> Source: https://docs.nometa.az/v4.1.0/deployment

# Deployment

SAMURAI is distributed as a single hardened Docker image (`beyrak44/samurai`). It
bundles the Go backend, the React UI behind Nginx, and an embedded MongoDB.

## Database: external-first, embedded-fallback

The entrypoint decides at runtime:

- `MONGODB_URL` set and reachable → uses your external MongoDB.
- `MONGODB_URL` set but unreachable → falls back to the embedded `mongod`.
- `MONGODB_URL` unset → uses the embedded `mongod`.

Mount a volume at `/app/mongo-data` to persist the embedded database.

## Environment

Bootstrap configuration is provided via environment variables; most runtime
settings (sync schedule, CORS, branding, timezone) are managed in **Settings** and
hot-reloaded.

| Variable | Purpose |
| --- | --- |
| `JWT_SECRET_KEY` | Signs session tokens |
| `DEVICE_ENCRYPTION_KEY` | 64-hex AES-256 key for stored credentials |
| `MONGODB_URL` | External MongoDB (optional) |
| `MONGODB_DATABASE` | Database name |
| `APP_HOST` / `APP_PORT` | Bind address |

Device passwords, SMTP/LDAP secrets, and tokens are encrypted at rest with
AES-256-GCM. TLS verification is handled per connector.

## Licensing

SAMURAI is license-gated. Upload your license file in **Settings → License**. See the
[License & Network Requirements](/v4.1.0/administration/settings) for outbound validation
details.