Installation

PEART runs as three processes: the internal surface (peart), the client portal (peart-portal), and a PDF rendering sidecar. This section installs them on a Linux host, either directly on the operating system or with a container.

The direct install is presented first, and it is the right choice for a hardened or audited host. The container path follows, and it is fully supported.

The shape of an installation

• peart serves the internal surface the pentester uses, holds the master encryption key, and reads and writes the database and the evidence directory.
• peart-portal serves the surface the client uses, runs as a separate user, opens its primary database connection read-only, writes only the session and the client's fix declaration through a second narrow connection, and never touches the key or the evidence.
• The rendering sidecar turns report HTML into PDF, and runs with no network and no access to the database, the key or the evidence. Its network isolation is a security control, not a convenience.

Doing it once, in order

The list below is by topic, for looking things up. A hardened install, end to end is the same material as a sequence, for a systemd host with no container: the order, and the places where the right step at the wrong moment is the same as not taking it.

The path through this section

1. Prerequisites and platforms
2. Direct install — get the binaries onto the host.
3. First run and configuration — the config file and the paths.
4. Running as a service (systemd) — the units, including the sidecar's isolation.
5. TLS and reverse proxy.
6. Data directory and backups — including exporting the master key.
7. Verifying the install — signatures and the SBOM.

The container install is an alternative to steps 2 through 5. There is no default credential in either path: on first access PEART requires you to create the administrator and enrol the second factor.