or equivalent)

Never copy

Any .env from Pravadh HQ or from a different customer
HQ Razorpay, Resend, Anthropic, OpenAI, Mongo, or JWT values
Git repository access, SSH passwords, or source trees
Salesforce Connected App secrets that belong to another org

1.License pack from Pravadh

Superadmin at HQ opens Admin → Deployments, registers your server (label, email, domain), and sends you three values shown once: INSTANCE_ID, INSTALL_TOKEN, LICENSE_SECRET — plus a GitHub PAT with read:packages only. That is the entire pack. No git clone.

Images: ghcr.io/dhairyasalesforce/pravadh-gx-backend, ghcr.io/dhairyasalesforce/pravadh-gx-frontend, ghcr.io/dhairyasalesforce/pravadh-gx-agent tagged stable (or a sha HQ pushed). Mongo is public mongo:7.

2.Generate instance keys — never reuse HQ

JWT, Fernet, and first-login passwords must be created on the new server. Do not paste Razorpay, Resend, Anthropic, or JWT values from any other GovernX environment.

# Run on the customer server. These keys belong to this instance only.
python3 -c 'import secrets; print("JWT_SECRET=" + secrets.token_urlsafe(48))'
python3 -c 'import os,base64; print("TOKEN_ENCRYPTION_KEY=" + base64.urlsafe_b64encode(os.urandom(32)).decode())'
python3 -c 'import secrets; print("ADMIN_PASSWORD=" + secrets.token_urlsafe(16))'
python3 -c 'import secrets; print("SUPERADMIN_PASSWORD=" + secrets.token_urlsafe(16))'

3.Log in to the private registry

# Private images. PAT must be read:packages — never repo or admin scope.
export GHCR_USER=dhairyasalesforce
export GHCR_PULL_TOKEN='PASTE_READ_PACKAGES_TOKEN'
echo "$GHCR_PULL_TOKEN" | docker login ghcr.io -u "$GHCR_USER" --password-stdin
# Podman: echo "$GHCR_PULL_TOKEN" | podman login ghcr.io -u "$GHCR_USER" --password-stdin

4.Pick how this server runs

Same images everywhere. Compose is the fastest one-box path. Kubernetes and raw OCI use your own reverse proxy: /api to backend :8000, everything else to frontend :80.

# Any Linux VM (Ubuntu, RHEL, Amazon Linux, on-prem). Images only — never git clone.
# Works with Docker Engine + Compose plugin, or Podman + podman-compose (same file).

sudo apt-get update
sudo apt-get install -y ca-certificates curl python3
curl -fsSL https://get.docker.com | sudo sh

export GHCR_USER=dhairyasalesforce
export GHCR_PULL_TOKEN='PASTE_READ_PACKAGES_TOKEN'
export LICENSE_HQ_URL=https://pravadhgx.pravadhlabs.com
export LICENSE_INSTANCE_ID=INSTANCE_ID_FROM_HQ
export INSTALL_TOKEN=INSTALL_TOKEN_FROM_HQ
export LICENSE_SECRET=LICENSE_SECRET_FROM_HQ
export GX_DOMAIN=gx.customer.com

(curl -fsSL "$LICENSE_HQ_URL/api/public/install.sh" || curl -fsSL "$LICENSE_HQ_URL/install.sh") | sudo env \
  LICENSE_HQ_URL="$LICENSE_HQ_URL" \
  LICENSE_INSTANCE_ID="$LICENSE_INSTANCE_ID" \
  INSTALL_TOKEN="$INSTALL_TOKEN" \
  LICENSE_SECRET="$LICENSE_SECRET" \
  GX_DOMAIN="$GX_DOMAIN" \
  GHCR_USER="$GHCR_USER" \
  GHCR_PULL_TOKEN="$GHCR_PULL_TOKEN" \
  bash

5.DNS, TLS, brand, your LLM

# DNS A/AAAA: gx.customer.com → this server. Then TLS (Caddy, nginx, ALB, certbot).
# First login: SUPERADMIN_EMAIL / SUPERADMIN_PASSWORD from THIS server's .env
# Brand + your LLM: https://gx.customer.com/admin/instance
# Billing, trial dates, lock, and revoke stay at Pravadh HQ.

Subscription dates and lock/unlock stay at Pravadh. If HQ revokes the license, this instance becomes read-only. Updates: HQ sets a tag; Compose/agent pull, or you roll the Kubernetes image.