Airlock provides connectivity, authentication, access control, and auditing for infrastructure. The platform includes an identity-aware proxy, a certificate authority with short-lived certificates, a unified access control system, and tunneling for accessing resources behind a firewall.

This guide shows how to deploy a single-node Airlock cluster on a Linux server. After deployment, you can configure RBAC, register resources, and secure test or home lab environments.

Demo Cluster Components

  • Auth Service — the cluster certificate authority. Issues certificates and performs authentication checks. Typically not accessible from outside the private network.
  • Proxy Service — the cluster frontend: handles user requests, forwards credentials to Auth Service, and communicates with agents.
  • SSH Service — an SSH server with short-lived certificates, RBAC, session recording, and other Airlock capabilities.

Prerequisites

  • A Linux host with port 443 open for inbound traffic. You must be able to install and run software. Initial setup requires SSH access (open the SSH port in addition to 443).
  • A multi-factor authentication app (Authy, Google Authenticator, 1Password, etc.).
  • One of the following:
    • A registered domain name.
    • An authoritative organizational DNS server and an existing certificate authority. The browser must use the organizational DNS server.

Step 1 of 4. Configure DNS

Airlock uses TLS to secure Proxy Service and Auth Service, so a domain name is required for certificate verification. Create two A DNS records pointing to the IP address of your Linux host. For the domain airlock.example.com:

DomainPurpose
airlock.example.comUser and service traffic to Proxy Service
*.airlock.example.comTraffic to web applications registered in Airlock

Step 2 of 4. Install Airlock on the Linux Host

Installation

curl https://deckhouse.ru/downloads/airlock/install.sh | bash -s

Configuration

Generate the configuration file using airlock configure. The command requires a TLS certificate and private key.

Public network deployment with Let’s Encrypt

Let’s Encrypt verifies domain ownership via HTTPS on port 443 of Proxy Service. Replace airlock.example.com with your cluster domain and admin@example.com with the notification email:

sudo airlock configure -o file \
  --acme --acme-email=admin@example.com \
  --cluster-name=airlock.example.com

Port 443 on the Proxy Service host must accept traffic from any source.

Private network deployment

Place the private key and certificate chain at /var/lib/airlock/privkey.pem and /var/lib/airlock/fullchain.pem. The certificate must match the cluster domain.

sudo airlock configure -o file \
  --cluster-name=airlock.example.com \
  --public-addr=airlock.example.com:443 \
  --cert-file=/var/lib/airlock/fullchain.pem \
  --key-file=/var/lib/airlock/privkey.pem

Starting

sudo systemctl enable airlock
sudo systemctl start airlock
sudo systemctl status airlock

Open the web interface via HTTPS: https://airlock.example.com. The welcome screen should appear.

Step 3 of 4. Create a User and MFA

Create an airlock-admin administrator with login rights as root, ubuntu, or other local accounts:

sudo airctl users add airlock-admin --roles=editor,access --logins=root,ubuntu

The command outputs a one-time link to complete user registration (valid for 1 hour):

User "airlock-admin" has been created but requires a password. Share this URL with the user to complete user setup, link is valid for 1h:
https://airlock.example.com:443/web/invite/...

Follow the link, set a password, and configure OTP using the QR code.

Accounts specified in the --logins flag must exist on the Linux host. Create them with adduser <login> or specify the current user: airctl users add airlock-admin $(whoami).

CLI Login

Install airsh on your workstation (if not already installed) and log in to the cluster:

airsh login --proxy=airlock.example.com --user=airlock-admin

Example output:

Profile URL:        https://airlock.example.com:443
Logged in as:       airlock-admin
Cluster:            airlock.example.com
Roles:              access, editor
Logins:             root, ubuntu
Kubernetes:         enabled
Valid until:        ...

Step 4 of 4. Register Infrastructure

In the web interface, open the section for the required resource type (Servers, Applications, Kubernetes, etc.) and follow the registration instructions.

The Servers tab will already show the Linux server running the cluster.

Next Steps

Airlock agents proxy traffic to servers, databases, Kubernetes clusters, and Windows desktops. See the Agents section and join-token enrollment for details.

←
Installation / Binary Installation
Installation / Deploying in Kubernetes
→