Skip to content

Evaluate on your own servers

Edition: Community and Enterprise

From the offline image to a first governed fix on your own installation, with your directory, one non-production database and your own people. You set everything up in the browser; the only file you edit is three lines long. Plan for about an hour.

What you need

  • A Linux host with Docker and Docker Compose, and the sealfix offline bundle (Install, steps 1 and 2).
  • Your LDAP or Active Directory, with a read-only service account and three groups: requesters, DBA reviewers and administrators. Add business approvers for production-like policies.
  • One non-production database (PostgreSQL, Oracle or SQL Server) with test rows you can change, and an account for the executor with the grants in Targets.

The path

flowchart LR
    I["Install<br/>3-line config"] --> W["Setup wizard<br/>8 steps in the browser"]
    W --> F["First governed fix<br/>3 people"]
    F --> C["Check the trail"]
    classDef step fill:#E9EEF6,stroke:#23407A,color:#13202D
    class I,W,F,C step

1. Install with a minimal configuration

sealfix.yaml holds only where the executor's keys are:

sealfix.yaml
executor:
  private_key_file_env: SEALFIX_EXECUTOR_KEY_FILE   # executor container only
  public_key_file: /run/sealfix/executor.pub         # api container

In api.env, set the bootstrap administrator's password hash and the directory's service account variables. In executor.env, add one variable per target holding its connection string. Only the executor ever reads it.

docker compose run --rm --no-deps api sealfix hash-password   # value of SEALFIX_ADMIN_PASSWORD_HASH
docker compose up -d

Put your TLS proxy in front of it (Install).

2. Walk the setup wizard

Sign in as the bootstrap administrator at /login/local. The wizard opens by itself and lists eight steps, each with where your installation stands, so you can leave and come back. First-time setup describes every step.

The wizard keeps no secret

A field that needs a secret takes a reference: an environment variable name, or a file path. A value that looks like a secret is refused and never shown back.

3. Your first governed fix

Three people from your groups, each in their own browser:

  1. The requester opens "New request", writes the SQL as a template with named parameters, gives each parameter its kind, adds the values and submits.
  2. The DBA reviewer opens the "Review queue", reads the dry run, the plan and the checks, and approves. They never see the values.
  3. The requester executes the approved request.

4. Check what happened

Sign in as an auditor or an administrator and open the audit log. Every step is there, with the values masked. "Hash chain intact" at the top of the page confirms nothing was changed.

Next