PCR-360 Wiki

Air-Gapped Install

PCR360 Installation — Air-Gap / Offline Environments

This guide is for installing or upgrading PCR360 on a server without internet access. All Docker images, source code, and database migration scripts are included in the bundle shipped to you by PCR360.


Before You Begin — Information to Gather

Collect the following before starting. Having these at hand will make the install wizard faster.

All Installs

Information

Notes

Server hostname(s)

e.g. pcr360.yourdomain.gov

SSL certificate mode

self-signed (no cert needed), manual (you supply the cert files), or letsencrypt (requires ACME — typically unavailable in air-gapped environments)

Timezone

IANA format, e.g. America/Chicago, America/Los_Angeles

PCR360 data directory path

Where inbound/outbound files will be stored, e.g. /data/pcr360

Linux group for SSH users

Group whose members can read/write the data directory

Linux group for admins

Group with full admin access to the data directory

Email transport

FILE (emails written to disk — no mail server needed) or SMTP (relay through your mail server)

SMTP host and port

Only if using SMTP

From email address

e.g. pcr360@yourdomain.gov

PCR360 license key

Provided by PCR360

MySQL Installs — Also Need

Information

Database server hostname and port (default: 3306)

Main database name (e.g. pcr360)

Archive database name (e.g. pcr360_archive)

Metadata database name (e.g. pcr360_metadata)

Main DB user + password

Archive DB user + password (or leave blank to reuse main user)

Metadata DB user + password (or leave blank to reuse main user)

Report (read-only) DB user + password (dmpusr convention)

Oracle Installs — Also Need

Information

Easy Connect string for each schema (main, archive, metadata)

Schema names for each

DB user + password for each schema

Oracle Instant Client directory path on this server

Oracle Instant Client version (e.g. 19.28)

Migration from Existing PCR360 — Also Need

Information

Existing database connection details (same DB, same credentials — no re-initialization required)

Existing bare-metal installation accessible — the wizard will prompt for the paths it needs during import


Prerequisites

The following must be installed on the server before using the bundle. These are standard packages your system administrator can provide via an internal package mirror.

Package

Purpose

Docker Engine 24+

Container runtime

Docker Compose v2

Runs multi-container apps (docker compose command)

openssl

Generates random secrets during install

Verify Docker is ready:

Bash
docker compose version   # should print v2.x.x
docker info              # should succeed without error

You will also need sudo or root access — the deploy script must run as root.


Section A: Extract and Load the Bundle

Bash
# 1. Create a staging directory and extract the bundle
sudo mkdir -p /opt/pcr360-install
sudo tar -xzf pcr360-bundle-{version}-{date}.tar.gz -C /opt/pcr360-install
cd /opt/pcr360-install/pcr360-bundle-{version}-{date}

# 2. Verify bundle integrity
sha256sum -c bundle-manifest.txt

# 3. Load all Docker images into the local Docker daemon
#    (This may take a few minutes — images are large)
for f in images/*.tar; do docker load -i "$f"; done

# 4. Copy to the permanent installation directory
sudo cp -r . /opt/pcr360
cd /opt/pcr360

Section B: Fresh Install

Step 1 — Choose your .env template

Pick the template that matches your database type and SSO setup:

Template

Use when

.env.example.mysql

MySQL database, no SSO

.env.example.oracle

Oracle database, no SSO

.env.example.shibboleth

MySQL + Shibboleth SAML SSO

.env.example.shibboleth-oracle

Oracle + Shibboleth SAML SSO

Bash
sudo cp .env.example.mysql .env   # (or your chosen variant)

Step 2 — Place SSL certificates (if using manual mode)

If your hostname will use a certificate issued by your organization's CA:

Bash
sudo cp your-cert.crt certs/prod/vhost1.crt
sudo cp your-key.key  certs/prod/vhost1.key

If using self-signed, no action needed — the installer will generate one.

Step 3 — Place Oracle Instant Client (Oracle only)

Copy your Oracle Instant Client directory to any path on this server (e.g. /opt/oracle/instantclient_19_28). You will enter this path during the install wizard.

Step 4 — Run the deployment wizard

Bash
sudo bash scripts/deploy.sh --airgap

The --airgap flag tells the installer to use the images you loaded in Section A instead of pulling from the internet.

The wizard will walk through:

  1. Port conflict check

  2. Environment configuration (enter all the values you gathered above)

  3. Optional: data migration from an existing bare-metal PCR360 install

  4. Image verification (confirms your loaded images match the configured version)

  5. Start all services

  6. Health checks

  7. Systemd service installation (so PCR360 starts on reboot)

Step 5 — Verify

After the wizard completes, the application should be reachable at <https://your-hostname/.>

Bash
# Check service status
sudo systemctl status pcr360

# View logs
sudo bash scripts/logs.sh

# Quick status
sudo bash scripts/status.sh

Section C: Migration from Existing PCR360

The deploy wizard handles the import process interactively — the steps are almost identical to a fresh install.

Step 1 — Run the deployment wizard

Bash
sudo bash scripts/deploy.sh --airgap

When the wizard asks whether to import from an existing bare-metal installation, answer y — it will prompt for the paths it needs and run the import scripts automatically.

During the wizard:

  • Enter your existing database connection details

  • The database is left as-is — no re-initialization

Step 2 — Verify

After the wizard completes, the application should be reachable at <https://your-hostname/.>

Bash
sudo systemctl status pcr360
sudo bash scripts/logs.sh

Section D: Updating to a New Version

When you receive an update bundle from PCR360:

Step 1 — Extract the update bundle

Bash
sudo tar -xzf pcr360-update-{old}-to-{new}-{date}.tar.gz -C /opt/pcr360-updates
cd /opt/pcr360-updates/pcr360-update-{old}-to-{new}-{date}

Step 2 — Verify bundle integrity

Bash
sha256sum -c bundle-manifest.txt

Step 3 — Load new Docker images

Bash
# Only needed if the images/ directory contains .tar files
# (not all updates include new images)
for f in images/*.tar; do
    [ -f "$f" ] && docker load -i "$f"
done

Step 4 — Copy updated files to your installation

Bash
sudo cp -r scripts/ /opt/pcr360/
sudo cp docker-compose.yml /opt/pcr360/
sudo cp -r sql360/ /opt/pcr360/scripts/lib/

Step 5 — Run the update script

Bash
cd /opt/pcr360
sudo bash scripts/update.sh --airgap

The --airgap flag skips internet checks and uses the locally-loaded images and bundled sql360 migrations.

The script will:

  1. Detect which services have a new version available

  2. Verify the required images are loaded

  3. Restart containers with the new images (rolling restart — brief interruption per service)

  4. Run SQL migrations for each updated environment

  5. Run post-update data operations (views, validators)


Section E: Custom File Placement Reference

Item

Where to place

SSL cert

certs/prod/vhost1.crt (must match hostname in PROD_VHOST_1_HOSTNAME)

SSL key

certs/prod/vhost1.key

Test SSL cert

certs/test/vhost1.crt

Test SSL key

certs/test/vhost1.key

Customer data files

{PCR360_DATA_PATH}/inbound/

Outbound reports

{PCR360_DATA_PATH}/outbound/

Oracle Instant Client

Any host path; enter it during install wizard

Custom PHP settings

config/prod-custom.ini


Section F: Permissions Reference

The deploy script configures all permissions automatically. For reference:

Path

Owner:Group

Mode

Purpose

/opt/pcr360/ (repo)

root:pcr360

750

No world access to config/scripts

/opt/pcr360/.env

root:pcr360

640

Secrets file

{PCR360_DATA_PATH}

root:{CUSTOMER_GROUP}

group-writable

Shared data directory


Common Issues

"Image not found" error during deploy or update

  • You need to load the image first: docker load -i images/<service>.tar

  • Make sure you're running from the correct directory where the images/ folder is

Services start but app is not reachable

  • Check logs: sudo bash scripts/logs.sh

  • Verify the hostname matches your DNS/hosts file entry

  • If using self-signed SSL, accept the certificate warning in your browser

Migration fails with "sql360 not found"

  • The sql360/ directory must be in scripts/lib/sql360/ before running migrations

  • Copy it from the bundle: sudo cp -r sql360/ /opt/pcr360/scripts/lib/

Systemd service fails to start

  • Check: sudo journalctl -u pcr360 -n 50

  • Ensure Docker is running: sudo systemctl start docker