Deployment

SAMURAI Networks is distributed as a single hardened Docker image (beyrak44/samurai). It bundles the Go backend, the React UI behind Nginx, and an embedded MongoDB.

Prerequisites

A host with Docker Engine 20.10+ (or Docker Desktop) and roughly 2 GB of free RAM. SAMURAI Networks ships as a single container, so Docker is the only dependency.

On most Linux hosts:

curl -fsSL https://get.docker.com | sh

See Docker’s official install guide  for Windows, macOS, or distribution-specific steps, and verify with docker --version.

Run

Deploy with the Docker CLI or Docker Compose. Both publish ports 80/443; for production, set stable secrets (see Environment) and persist the database in a volume.

docker run -d --name samurai -p 80:80 -p 443:443 beyrak44/samurai:latest

JWT_SECRET_KEY=$(openssl rand -hex 32)
DEVICE_ENCRYPTION_KEY=$(openssl rand -hex 32)
 
docker run -d --name samurai -p 80:80 -p 443:443 \
  -v samurai-data:/app/mongo-data \
  -e JWT_SECRET_KEY="$JWT_SECRET_KEY" \
  -e DEVICE_ENCRYPTION_KEY="$DEVICE_ENCRYPTION_KEY" \
  beyrak44/samurai:latest

# compose.yml
services:
  samurai:
    image: beyrak44/samurai:latest
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - samurai-data:/app/mongo-data
    environment:
      JWT_SECRET_KEY: "REPLACE_WITH_STABLE_SECRET"
      DEVICE_ENCRYPTION_KEY: "REPLACE_WITH_STABLE_64_HEX_KEY"
    restart: unless-stopped
volumes:
  samurai-data:

docker compose up -d

Database: external-first, embedded-fallback

The entrypoint decides at runtime:

• MONGODB_URL set and reachable → uses your external MongoDB.
• MONGODB_URL set but unreachable → falls back to the embedded mongod.
• MONGODB_URL unset → uses the embedded mongod.

Mount a volume at /app/mongo-data to persist the embedded database. For a production high-availability database, see Database Redundancy.

Environment

Bootstrap configuration is provided via environment variables; most runtime settings (sync schedule, CORS, branding, timezone) are managed in Settings and hot-reloaded.

Licensing

SAMURAI Networks is license-gated. Get a free trial license , then upload your license file in Settings → License, where you can review the active license: customer, validity, per-type device limits and current usage. A running deployment also needs outbound network access to validate the license, covered next.

License verification

SAMURAI Networks validates its license at startup and periodically while running. This needs outbound network access from the SAMURAI Networks server for two things: trusted time (to verify the license has not expired) and the server’s public IP (to enforce IP-locked licenses). All licensing traffic is outbound, so no inbound firewall rules are needed.

Required outbound access

What must succeed

Notes

• Allowlist by domain or by port, not by IP. pool.ntp.org is a rotating DNS pool and the IP-lookup services sit behind CDNs, so destination IPs are not stable. Permit the hostnames (egress proxy) or the ports (UDP 123, TCP 443) outbound, and keep DNS (UDP/TCP 53) open.
• These endpoints are fixed; there is currently no setting to use an internal NTP server or route through a proxy. Air-gapped or restricted-egress sites that cannot allow this outbound access will reach the 6-hour limit. If you need internal NTP or offline licensing, contact us.
• The license is locked to one or more specific public IPs (exact match). The public IP discovered above is what each match is compared against.