[{"data":1,"prerenderedAt":3634},["ShallowReactive",2],{"page-\u002Fbyodt-cloud\u002Fconfiguration":3,"navigation":3312},{"id":4,"title":5,"body":6,"description":3298,"extension":3299,"meta":3300,"navigation":3307,"path":3308,"seo":3309,"stem":3310,"__hash__":3311},"docs\u002F02.byodt-cloud\u002F02.configuration.md","Configuring the BYODt Deployment",{"type":7,"value":8,"toc":3263},"minimark",[9,13,17,20,25,108,117,141,143,147,154,341,344,372,380,382,389,471,481,486,492,597,603,614,624,633,680,693,709,713,756,759,773,780,784,840,847,856,872,876,887,891,1041,1044,1057,1061,1073,1079,1117,1126,1159,1201,1217,1233,1242,1256,1260,1301,1306,1324,1328,1366,1370,1412,1416,1424,1509,1526,1587,1613,1624,1687,1716,1721,1724,1730,1749,1780,1806,1811,1848,1852,1911,1964,1966,1969,1974,1980,1990,1996,2000,2003,2017,2021,2049,2053,2063,2085,2088,2112,2115,2121,2127,2137,2252,2257,2282,2292,2310,2323,2329,2361,2373,2375,2378,2389,2520,2564,2588,2628,2634,2668,2693,2695,2699,2707,2768,2776,2785,2806,2839,2849,2851,2855,2884,2886,2892,2895,2898,2904,2907,2910,3021,3028,3042,3052,3062,3064,3071,3080,3163,3165,3169,3172,3229,3232,3234,3238,3259],[10,11,5],"h1",{"id":12},"configuring-the-byodt-deployment",[14,15,16],"p",{},"Everything you can change about the deployment lives in three files in the bundle directory. This guide covers what each one is, every setting in the one you edit, and — the part that trips people up — which command actually applies a given change.",[18,19],"hr",{},[21,22,24],"h2",{"id":23},"the-three-configuration-layers","The three configuration layers",[26,27,33],"div",{"className":28,"tabIndex":30,"role":31,"ariaLabel":32},[29],"table-frame",0,"region","Table: The three configuration layers",[34,35,36,52],"table",{},[37,38,39],"thead",{},[40,41,42,46,49],"tr",{},[43,44,45],"th",{},"File",[43,47,48],{},"Who owns it",[43,50,51],{},"What is in it",[53,54,55,73,93],"tbody",{},[40,56,57,64,70],{},[58,59,60],"td",{},[61,62,63],"code",{},".env",[58,65,66],{},[67,68,69],"strong",{},"You",[58,71,72],{},"Every readable setting: the pinned image versions, the front-door address, database and embedding settings. This is the file you edit.",[40,74,75,80,86],{},[58,76,77],{},[61,78,79],{},".env.secrets",[58,81,82,83],{},"Generated, then ",[67,84,85],{},"yours to keep",[58,87,88,89,92],{},"The database password, and the outbound proxy's login if you add one. Created once on the first start, mode ",[61,90,91],{},"0600",".",[40,94,95,100,105],{},[58,96,97],{},[61,98,99],{},"mode\u002Fmode.env",[58,101,102],{},[67,103,104],{},"The console",[58,106,107],{},"The platform's authentication posture. Written by the console when you connect the deployment to the cloud or disconnect it. Do not hand-edit.",[14,109,110,111,113,114,116],{},"All three are read on every command. ",[61,112,63],{}," and ",[61,115,79],{}," are deliberately separate so the password stays out of the file you open, share, and diff.",[14,118,119,120,127,128,130,131,133,134,137,138,140],{},"None of the three exists in the release tarball. ",[121,122,124],"a",{"href":123},"\u002Fbyodt-cloud\u002Finstallation#set-up-with-byodt-setup",[61,125,126],{},".\u002Fbyodt setup"," writes ",[61,129,63],{}," from your answers (and ",[61,132,79],{}," only for a proxy login), and the first ",[61,135,136],{},".\u002Fbyodt up"," creates whatever is still missing: ",[61,139,63],{}," with the defaults, the database password, and the mode layer. A later start never overwrites them.",[18,142],{},[21,144,146],{"id":145},"how-to-apply-a-change","How to apply a change",[14,148,149,150,153],{},"A configuration change is not live until the affected containers are ",[67,151,152],{},"recreated",". A plain container restart re-runs the same process with the same environment and would not pick the change up. Use the command that matches your change:",[26,155,158],{"className":156,"tabIndex":30,"role":31,"ariaLabel":157},[29],"Table: How to apply a change",[34,159,160,170],{},[37,161,162],{},[40,163,164,167],{},[43,165,166],{},"What you changed",[43,168,169],{},"Apply it with",[53,171,172,183,198,210,222,248,269,283,293,303,312,331],{},[40,173,174,179],{},[58,175,176,177],{},"A value in ",[61,178,63],{},[58,180,181],{},[61,182,136],{},[40,184,185,194],{},[58,186,187,188,191,192],{},"The outbound proxy's login, ",[61,189,190],{},"HTTPS_PROXY_USERINFO"," in ",[61,193,79],{},[58,195,196],{},[61,197,136],{},[40,199,200,206],{},[58,201,202,205],{},[61,203,204],{},"proxy-ca\u002Fproxy-ca.pem"," added or removed",[58,207,208],{},[61,209,136],{},[40,211,212,217],{},[58,213,214,216],{},[61,215,204],{}," replaced",[58,218,219],{},[61,220,221],{},".\u002Fbyodt restart platform console",[40,223,224,243],{},[58,225,226,229,230,229,233,229,236,239,240],{},[61,227,228],{},"DB_DATA",", ",[61,231,232],{},"SNAPSHOT_INTERVAL_SEC",[61,234,235],{},"NEO4J_DATA",[61,237,238],{},"NEO4J_HEAP_SIZE"," or ",[61,241,242],{},"NEO4J_PAGECACHE_SIZE",[58,244,245],{},[61,246,247],{},".\u002Fbyodt restart db",[40,249,250,255],{},[58,251,252],{},[61,253,254],{},"DB_ENGINE",[58,256,257,260,261,263,264,268],{},[61,258,259],{},".\u002Fbyodt down",", then ",[61,262,136],{}," — see ",[121,265,267],{"href":266},"#the-database-engine","The database engine"," first",[40,270,271,278],{},[58,272,273,274,277],{},"A certificate in ",[61,275,276],{},"tls\u002F"," (added, replaced, or removed)",[58,279,280],{},[61,281,282],{},".\u002Fbyodt restart proxy",[40,284,285,288],{},[58,286,287],{},"Connected or disconnected the cloud, in the console",[58,289,290],{},[61,291,292],{},".\u002Fbyodt restart",[40,294,295,298],{},[58,296,297],{},"Mounted or unmounted a content module, in the console",[58,299,300],{},[61,301,302],{},".\u002Fbyodt restart platform",[40,304,305,308],{},[58,306,307],{},"Updated the knowledge graph, in the console",[58,309,310],{},[61,311,302],{},[40,313,314,317],{},[58,315,316],{},"The pinned image versions, to move to a new release",[58,318,319,322,323,326,327],{},[61,320,321],{},".\u002Fbyodt update",", or let ",[61,324,325],{},".\u002Fbyodt upgrade"," do it — see ",[121,328,330],{"href":329},"\u002Fbyodt-cloud\u002Foperations#upgrading-to-a-new-release","Operations → Upgrading to a new release",[40,332,333,338],{},[58,334,335],{},[61,336,337],{},"UPGRADE_REQUIRE_SIGNATURE",[58,339,340],{},"Nothing: the next upgrade reads it",[14,342,343],{},"Two rules of thumb behind that table:",[345,346,347,359],"ul",{},[348,349,350,358],"li",{},[67,351,352,354,355,357],{},[61,353,136],{}," re-reads ",[61,356,63],{}," and the mode layer"," and recreates whatever their values changed. It is the general apply step, and it is safe to run at any time — on an already-running deployment with no changes, it does nothing.",[348,360,361,364,365,367,368,371],{},[67,362,363],{},"A change made only inside a mounted directory"," — a certificate file, a module directory — does not change any container's configuration, so it needs that service recreated explicitly. That is why the certificate and content rows above name a specific service. Adding or removing the proxy's CA file is different: it switches the variables that point the services at it, which ",[61,366,136],{}," sees. Replacing it changes nothing ",[61,369,370],{},"up"," sees, and the platform and the console read it only when they start.",[14,373,374,376,377,379],{},[61,375,292],{}," with no service recreates everything. Naming a service (",[61,378,282],{},") recreates only that one, leaving its dependencies untouched.",[18,381],{},[21,383,385,386,388],{"id":384},"the-env-reference","The ",[61,387,63],{}," reference",[14,390,391,393,394,397,398,229,401,229,404,229,406,229,409,229,411,229,413,229,415,229,418,229,421,229,424,229,427,429,430,433,434,436,437,441,442,444,445,448,449,113,451,191,453,455,456,229,458,229,461,239,464,467,468,470],{},[61,392,63],{}," is created from ",[61,395,396],{},".env.example",", which stays in the bundle as the annotated original. Every setting below appears in it — some only commented out (",[61,399,400],{},"CONSOLE_IMAGE",[61,402,403],{},"CONTAINER_ENGINE",[61,405,254],{},[61,407,408],{},"NEO4J_IMAGE",[61,410,235],{},[61,412,238],{},[61,414,242],{},[61,416,417],{},"EMBEDDING_THREADS",[61,419,420],{},"SETTINGS_URL",[61,422,423],{},"HTTPS_PROXY",[61,425,426],{},"NO_PROXY",[61,428,337],{},"), and ",[61,431,432],{},"EMBEDDING_MODEL"," only by mention. A ",[61,435,63],{}," made by an earlier release can lack a line the template now has. An upgrade adds a setting that is new in the release, as the template ships it, but not the settings it leaves alone, which ",[121,438,440],{"href":439},"\u002Fbyodt-cloud\u002Foperations#what-an-upgrade-does","What an upgrade does"," lists. To change a setting that has no line, add the line to ",[61,443,63],{},". Without a line, ",[61,446,447],{},"byodt"," uses the default given here. It records ",[61,450,403],{},[61,452,254],{},[61,454,63],{}," when ",[61,457,136],{},[61,459,460],{},"restart",[61,462,463],{},"update",[61,465,466],{},"bootstrap"," finds them missing — on the first run, or in the update an upgrade ends with — and on Neo4j, ",[61,469,408],{}," too.",[14,472,473,474,239,477,480],{},"Spell boolean values exactly ",[61,475,476],{},"true",[61,478,479],{},"false",". Do not rename any of these keys — the deployment reads them by name.",[482,483,485],"h3",{"id":484},"the-release-set","The release set",[14,487,488,491],{},[61,489,490],{},"PLATFORM_VERSION"," is the release. Everything cut from that release moves with it. The two third-party images are pinned on their own lines so you can repoint them at a mirror.",[26,493,496],{"className":494,"tabIndex":30,"role":31,"ariaLabel":495},[29],"Table: The release set",[34,497,498,514],{},[37,499,500],{},[40,501,502,505,508,511],{},[43,503,504],{},"Setting",[43,506,507],{},"What it does",[43,509,510],{},"Default",[43,512,513],{},"Change it when",[53,515,516,539,558,582],{},[40,517,518,522,533,536],{},[58,519,520],{},[61,521,490],{},[58,523,524,527,528,532],{},[67,525,526],{},"The one version knob."," It selects the platform image ",[529,530,531],"em",{},"and"," the console image, and it selects which release's module payloads the one-shot downloads and which signing identity it requires.",[58,534,535],{},"The version of the bundle you downloaded",[58,537,538],{},"Upgrading.",[40,540,541,546,552,555],{},[58,542,543],{},[61,544,545],{},"DB_IMAGE",[58,547,548,549,92],{},"The Memgraph image, used when ",[61,550,551],{},"DB_ENGINE=memgraph",[58,553,554],{},"The Memgraph version tested with this release",[58,556,557],{},"Repointing at a mirror you operate.",[40,559,560,564,570,579],{},[58,561,562],{},[61,563,408],{},[58,565,566,567,92],{},"The Neo4j image, used when ",[61,568,569],{},"DB_ENGINE=neo4j",[58,571,572,573,575,576],{},"Recorded in ",[61,574,63],{}," on the first Neo4j run: the image the bundle was tested with, ",[61,577,578],{},"docker.io\u002Flibrary\u002Fneo4j:5.26.32-community",[58,580,581],{},"Repointing at a mirror, or moving the database to a newer image (see below).",[40,583,584,589,592,595],{},[58,585,586],{},[61,587,588],{},"PROXY_IMAGE",[58,590,591],{},"The front-door proxy image.",[58,593,594],{},"The nginx version tested with this release",[58,596,557],{},[14,598,599,600,602],{},"Upgrading is therefore a one-line change. The platform and the console are cut from the same release and cannot drift apart, because the console image follows ",[61,601,490],{}," unless you deliberately override it.",[14,604,605,610,611,613],{},[67,606,607,609],{},[61,608,400],{}," — an optional mirror override."," ",[61,612,63],{}," ships this key commented out, and you should normally leave it that way:",[615,616,621],"pre",{"className":617,"code":619,"language":620},[618],"language-text","# CONSOLE_IMAGE=ghcr.io\u002Fdether-net\u002Fbyodt-console:${PLATFORM_VERSION}\n","text",[61,622,619],{"__ignoreMap":623},"",[14,625,626,627,632],{},"Uncomment it only to repoint the console image at a registry you operate. If you do, ",[67,628,629,630],{},"keep its tag equal to ",[61,631,490],{}," — the console refuses to serve a platform version it was not built for, and a mismatched override aborts the start with a message naming both values.",[14,634,635,640,641,643,644,646,647,649,650,652,653,655,656,113,658,660,661,663,664,666,667,670,671,674,675,677,678,92],{},[67,636,637,639],{},[61,638,408],{}," stays what the deployment started on."," On the first Neo4j run ",[61,642,447],{}," records the image this bundle was tested with in ",[61,645,63],{},", as ",[61,648,396],{}," does ",[61,651,545],{}," for Memgraph. A later bundle tested with a newer Neo4j image does not move the store on ",[61,654,321],{}," — a newer database cannot be downgraded — and ",[61,657,136],{},[61,659,321],{}," warn when ",[61,662,408],{}," differs from the tested image, as they do for ",[61,665,545],{},". A deployment whose first Neo4j run recorded the floating tag ",[61,668,669],{},"docker.io\u002Flibrary\u002Fneo4j:5.26-community"," keeps that tag and gets the same warning. Whether to move it is your call: back up first (",[61,672,673],{},".\u002Fbyodt backup","; there is no downgrade), set ",[61,676,408],{},", then run ",[61,679,321],{},[14,681,682,229,684,113,686,688,689,692],{},[61,683,545],{},[61,685,408],{},[61,687,588],{}," name third-party images that your container engine pulls directly from their publishers. The bundle references them; it does not redistribute them. If you repoint one at a registry you operate, that copy is yours to make under that component's own licence — read ",[61,690,691],{},"NOTICE"," in the bundle first, in particular for the database.",[14,694,695,698,699,701,702,229,705,708],{},[67,696,697],{},"Always name the registry."," Every image reference in ",[61,700,63],{}," starts with its registry host (",[61,703,704],{},"docker.io\u002F…",[61,706,707],{},"ghcr.io\u002F…","). Docker will accept a short name and quietly assume Docker Hub, but Podman refuses one unless the host has configured a search registry — which a default installation has not. A short name is therefore a deployment that starts under one engine and fails under the other, so keep the registry on any value you change.",[482,710,712],{"id":711},"container-engine","Container engine",[26,714,717],{"className":715,"tabIndex":30,"role":31,"ariaLabel":716},[29],"Table: Container engine",[34,718,719,731],{},[37,720,721],{},[40,722,723,725,727,729],{},[43,724,504],{},[43,726,507],{},[43,728,510],{},[43,730,513],{},[53,732,733],{},[40,734,735,739,748,753],{},[58,736,737],{},[61,738,403],{},[58,740,741,742,239,745,92],{},"Which engine runs the deployment: ",[61,743,744],{},"docker",[61,746,747],{},"podman",[58,749,750,751],{},"Detected on the first start (Docker first, then Podman) and written into ",[61,752,63],{},[58,754,755],{},"You have both installed and want to force one.",[14,757,758],{},"Recording the choice is what stops a later-installed second engine from silently taking over an existing deployment. To override for a single command without editing the file, export it:",[615,760,764],{"className":761,"code":762,"language":763,"meta":623,"style":623},"language-sh shiki shiki-themes github-light github-dark-dimmed","CONTAINER_ENGINE=podman .\u002Fbyodt status\n","sh",[61,765,766],{"__ignoreMap":623},[767,768,771],"span",{"class":769,"line":770},"line",1,[767,772,762],{},[14,774,775,776,779],{},"Whatever it resolves to, the script validates that engine's ",[61,777,778],{},"compose"," before doing anything, so a wrong value fails immediately with a clear message rather than deep inside a compose call.",[482,781,783],{"id":782},"front-door","Front door",[26,785,788],{"className":786,"tabIndex":30,"role":31,"ariaLabel":787},[29],"Table: Front door",[34,789,790,802],{},[37,791,792],{},[40,793,794,796,798,800],{},[43,795,504],{},[43,797,507],{},[43,799,510],{},[43,801,513],{},[53,803,804,822],{},[40,805,806,811,814,819],{},[58,807,808],{},[61,809,810],{},"FRONT_DOOR_PORT",[58,812,813],{},"The host port the deployment publishes. Both the platform and the console are served through it.",[58,815,816],{},[61,817,818],{},"3000",[58,820,821],{},"The port is taken by something else.",[40,823,824,829,832,837],{},[58,825,826],{},[61,827,828],{},"FRONT_DOOR_BIND",[58,830,831],{},"The host address the port is bound to.",[58,833,834],{},[61,835,836],{},"127.0.0.1",[58,838,839],{},"You need to reach the deployment from another machine.",[14,841,842,843,846],{},"This is the ",[67,844,845],{},"only"," published port. Everything else — the database, the platform, the console — stays on the deployment's internal network.",[848,849,850],"blockquote",{},[14,851,852,855],{},[67,853,854],{},"Port 3000 is not arbitrary."," It is a pre-registered loopback callback address, which is why a laptop deployment needs no identity-provider registration to sign in. Renumbering it — to 80, or anything else — silently reintroduces that step. Change it if you must, but know what it costs.",[848,857,858],{},[14,859,860,863,864,867,868,92],{},[67,861,862],{},"Binding beyond loopback exposes an unauthenticated deployment."," With the standalone defaults, anyone who can reach the port has full access. Set ",[61,865,866],{},"FRONT_DOOR_BIND=0.0.0.0"," only behind your own authenticated front door, and terminate TLS first. See ",[121,869,871],{"href":870},"\u002Fbyodt-cloud\u002Foperations#tls-at-the-front-door","TLS at the front door",[482,873,875],{"id":874},"authentication","Authentication",[14,877,878,879,881,882,886],{},"There is no authentication setting in ",[61,880,63],{},", by design. The platform's authentication posture lives in the console-owned mode layer — see ",[121,883,885],{"href":884},"#the-mode-layer-modemodeenv","The mode layer"," below.",[482,888,890],{"id":889},"database","Database",[26,892,895],{"className":893,"tabIndex":30,"role":31,"ariaLabel":894},[29],"Table: Database",[34,896,897,909],{},[37,898,899],{},[40,900,901,903,905,907],{},[43,902,504],{},[43,904,507],{},[43,906,510],{},[43,908,513],{},[53,910,911,939,957,974,991,1007,1024],{},[40,912,913,917,926,934],{},[58,914,915],{},[61,916,254],{},[58,918,919,920,239,923,92],{},"The graph database: ",[61,921,922],{},"memgraph",[61,924,925],{},"neo4j",[58,927,928,930,931,933],{},[61,929,922],{},", recorded in ",[61,932,63],{}," on the first run",[58,935,936,937,92],{},"Before the first start. See ",[121,938,267],{"href":266},[40,940,941,946,949,954],{},[58,942,943],{},[61,944,945],{},"NEO4J_USERNAME",[58,947,948],{},"The database user the platform and the one-shot connect as on Memgraph. Not a secret. Not used on Neo4j.",[58,950,951],{},[61,952,953],{},"dethernety",[58,955,956],{},"Rarely. Changing it on an existing deployment does not rename the existing database user.",[40,958,959,964,967,971],{},[58,960,961],{},[61,962,963],{},"NEO4J_DATABASE",[58,965,966],{},"The database name on Memgraph. Not used on Neo4j.",[58,968,969],{},[61,970,922],{},[58,972,973],{},"Rarely.",[40,975,976,980,983,988],{},[58,977,978],{},[61,979,228],{},[58,981,982],{},"Where Memgraph keeps its data — a host path, or the name of the declared volume.",[58,984,985],{},[61,986,987],{},".\u002Fdata\u002Fmemgraph",[58,989,990],{},"See below.",[40,992,993,997,1000,1005],{},[58,994,995],{},[61,996,235],{},[58,998,999],{},"Where Neo4j keeps its data — a host path, or the name of the declared volume.",[58,1001,1002],{},[61,1003,1004],{},".\u002Fdata\u002Fneo4j",[58,1006,990],{},[40,1008,1009,1013,1016,1021],{},[58,1010,1011],{},[61,1012,238],{},[58,1014,1015],{},"Neo4j's Java heap, initial and maximum. The reference-data ingest parses large statements on the heap.",[58,1017,1018],{},[61,1019,1020],{},"2G",[58,1022,1023],{},"The ingest fails with a memory error on Neo4j.",[40,1025,1026,1030,1033,1038],{},[58,1027,1028],{},[61,1029,242],{},[58,1031,1032],{},"Neo4j's page cache, which holds the graph's files in memory.",[58,1034,1035],{},[61,1036,1037],{},"1G",[58,1039,1040],{},"A large graph reads slowly.",[14,1042,1043],{},"On either engine a single statement may run for at most 600 seconds.",[14,1045,385,1046,1049,1050,1052,1053,92],{},[67,1047,1048],{},"password is not here."," It is generated into ",[61,1051,79],{}," on the first start — see ",[121,1054,1056],{"href":1055},"#the-generated-secret-file","The generated secret file",[482,1058,1060],{"id":1059},"embedding","Embedding",[14,1062,1063,1064,1069,1070,1072],{},"The platform embeds in process with its built-in model, ",[67,1065,1066],{},[61,1067,1068],{},"embeddinggemma-300m-retrieval-v1"," (EmbeddingGemma 300m, by Google). There is no separate service to run or configure. The ",[61,1071,396],{}," section reads:",[615,1074,1077],{"className":1075,"code":1076,"language":620},[618],"# --- Embedding -----------------------------------------------------------------------------------------\n# The platform embeds in process with its built-in model, embeddinggemma-300m-retrieval-v1 (EmbeddingGemma,\n# Google). Its weights (about 1.26 GB) are downloaded from Hugging Face on the first start into data\u002Fmodels and\n# verified; '.\u002Fbyodt models pull' does it ahead of time. The model is licensed under the Gemma Terms of Use:\n# https:\u002F\u002Fai.google.dev\u002Fgemma\u002Fterms\n# Leave EMBEDDING_MODEL unset: the platform refuses any model other than the one its MITRE data was made with.\n# Inference threads (default 4): set to the host's cores (on Docker Desktop or a Podman machine, the VM's).\n# EMBEDDING_THREADS=4\n",[61,1078,1076],{"__ignoreMap":623},[26,1080,1083],{"className":1081,"tabIndex":30,"role":31,"ariaLabel":1082},[29],"Table: Embedding",[34,1084,1085,1097],{},[37,1086,1087],{},[40,1088,1089,1091,1093,1095],{},[43,1090,504],{},[43,1092,507],{},[43,1094,510],{},[43,1096,513],{},[53,1098,1099],{},[40,1100,1101,1105,1111,1114],{},[58,1102,1103],{},[61,1104,432],{},[58,1106,1107,1108,1110],{},"The embedding model the platform runs. Not in ",[61,1109,63],{}," by default, and it should stay that way.",[58,1112,1113],{},"Unset — the built-in model",[58,1115,1116],{},"Never, in this release. Any value other than the built-in model stops the start (see below).",[14,1118,1119,1125],{},[67,1120,1121,1122,1124],{},"Leave ",[61,1123,432],{}," unset."," The reference data's MITRE vectors were embedded with the built-in model, and a different model's queries would not match them. So any other value is refused before anything starts:",[345,1127,1128,1146],{},[348,1129,1130,1133,1134,1137,1138,229,1140,113,1142,1145],{},[61,1131,1132],{},"EMBEDDING_MODEL=embeddinggemma"," — the model the old ",[61,1135,1136],{},"ollama"," service ran — is refused by ",[61,1139,136],{},[61,1141,321],{},[61,1143,1144],{},".\u002Fbyodt models pull"," with an instruction to remove the line, however it is quoted, exported, or followed by a comment.",[348,1147,1148,1149,1152,1153,1155,1156,92],{},"Any other value is checked by ",[61,1150,1151],{},"console-init"," against the model this release's MITRE data was embedded with; on a mismatch it stops the start and the platform does not start. ",[61,1154,136],{}," then fails with ",[61,1157,1158],{},"'.\u002Fbyodt logs console-init' says why",[14,1160,1161,1162,1164,1165,1168,1169,1172,1173,229,1176,1179,1180,229,1182,113,1184,1186,1187,1189,1190,1192,1193,239,1195,1197,1198,1200],{},"Settings of the old ",[61,1163,1136],{}," service — ",[61,1166,1167],{},"OLLAMA_IMAGE"," and any other ",[61,1170,1171],{},"OLLAMA_*"," line, ",[61,1174,1175],{},"EMBEDDING_URL",[61,1177,1178],{},"EMBEDDING_SIMILARITY_THRESHOLD"," — are no longer used. ",[61,1181,136],{},[61,1183,321],{},[61,1185,1144],{}," print a notice for each one they find; you can remove the lines. ",[61,1188,321],{}," does not remove them: it never changes your settings in ",[61,1191,63],{},", and only records a missing ",[61,1194,403],{},[61,1196,254],{}," there (on Neo4j, ",[61,1199,408],{}," too).",[14,1202,1203,1206,1207,1210,1211,1213,1214,1216],{},[67,1204,1205],{},"The model's weights"," (about 1.26 GB) live in ",[61,1208,1209],{},"data\u002Fmodels"," on the host, mounted into the platform. The platform downloads them once from Hugging Face on the first start and verifies each file's sha256; ",[61,1212,1144],{}," does it ahead of time. A recreate or an upgrade that keeps the same model does not download them again. They are not secret and need no backup: a lost ",[61,1215,1209],{}," is downloaded again on the next start.",[14,1218,1219,1222,1223,1229,1230,1232],{},[67,1220,1221],{},"The licence."," The model is licensed under the ",[121,1224,1228],{"href":1225,"rel":1226},"https:\u002F\u002Fai.google.dev\u002Fgemma\u002Fterms",[1227],"nofollow","Gemma Terms of Use",". The platform logs the licence once before it downloads, and ",[61,1231,1144],{}," prints it.",[14,1234,1235,1238,1239,1241],{},[67,1236,1237],{},"Memory."," The model is held in the platform's own memory for as long as it runs, which adds roughly 0.8–0.9 GiB to the platform container. This replaces the memory the old ",[61,1240,1136],{}," service used, so the deployment's total is about the same as before.",[848,1243,1244],{},[14,1245,1246,1250,1251,1253,1254,92],{},[67,1247,1248],{},[61,1249,417],{}," sets the embedder's inference threads (default 4): a positive integer, at most 64. Set it in ",[61,1252,63],{}," to the host's core count if that differs — on a VM-backed runtime, such as Docker Desktop or a Podman machine, the virtual machine's core count. The bundle passes it to the platform; apply a change with ",[61,1255,136],{},[482,1257,1259],{"id":1258},"snapshots","Snapshots",[26,1261,1264],{"className":1262,"tabIndex":30,"role":31,"ariaLabel":1263},[29],"Table: Snapshots",[34,1265,1266,1278],{},[37,1267,1268],{},[40,1269,1270,1272,1274,1276],{},[43,1271,504],{},[43,1273,507],{},[43,1275,510],{},[43,1277,513],{},[53,1279,1280],{},[40,1281,1282,1286,1293,1298],{},[58,1283,1284],{},[61,1285,232],{},[58,1287,1288,1289,1292],{},"How often, in seconds, Memgraph writes an automatic in-place snapshot for crash recovery. ",[61,1290,1291],{},"0"," disables them. Not used on Neo4j.",[58,1294,1295],{},[61,1296,1297],{},"300",[58,1299,1300],{},"You want more or less frequent crash-recovery points.",[14,1302,1303,1304,92],{},"Applied on ",[61,1305,247],{},[14,1307,1308,1309,1312,1313,1315,1316,1319,1320,92],{},"Automatic in-place snapshots are ",[67,1310,1311],{},"not backups",". They live inside the data directory, are pruned over time by the database's own retention, and are lost with the machine. Use ",[61,1314,673],{}," for anything you want to keep — it copies the graph out to ",[61,1317,1318],{},"backups\u002F",". See ",[121,1321,1323],{"href":1322},"\u002Fbyodt-cloud\u002Foperations#backing-up-and-restoring-the-graph","Backing up and restoring",[482,1325,1327],{"id":1326},"module-source","Module source",[26,1329,1332],{"className":1330,"tabIndex":30,"role":31,"ariaLabel":1331},[29],"Table: Module source",[34,1333,1334,1346],{},[37,1335,1336],{},[40,1337,1338,1340,1342,1344],{},[43,1339,504],{},[43,1341,507],{},[43,1343,510],{},[43,1345,513],{},[53,1347,1348],{},[40,1349,1350,1355,1361,1364],{},[58,1351,1352],{},[61,1353,1354],{},"CONSOLE_RELEASE_BASE_URL",[58,1356,1357,1358,1360],{},"Where the one-shot fetches the signed module payloads from. The release itself is selected by ",[61,1359,490],{}," — the console never picks a version of its own.",[58,1362,1363],{},"The public project repository",[58,1365,973],{},[482,1367,1369],{"id":1368},"platform-settings-link","Platform \"Settings\" link",[26,1371,1374],{"className":1372,"tabIndex":30,"role":31,"ariaLabel":1373},[29],"Table: Platform \"Settings\" link",[34,1375,1376,1388],{},[37,1377,1378],{},[40,1379,1380,1382,1384,1386],{},[43,1381,504],{},[43,1383,507],{},[43,1385,510],{},[43,1387,513],{},[53,1389,1390],{},[40,1391,1392,1396,1403,1409],{},[58,1393,1394],{},[61,1395,420],{},[58,1397,1398,1399,1402],{},"The target of the ",[67,1400,1401],{},"Settings"," item in the platform's sidebar.",[58,1404,1405,1408],{},[61,1406,1407],{},"\u002Fconsole\u002F"," — the operator console on the same address",[58,1410,1411],{},"You front the console somewhere else, or you want the link hidden (set it empty).",[482,1413,1415],{"id":1414},"outbound-proxy","Outbound proxy",[14,1417,1418,1419,1423],{},"For a host whose only way to the internet is an HTTP proxy. The setup, in order, is in ",[121,1420,1422],{"href":1421},"\u002Fbyodt-cloud\u002Finstallation#behind-an-outbound-proxy","Installation → Behind an outbound proxy","; this section is the reference.",[26,1425,1428],{"className":1426,"tabIndex":30,"role":31,"ariaLabel":1427},[29],"Table: Outbound proxy",[34,1429,1430,1442],{},[37,1431,1432],{},[40,1433,1434,1436,1438,1440],{},[43,1435,504],{},[43,1437,507],{},[43,1439,510],{},[43,1441,513],{},[53,1443,1444,1474],{},[40,1445,1446,1450,1468,1471],{},[58,1447,1448],{},[61,1449,423],{},[58,1451,1452,1453,1455,1456,1459,1460,1462,1463,1467],{},"The proxy ",[61,1454,1151],{},", the platform and the console reach the internet through, as ",[61,1457,1458],{},"http:\u002F\u002Fhost:port",". No login in it: that goes in ",[61,1461,79],{}," (see ",[121,1464,1466],{"href":1465},"#the-outbound-proxys-login","The outbound proxy's login",").",[58,1469,1470],{},"Unset — they connect directly",[58,1472,1473],{},"The host reaches the internet only through a proxy.",[40,1475,1476,1480,1499,1502],{},[58,1477,1478],{},[61,1479,426],{},[58,1481,1482,1483,1486,1487,1489,1490,229,1493,229,1495,1498],{},"Extra hosts reached directly, not through the proxy: exact host names or addresses, each with an optional ",[61,1484,1485],{},":port",", separated by commas. ",[61,1488,447],{}," adds ",[61,1491,1492],{},"localhost",[61,1494,836],{},[61,1496,1497],{},"::1"," and the deployment's own service names.",[58,1500,1501],{},"Unset",[58,1503,1504,1505,1508],{},"A host the deployment calls over ",[61,1506,1507],{},"https:\u002F\u002F",", such as a LangGraph server, must bypass the proxy.",[14,1510,1303,1511,1513,1514,1516,1517,1519,1520,1522,1523,1525],{},[61,1512,136],{}," (or ",[61,1515,292],{},"). The proxy's login, ",[61,1518,190],{},", lives in ",[61,1521,79],{},", and the CA of a proxy that inspects TLS in ",[61,1524,204],{},"; both are described below.",[14,1527,1528,1536,1537,229,1539,1541,1542,1544,1545,229,1547,229,1549,229,1551,113,1554,1556,1557,1560,1561,1563,1564,1567,1568,229,1571,229,1574,229,1577,229,1580,113,1583,1586],{},[67,1529,1530,1532,1533,1535],{},[61,1531,447],{}," reads it from ",[61,1534,63],{}," only, never from your shell."," Operators behind a proxy often export one, and an upgrade must not start sending a deployment through a proxy it worked without. When your shell sets a different ",[61,1538,423],{},[61,1540,447],{}," prints a notice and goes on with ",[61,1543,63],{},"'s. It reads the setting for the commands that can create or recreate a service that calls out: ",[61,1546,370],{},[61,1548,460],{},[61,1550,463],{},[61,1552,1553],{},"models pull",[61,1555,778],{},", and for ",[61,1558,1559],{},"upgrade",", which downloads the new release through it (with the login from ",[61,1562,79],{},"; a TLS-inspecting proxy's CA must be in the host's trust store for that download, since ",[61,1565,1566],{},"proxy-ca\u002F"," reaches only the containers). ",[61,1569,1570],{},"down",[61,1572,1573],{},"status",[61,1575,1576],{},"logs",[61,1578,1579],{},"backup",[61,1581,1582],{},"restore",[61,1584,1585],{},"destroy"," do not read it, so a bad value does not stand in their way.",[14,1588,1589,1592,1593,1596,1597,1599,1600,1602,1603,1605,1606,1608,1609,1467],{},[67,1590,1591],{},"What goes through the proxy."," Only HTTPS. Everything the deployment fetches from outside is HTTPS, and every plain-HTTP call stays inside the stack or on your own network. So there is no ",[61,1594,1595],{},"HTTP_PROXY",": plain HTTP is never sent to the proxy, and ",[61,1598,447],{}," warns that an ",[61,1601,1595],{}," line in ",[61,1604,63],{}," is not used. ",[61,1607,1151],{},", the platform and the console get the setting. The database and the front door call nothing outside the stack, and get every proxy variable set empty. Image pulls do not use it either: the container engine pulls with its own setting (see ",[121,1610,1612],{"href":1611},"\u002Fbyodt-cloud\u002Finstallation#_1-give-the-container-engine-the-proxy","Installation → Give the container engine the proxy",[14,1614,1615,610,1618,1620,1621,1623],{},[67,1616,1617],{},"The URL.",[61,1619,447],{}," checks ",[61,1622,423],{}," before anything starts, and refuses, with a message that says what to fix, any value that breaks these rules:",[345,1625,1626,1635,1650,1676],{},[348,1627,1628,1629,239,1631,1634],{},"It is ",[61,1630,1458],{},[61,1632,1633],{},"https:\u002F\u002Fhost:port",", with a numeric port from 1 to 65535 and nothing after it.",[348,1636,1637,1639,1640,1643,1644,1646,1647,1649],{},[61,1638,1507],{}," means the services talk to the proxy itself over TLS. Most proxies take ",[61,1641,1642],{},"http:\u002F\u002F",": the scheme is only how the services reach the proxy, and the HTTPS connections they make through it stay HTTPS. Without a login, ",[61,1645,447],{}," warns about an ",[61,1648,1507],{}," value.",[348,1651,1652,1653,1655,1656,229,1659,229,1661,229,1664,1667,1668,1671,1672,1675],{},"The host is not ",[61,1654,1492],{}," or a loopback address: inside a container, that is the container itself. It is not one of the deployment's own service names either: ",[61,1657,1658],{},"db",[61,1660,1151],{},[61,1662,1663],{},"platform",[61,1665,1666],{},"proxy"," (the front door), ",[61,1669,1670],{},"console",", or a service ",[61,1673,1674],{},"compose.override.yaml"," adds. Use a name the containers can resolve, or the host's address on the network the proxy listens on.",[348,1677,1678,1679,1681,1682,191,1685,92],{},"It carries no login. ",[61,1680,447],{}," refuses ",[61,1683,1684],{},"user:password@",[61,1686,63],{},[14,1688,1689,610,1694,1696,1697,1700,1701,1704,1705,1708,1709,1712,1713,1715],{},[67,1690,1691,1693],{},[61,1692,426],{}," takes exact names only.",[61,1695,447],{}," refuses CIDR blocks (",[61,1698,1699],{},"10.0.0.0\u002F8","), address ranges, wildcards (",[61,1702,1703],{},"*.example.com","), a leading dot and spaces, because the services' HTTP clients read those forms differently. Do not rely on an entry to cover its subdomains either: the platform's core HTTPS agent matches the exact name only. List every host — ",[61,1706,1707],{},"login.example.com",", not ",[61,1710,1711],{},"example.com",". An ",[61,1714,1642],{}," destination, such as a LangGraph server on plain HTTP, needs no entry, because plain HTTP never goes to the proxy.",[1717,1718,1720],"h4",{"id":1719},"a-proxy-that-inspects-tls","A proxy that inspects TLS",[14,1722,1723],{},"Many corporate proxies re-sign every HTTPS connection with a CA of their own. The services then refuse every certificate the proxy presents, until they trust that CA.",[14,1725,1726,1729],{},[67,1727,1728],{},"Prefer pass-through."," Ask the proxy's operators to pass the identity provider your cloud connection names, and the content service, through uninspected. Use the CA file only when they cannot. The warning below says why.",[14,1731,1732,1735,1736,1738,1739,1741,1742,1744,1745,1748],{},[67,1733,1734],{},"The CA file"," is ",[61,1737,204],{},", in PEM form. It may hold more than one certificate. A private CA your identity provider uses goes in the same file. ",[61,1740,447],{}," creates ",[61,1743,1566],{}," (mode ",[61,1746,1747],{},"0755",") on the first start, and checks it before every command that reads the proxy setting. It refuses to go on when:",[345,1750,1751,1763,1768,1777],{},[348,1752,1753,1755,1756,1759,1760,1762],{},[61,1754,1566],{}," holds anything but ",[61,1757,1758],{},"proxy-ca.pem",". ",[61,1761,1151],{}," and the console trust every certificate file in the directory, and the platform only the one named, so another file would make them trust different CAs.",[348,1764,1765,1767],{},[61,1766,1758],{}," is a symbolic link, which does not resolve inside the containers.",[348,1769,1770,1772,1773,1776],{},[61,1771,1758],{}," is not readable by every account (mode ",[61,1774,1775],{},"0644","). The services read it under their own accounts.",[348,1778,1779],{},"The directory or the file is owned by another account (not you or root), or other accounts can write to it.",[14,1781,1782,1783,1786,1787,1789,1790,1793,1794,1796,1797,1799,1800,1802,1803,1805],{},"The platform adds the file to Node's trusted roots (",[61,1784,1785],{},"NODE_EXTRA_CA_CERTS","); ",[61,1788,1151],{}," and the console add it to Go's (",[61,1791,1792],{},"SSL_CERT_DIR","). It adds to the default roots and replaces none of them, and it applies whether or not ",[61,1795,423],{}," is set. Adding or removing the file is applied with ",[61,1798,136],{},". After replacing it, run ",[61,1801,221],{},": they read it only when they start. ",[61,1804,1151],{}," reads it on its next run.",[14,1807,1808,1809,92],{},"The CA reaches only the deployment's containers. For image pulls through an inspecting proxy, the container engine needs it in the host's trust store; see ",[121,1810,1612],{"href":1611},[848,1812,1813,1825,1845],{},[14,1814,1815,1818,1819,1821,1822,1824],{},[67,1816,1817],{},"Warning: what trusting the CA hands over."," It covers every TLS connection ",[61,1820,1151],{},", the platform and the console make, the ",[61,1823,426],{}," hosts included (for hosts reached directly, from a position on the path). Whoever holds the CA's key can read and change all of it:",[345,1826,1827,1833,1839],{},[348,1828,1829,1832],{},[67,1830,1831],{},"Sign-in."," It can serve its own signing keys in place of the identity provider's, and so sign anyone in to the platform and the console, administrators included. It can also forge the answer the console's administrator check reads.",[348,1834,1835,1838],{},[67,1836,1837],{},"Content."," It can change any response that carries no signature of its own: the catalog, the knowledge graph, templates, guides and evaluation results.",[348,1840,1841,1844],{},[67,1842,1843],{},"What is sent."," It can read the operator's cloud token, users' sign-in tokens, the threat-model attributes sent for evaluation, and knowledge-graph queries.",[14,1846,1847],{},"Signed content stays checked against what does not come from the network. Code modules are verified against a trusted root embedded in the console image and the identity pinned to the release. Cloud artifacts are verified against the signer your cloud recipe names. The model's weights are checked against the sha256 the platform image pins. A change to any of them fails its check.",[482,1849,1851],{"id":1850},"upgrades","Upgrades",[26,1853,1856],{"className":1854,"tabIndex":30,"role":31,"ariaLabel":1855},[29],"Table: Upgrades",[34,1857,1858,1870],{},[37,1859,1860],{},[40,1861,1862,1864,1866,1868],{},[43,1863,504],{},[43,1865,507],{},[43,1867,510],{},[43,1869,513],{},[53,1871,1872],{},[40,1873,1874,1878,1894,1908],{},[58,1875,1876],{},[61,1877,337],{},[58,1879,1880,1882,1883,1886,1887,1890,1891,1893],{},[61,1881,476],{}," makes every upgrade of this deployment refuse a release that cosign did not verify, as ",[61,1884,1885],{},"--require-signature"," does. An upgrade given ",[61,1888,1889],{},"--allow-unsigned"," is refused before anything is downloaded. ",[61,1892,479],{},", or an empty value, leaves it to the flags. Any other value stops every upgrade.",[58,1895,1896,1897,1900,1901,1904,1905,1907],{},"Unset — an upgrade whose signature cannot be checked (cosign is not installed, or an installer ",[61,1898,1899],{},"--tarball"," has no ",[61,1902,1903],{},".bundle"," beside it) asks at a terminal, and needs ",[61,1906,1889],{}," unattended. A signature cosign rejects always stops the upgrade",[58,1909,1910],{},"cosign is installed on this host and no upgrade should run without it.",[14,1912,1913,1914,1916,1917,1920,1921,1923,1924,1927,1928,113,1930,1932,1933,1936,1937,1939,1940,229,1943,239,1946,1949,1950,1952,1953,1956,1957,1959,1960,92],{},"Both ",[61,1915,325],{}," and the installer's ",[61,1918,1919],{},"--upgrade"," read it from this deployment's ",[61,1922,63],{},", as compose would read the line (quotes and an ",[61,1925,1926],{},"export "," prefix are fine). ",[61,1929,476],{},[61,1931,479],{}," count in any case, so ",[61,1934,1935],{},"True"," counts as ",[61,1938,476],{},". Any other value, such as ",[61,1941,1942],{},"yes",[61,1944,1945],{},"1",[61,1947,1948],{},"on",", may have been meant as ",[61,1951,476],{},", so the upgrade stops before anything is downloaded, with ",[61,1954,1955],{},".env sets UPGRADE_REQUIRE_SIGNATURE=yes, which is neither true nor false. Nothing was changed."," An upgrade never changes the setting. An account that cannot read ",[61,1958,63],{}," cannot tell whether it is set, so its upgrade stops instead of going on without it. See ",[121,1961,1963],{"href":1962},"\u002Fbyodt-cloud\u002Foperations#signatures","Operations → Signatures",[18,1965],{},[21,1967,1056],{"id":1968},"the-generated-secret-file",[14,1970,1971,1973],{},[61,1972,79],{}," holds one generated value, the database password:",[615,1975,1978],{"className":1976,"code":1977,"language":620},[618],"NEO4J_PASSWORD=…\n",[61,1979,1977],{"__ignoreMap":623},[14,1981,1982,1983,1985,1986,1989],{},"It is generated on the first start, written with mode ",[61,1984,91],{},", and ",[67,1987,1988],{},"never regenerated",". Every later command reads it; nothing rewrites it.",[14,1991,1992,1993,1995],{},"It can hold one value you add yourself: the outbound proxy's login (see ",[121,1994,1466],{"href":1465}," below).",[482,1997,1999],{"id":1998},"why-it-must-be-kept","Why it must be kept",[14,2001,2002],{},"The database's own credentials were created from this password when the database first started. The file and the data are a matched pair:",[345,2004,2005,2011],{},[348,2006,2007,2010],{},[67,2008,2009],{},"Lose it while the graph exists, and you are locked out of your own data."," A new password would be generated on the next start, the database would keep expecting the old one, and the database would never come up healthy — which stops the whole deployment, because the platform waits for it.",[348,2012,2013,2016],{},[67,2014,2015],{},"It is not in your backups."," A backup — a Memgraph snapshot or a Neo4j dump — is the graph only; database credentials are separate state and are not captured. That is what makes a backup portable and not a secret-bearing file — and it is also why the password file needs its own protection.",[482,2018,2020],{"id":2019},"how-to-treat-it","How to treat it",[345,2022,2023,2029,2035],{},[348,2024,2025,2028],{},[67,2026,2027],{},"Back it up separately",", somewhere private. It is the key to your graph.",[348,2030,2031,2034],{},[67,2032,2033],{},"Never commit it."," The bundle ignores it, along with every other generated file.",[348,2036,2037,2040,2041,2044,2045,2048],{},[67,2038,2039],{},"Do not delete it to \"reset\" anything."," If you want a clean graph, delete the ",[529,2042,2043],{},"data"," and keep the password — a fresh database adopts the password already on disk. ",[61,2046,2047],{},".\u002Fbyodt destroy"," prints the exact commands for your storage setting.",[482,2050,2052],{"id":2051},"how-memgraph-stores-it","How Memgraph stores it",[14,2054,2055,2056,191,2059,2062],{},"On Memgraph, the bundle stores the password with a salted, iterated SHA-256 hash (",[61,2057,2058],{},"--password-encryption-algorithm=sha256-multiple",[61,2060,2061],{},"compose.memgraph.yaml","), not Memgraph's default, bcrypt. A bcrypt login holds a lock that queries wait for, so a burst of new database connections — after a restart, for example — stalls queries for seconds; with this hash a login costs almost nothing. Neo4j is unaffected.",[14,2064,2065,2066,113,2068,2070,2071,610,2074,2076,2077,2079,2080,239,2082,2084],{},"Memgraph keeps each stored hash in the algorithm it was made with, so ",[61,2067,136],{},[61,2069,321],{}," set the database user's password again to the value it already has. They do it after a full start, or a start of a service that depends on the database; a start of only the console or only the database skips it. ",[67,2072,2073],{},"No password changes:",[61,2075,79],{}," is not touched, and the platform logs in as before. The re-apply takes the password from the database container's own environment, puts it on no command line, and never prints it. If it fails, ",[61,2078,447],{}," warns and carries on — logins still work, only slower — and the next ",[61,2081,136],{},[61,2083,321],{}," tries again. Going back to an older bundle is safe: it still verifies the stored hash.",[14,2086,2087],{},"The re-apply covers only a password of the generated shape — lowercase hex, 32 characters or more — and a user name of letters, digits and underscores that does not start with a digit. On an existing deployment, any other password keeps the hash it has; a new deployment stores any password with the faster hash from the start.",[14,2089,2090,2093,2094,2097,2098,113,2100,660,2102,2105,2106,2108,2109,1467],{},[67,2091,2092],{},"If you set your own password, make it long and random."," The generated one is 48 random hex characters (192 bits), too long to guess or crack whatever the hash; generate yours the same way, with ",[61,2095,2096],{},"openssl rand -hex 24",". On Memgraph, ",[61,2099,136],{},[61,2101,321],{},[61,2103,2104],{},"NEO4J_PASSWORD"," is shorter than 32 characters. On an existing deployment, set the new password in the database first and only then in ",[61,2107,79],{},": changing the file alone locks the platform out (see ",[121,2110,1999],{"href":2111},"#why-it-must-be-kept",[482,2113,1466],{"id":2114},"the-outbound-proxys-login",[14,2116,2117,2118,2120],{},"If your outbound proxy needs a login, add it to ",[61,2119,79],{}," on a line of its own:",[615,2122,2125],{"className":2123,"code":2124,"language":620},[618],"HTTPS_PROXY_USERINFO=user:password\n",[61,2126,2124],{"__ignoreMap":623},[14,2128,2129,2132,2133,2136],{},[67,2130,2131],{},"How to write it."," The user name and the password, separated by exactly one colon, with no quotes. Every other character must be a letter, a digit, or one of ",[61,2134,2135],{},". _ ~ - ! & ' ( ) * + , ; =",". Percent-encode the rest, in the user name as well as the password:",[26,2138,2141],{"className":2139,"tabIndex":30,"role":31,"ariaLabel":2140},[29],"Table: The outbound proxy's login",[34,2142,2143,2153],{},[37,2144,2145],{},[40,2146,2147,2150],{},[43,2148,2149],{},"Character",[43,2151,2152],{},"Write it as",[53,2154,2155,2167,2179,2191,2203,2215,2227,2237],{},[40,2156,2157,2162],{},[58,2158,2159],{},[61,2160,2161],{},"#",[58,2163,2164],{},[61,2165,2166],{},"%23",[40,2168,2169,2174],{},[58,2170,2171],{},[61,2172,2173],{},"\u002F",[58,2175,2176],{},[61,2177,2178],{},"%2F",[40,2180,2181,2186],{},[58,2182,2183],{},[61,2184,2185],{},"@",[58,2187,2188],{},[61,2189,2190],{},"%40",[40,2192,2193,2198],{},[58,2194,2195],{},[61,2196,2197],{},":",[58,2199,2200],{},[61,2201,2202],{},"%3A",[40,2204,2205,2210],{},[58,2206,2207],{},[61,2208,2209],{},"$",[58,2211,2212],{},[61,2213,2214],{},"%24",[40,2216,2217,2222],{},[58,2218,2219],{},[61,2220,2221],{},"%",[58,2223,2224],{},[61,2225,2226],{},"%25",[40,2228,2229,2232],{},[58,2230,2231],{},"A space",[58,2233,2234],{},[61,2235,2236],{},"%20",[40,2238,2239,2242],{},[58,2240,2241],{},"A character outside ASCII",[58,2243,2244,2245,2248,2249],{},"Its UTF-8 bytes, for example ",[61,2246,2247],{},"é"," as ",[61,2250,2251],{},"%C3%A9",[14,2253,2254,2256],{},[61,2255,447],{}," refuses anything else before it starts a service. Node and Go print a proxy URL they cannot parse in full, login included, so an invalid one must never reach them. Only basic authentication is supported: a proxy that needs NTLM or Kerberos login is not.",[14,2258,2259,610,2262,2264,2265,2267,2268,2270,2271,2273,2274,191,2276,2278,2279,2281],{},[67,2260,2261],{},"How it is used.",[61,2263,447],{}," adds the login to ",[61,2266,423],{}," only in the environment it passes to ",[61,2269,1151],{},", the platform and the console. It never writes the combined URL to a file. Apply a change with ",[61,2272,136],{},". A login with no ",[61,2275,423],{},[61,2277,63],{}," is not used, and ",[61,2280,447],{}," warns about it.",[14,2283,2284,2287,2288,2291],{},[67,2285,2286],{},"Where it is masked."," As ",[61,2289,2290],{},"***",", in these places only:",[345,2293,2294,2299,2304,2307],{},[348,2295,2296,2298],{},[61,2297,447],{},"'s own messages.",[348,2300,2301,2303],{},[61,2302,1151],{},"'s error for a failed module download, in its log and in the status it leaves for the console.",[348,2305,2306],{},"The console's errors for a failed call to the cloud content service or to the platform.",[348,2308,2309],{},"The platform's errors for a failed fetch of the sign-in keys, of cloud content, or of the embedding model's weights.",[14,2311,2312,2313,1985,2316,2319,2320,2322],{},"Other error text is not masked. In tests, Node's own proxy errors left the login out: a failed tunnel reads ",[61,2314,2315],{},"Failed to establish tunnel to \u003Chost>:443 via http:\u002F\u002F\u003Cproxy-host>:\u003Cport>\u002F",[61,2317,2318],{},"fetch","'s errors named no login. The one error seen with the login in it was Node's for a proxy URL it cannot parse, at the platform's start, and ",[61,2321,447],{},"'s checks above refuse such a URL first. No service log carried the login in those tests. It does show wherever the services' environment is shown, as listed next.",[14,2324,2325,2328],{},[67,2326,2327],{},"Who can see it."," The same accounts that can see the database password:",[345,2330,2331,2344],{},[348,2332,2333,2334,239,2337,2340,2341,92],{},"Anyone who can run your container engine: ",[61,2335,2336],{},"docker inspect",[61,2338,2339],{},"podman inspect"," shows the environment of those three services in full, and so does ",[61,2342,2343],{},".\u002Fbyodt compose config",[348,2345,2346,2347,2350,2351,2354,2355,2357,2358,2360],{},"Under ",[61,2348,2349],{},"podman-compose",", any local account that lists processes (",[61,2352,2353],{},"ps","), while containers are created: the encoded login is on the ",[61,2356,747],{}," command lines ",[61,2359,2349],{}," runs, as the database password is. Docker Compose passes the environment through the engine's API, not on a command line.",[14,2362,2363,2366,2367,2369,2370,2372],{},[67,2364,2365],{},"On the network."," With an ",[61,2368,1642],{}," proxy URL, the login crosses the network to the proxy in clear, on every connection. Use ",[61,2371,1507],{}," if the proxy offers it.",[18,2374],{},[21,2376,267],{"id":2377},"the-database-engine",[14,2379,2380,2382,2383,2385,2386,2388],{},[61,2381,254],{}," selects the graph database: ",[61,2384,922],{}," (the default) or ",[61,2387,925],{}," (Neo4j 5.26 Community). The rest of the deployment is the same on either.",[26,2390,2393],{"className":2391,"tabIndex":30,"role":31,"ariaLabel":2392},[29],"Table: The database engine",[34,2394,2395,2407],{},[37,2396,2397],{},[40,2398,2399,2401,2404],{},[43,2400],{},[43,2402,2403],{},"Memgraph",[43,2405,2406],{},"Neo4j",[53,2408,2409,2425,2444,2459,2479,2498,2509],{},[40,2410,2411,2414,2418],{},[58,2412,2413],{},"Image",[58,2415,2416],{},[61,2417,545],{},[58,2419,2420,2422,2423],{},[61,2421,408],{},", recorded on the first run as the tested image ",[61,2424,578],{},[40,2426,2427,2430,2438],{},[58,2428,2429],{},"Data",[58,2431,2432,2434,2435,2437],{},[61,2433,228],{}," (default ",[61,2436,987],{},")",[58,2439,2440,2434,2442,2437],{},[61,2441,235],{},[61,2443,1004],{},[40,2445,2446,2449,2454],{},[58,2447,2448],{},"Logs",[58,2450,2451],{},[61,2452,2453],{},"data\u002Fmemgraph-log",[58,2455,2456],{},[61,2457,2458],{},"data\u002Fneo4j-logs",[40,2460,2461,2464,2467],{},[58,2462,2463],{},"Memory",[58,2465,2466],{},"A fixed 4096 MiB limit",[58,2468,2469,2471,2472,2474,2475,2471,2477,2437],{},[61,2470,238],{}," (",[61,2473,1020],{},") plus ",[61,2476,242],{},[61,2478,1037],{},[40,2480,2481,2484,2491],{},[58,2482,2483],{},"Login",[58,2485,2486,2488,2489],{},[61,2487,945],{},", to database ",[61,2490,963],{},[58,2492,2493,2494,2488,2496],{},"Always user ",[61,2495,925],{},[61,2497,925],{},[40,2499,2500,2503,2506],{},[58,2501,2502],{},"Backup",[58,2504,2505],{},"A snapshot, with no downtime",[58,2507,2508],{},"A dump; the database is stopped meanwhile",[40,2510,2511,2514,2517],{},[58,2512,2513],{},"Licence",[58,2515,2516],{},"BSL 1.1",[58,2518,2519],{},"GPLv3",[14,2521,2522,2528,2529,2531,2532,2534,2535,2537,2538,2540,2541,2543,2544,2547,2548,2550,2551,2553,2554,2557,2558,2560,2561,2563],{},[67,2523,2524,2525,2527],{},"How ",[61,2526,447],{}," picks it."," An exported ",[61,2530,254],{}," wins, for that one command. Otherwise the value in ",[61,2533,63],{},"; otherwise ",[61,2536,922],{},". On the first run ",[61,2539,447],{}," writes the result into ",[61,2542,63],{},", so a deployment first started with ",[61,2545,2546],{},"DB_ENGINE=neo4j .\u002Fbyodt up"," stays on Neo4j. It reads the ",[61,2549,63],{}," line as compose does, so an ",[61,2552,1926],{}," prefix or a trailing ",[61,2555,2556],{}," # comment"," is fine. Any other value stops ",[61,2559,447],{}," with an error that says whether it came from ",[61,2562,63],{}," or from your shell's environment.",[14,2565,2566,2569,2570,2572,2573,2575,2576,1759,2578,113,2580,191,2582,2584,2585,2587],{},[67,2567,2568],{},"The Neo4j login."," Neo4j Community serves one database, ",[61,2571,925],{},", and the platform logs in as its administrator, ",[61,2574,925],{},", with the password from ",[61,2577,79],{},[61,2579,945],{},[61,2581,963],{},[61,2583,63],{}," are not used. When they say something else, ",[61,2586,447],{}," prints a notice for each, once, on the first Neo4j run; it changes nothing, and you can remove the lines or leave them.",[14,2589,2590,2593,2594,2597,2598,2601,2602,2605,2606,2609,2610,2613,2614,2617,2618,2620,2621,2623,2624,2627],{},[67,2591,2592],{},"APOC Core on Neo4j."," The platform needs two APOC Core functions on Neo4j: ",[61,2595,2596],{},"apoc.date.convertFormat",", which every date-and-time field is read through, and ",[61,2599,2600],{},"apoc.util.validatePredicate",", which the checks in some updates run through. The bundle loads APOC Core from the jar the Neo4j image ships in its ",[61,2603,2604],{},"labs\u002F"," directory: ",[61,2607,2608],{},"compose.neo4j.yaml"," points the plugins directory there (",[61,2611,2612],{},"NEO4J_server_directories_plugins",") and names the two functions in the procedure allowlist (",[61,2615,2616],{},"NEO4J_dbms_security_procedures_allowlist","). Only those two load: no other APOC procedure or function can be called, and none is given unrestricted access. Nothing is copied or downloaded. An image you set in ",[61,2619,408],{}," must ship APOC Core in ",[61,2622,2604],{},", as the official Neo4j images do. At startup the platform checks that both functions are there and run. When they are not, it still starts, but logs an error that names the missing functions, or says that they are listed but cannot run (",[61,2625,2626],{},".\u002Fbyodt logs platform","); without them, every query that reads a date-and-time field fails.",[14,2629,2630,2633],{},[67,2631,2632],{},"Switching is a new, empty graph."," Each engine keeps its own data, and nothing converts one into the other; each engine also refuses the other's backup file. After a switch the one-shot ingests the reference data again, and your models stay behind in the old engine's store. To switch from Memgraph to Neo4j:",[615,2635,2637],{"className":761,"code":2636,"language":763,"meta":623,"style":623},".\u002Fbyodt backup                       # on the current engine, to keep its graph\n.\u002Fbyodt down\nmv data\u002Fmemgraph data\u002Fmemgraph.old   # move the current engine's data aside\n# set DB_ENGINE=neo4j in .env\n.\u002Fbyodt up\n",[61,2638,2639,2644,2650,2656,2662],{"__ignoreMap":623},[767,2640,2641],{"class":769,"line":770},[767,2642,2643],{},".\u002Fbyodt backup                       # on the current engine, to keep its graph\n",[767,2645,2647],{"class":769,"line":2646},2,[767,2648,2649],{},".\u002Fbyodt down\n",[767,2651,2653],{"class":769,"line":2652},3,[767,2654,2655],{},"mv data\u002Fmemgraph data\u002Fmemgraph.old   # move the current engine's data aside\n",[767,2657,2659],{"class":769,"line":2658},4,[767,2660,2661],{},"# set DB_ENGINE=neo4j in .env\n",[767,2663,2665],{"class":769,"line":2664},5,[767,2666,2667],{},".\u002Fbyodt up\n",[14,2669,2670,2671,229,2673,229,2675,113,2677,2680,2681,2683,2684,113,2686,2689,2690,2692],{},"Switching back works the same way, with the names swapped. With the data in named volumes there is nothing to move: each engine has its own volume. If you leave the old data in place, ",[61,2672,136],{},[61,2674,292],{},[61,2676,321],{},[61,2678,2679],{},".\u002Fbyodt bootstrap"," refuse to start an engine whose data directory is empty while the other engine's holds a graph, and say what to do. The check runs before ",[61,2682,447],{}," records anything, so a refused start leaves ",[61,2685,63],{},[61,2687,2688],{},"data\u002F"," as they were: an exported ",[61,2691,254],{}," that is refused is not recorded. That check needs both stores to be host bind mounts: a store in a named volume is not checked.",[18,2694],{},[21,2696,2698],{"id":2697},"where-the-database-keeps-its-data","Where the database keeps its data",[14,2700,2701,2703,2704,2706],{},[61,2702,228],{}," (Memgraph) or ",[61,2705,235],{}," (Neo4j) chooses between two stores.",[26,2708,2711],{"className":2709,"tabIndex":30,"role":31,"ariaLabel":2710},[29],"Table: Where the database keeps its data",[34,2712,2713,2729],{},[37,2714,2715],{},[40,2716,2717,2720,2723,2726],{},[43,2718,2719],{},"Value",[43,2721,2722],{},"Store",[43,2724,2725],{},"Good for",[43,2727,2728],{},"Trade-off",[53,2730,2731,2749],{},[40,2732,2733,2740,2743,2746],{},[58,2734,2735,239,2737,2739],{},[61,2736,987],{},[61,2738,1004],{}," (default)",[58,2741,2742],{},"A host bind mount inside the bundle directory",[58,2744,2745],{},"Native Linux, under either container engine. Visible on disk, easy to inspect and copy.",[58,2747,2748],{},"On a VM-backed runtime, the file-sharing layer can corrupt a running database.",[40,2750,2751,2759,2762,2765],{},[58,2752,2753,239,2756],{},[61,2754,2755],{},"memgraph-data",[61,2757,2758],{},"neo4j-data",[58,2760,2761],{},"The named volume declared in the engine's compose file, in the container engine's own storage",[58,2763,2764],{},"A VM-backed runtime, one that runs containers in a virtual machine: Docker Desktop, or a Podman machine on macOS or Windows",[58,2766,2767],{},"You cannot browse it from the host.",[14,2769,2770,2771,239,2773,2775],{},"Any value starting with ",[61,2772,92],{},[61,2774,2173],{}," is treated as a host path; anything else is treated as a volume name.",[14,2777,2778,2779,2781,2782,92],{},"On a bind mount, ",[61,2780,447],{}," runs the database as the user that owns the directory — Memgraph requires that, and which user it is depends on your container engine, so the control script works it out rather than asking you to. The practical consequence is that your data stays owned by you and readable from the host, which is the reason to pick a bind mount in the first place. Under rootless Podman, Neo4j's files belong to the container's user instead: remove them with ",[61,2783,2784],{},"podman unshare rm -rf data\u002Fneo4j",[14,2786,2787,2788,2790,2791,2794,2795,239,2797,1985,2799,2801,2802,2805],{},"The bundle expects to be driven through ",[61,2789,447],{},". The database service is not in ",[61,2792,2793],{},"compose.yaml"," but in ",[61,2796,2061],{},[61,2798,2608],{},[61,2800,447],{}," passes the right one along with the user it derived. A raw ",[61,2803,2804],{},"compose up"," has neither, and the database will not start.",[848,2807,2808,2814],{},[14,2809,2810,2813],{},[67,2811,2812],{},"Switching is a fresh database, not a migration."," The two are separate stores. Change the setting and the deployment starts against an empty database — your existing data is still in the old store, untouched, but the deployment no longer looks there. To carry data across, take a backup first, switch, then restore:",[615,2815,2817],{"className":761,"code":2816,"language":763,"meta":623,"style":623},".\u002Fbyodt backup                                   # while still on the old store\n# edit DB_DATA in .env\n.\u002Fbyodt restart db\n.\u002Fbyodt restore backups\u002F\u003Cthe file you just made>\n",[61,2818,2819,2824,2829,2834],{"__ignoreMap":623},[767,2820,2821],{"class":769,"line":770},[767,2822,2823],{},".\u002Fbyodt backup                                   # while still on the old store\n",[767,2825,2826],{"class":769,"line":2646},[767,2827,2828],{},"# edit DB_DATA in .env\n",[767,2830,2831],{"class":769,"line":2652},[767,2832,2833],{},".\u002Fbyodt restart db\n",[767,2835,2836],{"class":769,"line":2658},[767,2837,2838],{},".\u002Fbyodt restore backups\u002F\u003Cthe file you just made>\n",[14,2840,2841,2842,239,2844,2846,2847,92],{},"Apply a change to ",[61,2843,228],{},[61,2845,235],{}," with ",[61,2848,247],{},[18,2850],{},[21,2852,2854],{"id":2853},"local-changes-to-the-compose-files","Local changes to the compose files",[14,2856,2857,2858,2860,2861,2863,2864,2866,2867,2869,2870,229,2873,239,2876,229,2879,113,2881,2883],{},"Put your own compose changes in ",[61,2859,1674],{}," in the bundle directory. ",[61,2862,447],{}," passes it to compose last, after ",[61,2865,2793],{}," and the engine's file, and a bundle upgrade does not overwrite it. ",[61,2868,447],{}," loads no other override file name: when it finds ",[61,2871,2872],{},"compose.override.yml",[61,2874,2875],{},"docker-compose.override.yaml",[61,2877,2878],{},"docker-compose.override.yml",[61,2880,136],{},[61,2882,321],{}," warn that the file is not loaded. Rename it to use it.",[18,2885],{},[21,2887,2889,2890,2437],{"id":2888},"the-mode-layer-modemodeenv","The mode layer (",[61,2891,99],{},[14,2893,2894],{},"This file is written by the console and read by the platform and the one-shot. It carries the deployment's authentication posture — nothing else — and it exists so that connecting or disconnecting the cloud is a console action rather than a configuration exercise.",[14,2896,2897],{},"On a standalone deployment it holds exactly two values, seeded on the first start:",[615,2899,2902],{"className":2900,"code":2901,"language":620},[618],"ENABLE_NOAUTH=true\nNODE_ENV=development\n",[61,2903,2901],{"__ignoreMap":623},[14,2905,2906],{},"That is the unauthenticated single-operator posture. Security headers and the platform's query-depth guard apply in every mode regardless.",[14,2908,2909],{},"Four console controls write this file, and nothing else does. Two of them replace it whole; the other two each rewrite a single line.",[26,2911,2914],{"className":2912,"tabIndex":30,"role":31,"ariaLabel":2913},[29],"Table: The mode layer (mode\u002Fmode.env)",[34,2915,2916,2929],{},[37,2917,2918],{},[40,2919,2920,2923,2926],{},[43,2921,2922],{},"Control",[43,2924,2925],{},"What it writes",[43,2927,2928],{},"What applies it",[53,2930,2931,2950,2969,3003],{},[40,2932,2933,2943,2946],{},[58,2934,2935,2938,2939,2942],{},[67,2936,2937],{},"Apply cloud configuration",", in section ",[67,2940,2941],{},"2 · Configuration"," of the Cloud tab",[58,2944,2945],{},"The whole file, replaced with the identity settings from your deployment recipe",[58,2947,2948],{},[61,2949,292],{},[40,2951,2952,2962,2965],{},[58,2953,2954,2957,2958,2961],{},[67,2955,2956],{},"Disconnect from cloud",", in the ",[67,2959,2960],{},"Disconnect"," section at the foot of the Cloud tab",[58,2963,2964],{},"The whole file, replaced with the two standalone values above",[58,2966,2967],{},[61,2968,292],{},[40,2970,2971,2992,2999],{},[58,2972,385,2973,2976,2977,2980,2981,229,2984,2987,2988,2991],{},[67,2974,2975],{},"Who may sign in"," card, section ",[67,2978,2979],{},"3 · Who may sign in"," of the Cloud tab — ",[67,2982,2983],{},"Apply",[67,2985,2986],{},"Remove people who have left",", or the paste box's ",[67,2989,2990],{},"Apply access list",", all through one write",[58,2993,2994,2995,2998],{},"One line, ",[61,2996,2997],{},"DEPLOYMENT_ALLOWLIST",". Every other value is left exactly as it was",[58,3000,3001],{},[61,3002,302],{},[40,3004,3005,3011,3017],{},[58,3006,3007,3010],{},[67,3008,3009],{},"Update to the … version",", on the knowledge-graph entry of the Content tab",[58,3012,2994,3013,3016],{},[61,3014,3015],{},"MODULE_KG_VERSION"," — the knowledge-graph version this deployment is pinned to. Every other value is left exactly as it was",[58,3018,3019],{},[61,3020,302],{},[14,3022,3023,3024,3027],{},"It is always rewritten, ",[67,3025,3026],{},"never deleted"," — a missing file would break the very recovery path disconnecting is.",[14,3029,3030,3033,3034,113,3038,92],{},[67,3031,3032],{},"Which restart follows from which value moved, not from which file was written."," Connecting and disconnecting change values that several services read, so the whole stack has to come back up in the new mode. The access list and the knowledge-graph version are read only by the platform, so only the platform is recreated — and that restart removes no module, so it has none of the consequences for your classes and links that a restart finding a module missing does. See ",[121,3035,3037],{"href":3036},"\u002Fbyodt-cloud\u002Fcloud#changing-who-may-sign-in","Cloud → Changing who may sign in",[121,3039,3041],{"href":3040},"\u002Fbyodt-cloud\u002Fcloud#update-the-knowledge-graph","Cloud → Update the knowledge graph",[14,3043,3044,3047,3048,92],{},[67,3045,3046],{},"Do not hand-edit this file — reading it is fine."," The console is its author, it validates everything it writes, and it refuses values that do not belong there; a hand edit gets none of those checks, and a connect or a disconnect replaces the file whole, so it would not survive one anyway. Make changes from the console instead; see ",[121,3049,3051],{"href":3050},"\u002Fbyodt-cloud\u002Fcloud","Cloud",[14,3053,3054,3055,3057,3058,92],{},"There is one good reason to open it. Nothing in the console shows you who may currently sign in, so the ",[61,3056,2997],{}," line here is the only place to check whether an apply dropped somebody — see ",[121,3059,3061],{"href":3060},"\u002Fbyodt-cloud\u002Ftroubleshooting#i-need-to-see-who-is-on-the-access-list","Troubleshooting → I need to see who is on the access list",[18,3063],{},[21,3065,3067,3068,3070],{"id":3066},"files-byodt-keeps-for-itself","Files ",[61,3069,447],{}," keeps for itself",[14,3072,3073,3074,3076,3077,3079],{},"Besides your configuration, ",[61,3075,447],{}," keeps a few records in the bundle directory. Leave them in place: they belong to the deployment, not to a release. No release ships them; ",[61,3078,447],{}," writes them itself.",[26,3081,3084],{"className":3082,"tabIndex":30,"role":31,"ariaLabel":3083},[29],"Table: Files byodt keeps for itself",[34,3085,3086,3096],{},[37,3087,3088],{},[40,3089,3090,3093],{},[43,3091,3092],{},"Path",[43,3094,3095],{},"What it is",[53,3097,3098,3111,3125,3138],{},[40,3099,3100,3105],{},[58,3101,3102],{},[61,3103,3104],{},".byodt-release",[58,3106,3107,3108,3110],{},"The release this deployment runs, and the SHA-256 of every file that release shipped. Written by ",[61,3109,126],{}," or the first start, and by each upgrade. The next upgrade checks your local edits against it.",[40,3112,3113,3118],{},[58,3114,3115],{},[61,3116,3117],{},"third-party-acknowledgement.log",[58,3119,3120,3121,92],{},"One line for each confirmation of the third-party notice. See ",[121,3122,3124],{"href":3123},"\u002Fbyodt-cloud\u002Finstallation#the-third-party-notice","Installation → The third-party notice",[40,3126,3127,3132],{},[58,3128,3129],{},[61,3130,3131],{},"backups\u002Fupgrade-\u003Cfrom>-to-\u003Cto>-\u003Ctime>\u002F",[58,3133,3134,3135,3137],{},"Each upgrade's backup: the graph, ",[61,3136,63],{},", the release record and the old release's files. Readable by you only. The upgrade's rollback steps restore from it.",[40,3139,3140,3154],{},[58,3141,3142,229,3145,229,3148,229,3151],{},[61,3143,3144],{},".byodt-upgrade.state",[61,3146,3147],{},".byodt-upgrade.lock",[61,3149,3150],{},".byodt-upgrade.lock.takeover",[61,3152,3153],{},".byodt-upgrade.XXXXXX\u002F",[58,3155,3156,3157,3159,3160,92],{},"An upgrade in progress: its journal, its lock (and, while it takes over a stale lock, the takeover lock), and its staging folder. They go when the upgrade finishes or is dropped. Do not remove them by hand while an upgrade is half done; run ",[61,3158,325],{},", or ",[61,3161,3162],{},".\u002Fbyodt upgrade --abandon",[18,3164],{},[21,3166,3168],{"id":3167},"what-to-back-up","What to back up",[14,3170,3171],{},"Two separate things, with different lifetimes:",[26,3173,3176],{"className":3174,"tabIndex":30,"role":31,"ariaLabel":3175},[29],"Table: What to back up",[34,3177,3178,3191],{},[37,3179,3180],{},[40,3181,3182,3185,3188],{},[43,3183,3184],{},"What",[43,3186,3187],{},"Why",[43,3189,3190],{},"How",[53,3192,3193,3208],{},[40,3194,3195,3198,3201],{},[58,3196,3197],{},"The graph",[58,3199,3200],{},"Your models, findings, and controls",[58,3202,3203,3205,3206,92],{},[61,3204,673],{},", then copy the file off the machine. See ",[121,3207,1323],{"href":1322},[40,3209,3210,3223,3226],{},[58,3211,3212,229,3214,229,3216,229,3219,229,3221],{},[61,3213,63],{},[61,3215,79],{},[61,3217,3218],{},"mode\u002F",[61,3220,276],{},[61,3222,1566],{},[58,3224,3225],{},"Your configuration, the database password and any proxy login, the posture, your certificate, and any proxy CA",[58,3227,3228],{},"Copy them somewhere private. They are small and change rarely.",[14,3230,3231],{},"With those two, a lost machine costs you a re-download and a restore — not your work.",[18,3233],{},[21,3235,3237],{"id":3236},"related","Related",[345,3239,3240,3247,3252],{},[348,3241,3242,3246],{},[121,3243,3245],{"href":3244},"\u002Fbyodt-cloud\u002Foperations","Operations"," — the command reference, backups, TLS, and upgrades.",[348,3248,3249,3251],{},[121,3250,3051],{"href":3050}," — connecting the deployment, which is what writes the mode layer.",[348,3253,3254,3258],{},[121,3255,3257],{"href":3256},"\u002Fbyodt-cloud\u002Ftroubleshooting","Troubleshooting"," — what a misapplied change looks like, and how to fix it.",[3260,3261,3262],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":623,"searchDepth":2652,"depth":2652,"links":3264},[3265,3266,3267,3283,3289,3290,3291,3292,3294,3296,3297],{"id":23,"depth":2646,"text":24},{"id":145,"depth":2646,"text":146},{"id":384,"depth":2646,"text":3268,"children":3269},"The .env reference",[3270,3271,3272,3273,3274,3275,3276,3277,3278,3279,3282],{"id":484,"depth":2652,"text":485},{"id":711,"depth":2652,"text":712},{"id":782,"depth":2652,"text":783},{"id":874,"depth":2652,"text":875},{"id":889,"depth":2652,"text":890},{"id":1059,"depth":2652,"text":1060},{"id":1258,"depth":2652,"text":1259},{"id":1326,"depth":2652,"text":1327},{"id":1368,"depth":2652,"text":1369},{"id":1414,"depth":2652,"text":1415,"children":3280},[3281],{"id":1719,"depth":2658,"text":1720},{"id":1850,"depth":2652,"text":1851},{"id":1968,"depth":2646,"text":1056,"children":3284},[3285,3286,3287,3288],{"id":1998,"depth":2652,"text":1999},{"id":2019,"depth":2652,"text":2020},{"id":2051,"depth":2652,"text":2052},{"id":2114,"depth":2652,"text":1466},{"id":2377,"depth":2646,"text":267},{"id":2697,"depth":2646,"text":2698},{"id":2853,"depth":2646,"text":2854},{"id":2888,"depth":2646,"text":3293},"The mode layer (mode\u002Fmode.env)",{"id":3066,"depth":2646,"text":3295},"Files byodt keeps for itself",{"id":3167,"depth":2646,"text":3168},{"id":3236,"depth":2646,"text":3237},"The .env settings reference, the generated secret file, database storage, and how to apply a change","md",{"category":3301,"position":2652,"tags":3302},"documentation",[447,3303,3304,3305,3306],"deployment","configuration","reference","env",true,"\u002Fbyodt-cloud\u002Fconfiguration",{"title":5,"description":3298},"02.byodt-cloud\u002F02.configuration","5BS06uJJNp3eGd_yrmLSLpBue3HCe6RbFY0iHrjzcic",[3313,3368,3396,3451,3485,3529,3544,3614],{"title":3314,"description":3315,"path":3316,"stem":3317,"children":3318,"page":-1},"Platform","Modelling, analysis, findings and controls in the Dethernety platform.","\u002Fplatform","01.platform",[3319,3323,3328,3333,3338,3343,3348,3353,3358,3363],{"title":3320,"path":3316,"stem":3321,"description":3322},"Dethernety User Documentation","01.platform\u002Findex","User guide for the Dethernety threat modeling platform",{"title":3324,"path":3325,"stem":3326,"description":3327},"Quick Start","\u002Fplatform\u002Fquick-start","01.platform\u002F01.quick-start","Install Dethernety on your own machine, draw a four-element model and read its first threat finding.",{"title":3329,"path":3330,"stem":3331,"description":3332},"Building Your First Model","\u002Fplatform\u002Fbuilding-your-first-model","01.platform\u002F02.building-your-first-model","Build a threat model of an online store in about 30 minutes, run a Threat Report on it, and raise an issue from a finding.",{"title":3334,"path":3335,"stem":3336,"description":3337},"Security Analysis Workflow","\u002Fplatform\u002Fsecurity-analysis-workflow","01.platform\u002F03.security-analysis-workflow","How to run security analysis and interpret results to improve your threat models.",{"title":3339,"path":3340,"stem":3341,"description":3342},"Managing Findings","\u002Fplatform\u002Fmanaging-findings","01.platform\u002F04.managing-findings","Record decisions on system-generated exposures and countermeasures — affirm them as confirmed live risk, or mute them as not applicable, false positive, waived, or superseded — instead of deleting them.",{"title":3344,"path":3345,"stem":3346,"description":3347},"Working with Security Controls","\u002Fplatform\u002Fworking-with-security-controls","01.platform\u002F05.working-with-security-controls","Learn how to create, manage, and assign reusable security controls in Dethernety to protect your threat models.",{"title":3349,"path":3350,"stem":3351,"description":3352},"Issue Management Guide","\u002Fplatform\u002Fissue-management-guide","01.platform\u002F06.issue-management-guide","Issue tracking, filtering, and management in Dethernety.",{"title":3354,"path":3355,"stem":3356,"description":3357},"Boundary Trust Zones","\u002Fplatform\u002Fboundary-trust-zones","01.platform\u002F07.boundary-trust-zones","Record each security boundary's trust zone, business domains, operational role, and approved channels to document how your system is meant to be segmented.",{"title":3359,"path":3360,"stem":3361,"description":3362},"Understanding Modules","\u002Fplatform\u002Funderstanding-modules","01.platform\u002F08.understanding-modules","How Dethernety's module system extends your threat modeling capabilities.",{"title":3364,"path":3365,"stem":3366,"description":3367},"Component Configuration Guide","\u002Fplatform\u002Fcomponent-configuration-guide","01.platform\u002F09.component-configuration-guide","Detailed guide on configuring different types of components and their security implications.",{"title":3369,"description":3370,"path":3371,"stem":3372,"children":3373,"page":-1},"BYODt cloud","Deploying the platform yourself and connecting it to the BYODt cloud.","\u002Fbyodt-cloud","02.byodt-cloud",[3374,3378,3383,3384,3388,3392],{"title":3375,"path":3371,"stem":3376,"description":3377},"BYODt Deployment","02.byodt-cloud\u002Findex","Run Dethernety on your own machine: install, configure, operate, and recover",{"title":3379,"path":3380,"stem":3381,"description":3382},"Installing the BYODt Deployment","\u002Fbyodt-cloud\u002Finstallation","02.byodt-cloud\u002F01.installation","Install Dethernety on your own machine: check the requirements, download and verify the signed bundle, start it, and confirm the deployment is healthy",{"title":5,"path":3308,"stem":3310,"description":3298},{"title":3385,"path":3244,"stem":3386,"description":3387},"Operating the BYODt Deployment","02.byodt-cloud\u002F03.operations","The byodt command reference and the day-to-day tasks: start, stop, inspect, back up, restore, TLS, upgrade, remove",{"title":3389,"path":3050,"stem":3390,"description":3391},"Connecting the BYODt Deployment to the Cloud","02.byodt-cloud\u002F04.cloud","Add cloud sign-in and content packages from the operator console, and disconnect again",{"title":3393,"path":3256,"stem":3394,"description":3395},"Troubleshooting the BYODt Deployment","02.byodt-cloud\u002F05.troubleshooting","Symptom, cause, and fix for the failures this deployment reports",{"title":3397,"description":3398,"path":3399,"stem":3400,"children":3401,"page":-1},"Dethereal","The Claude Code plugin: build a threat model in conversation and publish it to the platform.","\u002Fdethereal","03.dethereal",[3402,3406,3411,3416,3421,3426,3431,3436,3441,3446],{"title":3403,"path":3399,"stem":3404,"description":3405},"Dethereal — Claude Code Plugin for Threat Modeling","03.dethereal\u002Findex","Comprehensive documentation for the Dethereal threat modeling plugin",{"title":3407,"path":3408,"stem":3409,"description":3410},"Getting Started with Dethereal","\u002Fdethereal\u002Fgetting-started","03.dethereal\u002F01.getting-started","Install the plugin, authenticate, and create your first threat model",{"title":3412,"path":3413,"stem":3414,"description":3415},"The 11-Step Guided Workflow","\u002Fdethereal\u002Fguided-workflow","03.dethereal\u002F02.guided-workflow","Complete walkthrough of the \u002Fdethereal:threat-model guided process",{"title":3417,"path":3418,"stem":3419,"description":3420},"Command Reference","\u002Fdethereal\u002Fcommand-reference","03.dethereal\u002F03.command-reference","Complete reference for all 14 Dethereal slash commands",{"title":3422,"path":3423,"stem":3424,"description":3425},"Threat Model Concepts","\u002Fdethereal\u002Fmodel-concepts","03.dethereal\u002F04.model-concepts","Components, boundaries, data flows, classes, attributes, and quality scoring",{"title":3427,"path":3428,"stem":3429,"description":3430},"Discovery and Enrichment","\u002Fdethereal\u002Fdiscovery-and-enrichment","03.dethereal\u002F05.discovery-and-enrichment","Infrastructure scanning, security attributes, MITRE ATT&CK, credentials, and compliance",{"title":3432,"path":3433,"stem":3434,"description":3435},"Sync and Version Control","\u002Fdethereal\u002Fsync-and-version-control","03.dethereal\u002F06.sync-and-version-control","Push\u002Fpull workflow, conflict handling, git integration, and multi-model projects",{"title":3437,"path":3438,"stem":3439,"description":3440},"Review and Attack Surface Analysis","\u002Fdethereal\u002Freview-and-analysis","03.dethereal\u002F07.review-and-analysis","Quality review, attack surface summary, and platform analysis integration",{"title":3442,"path":3443,"stem":3444,"description":3445},"Agents, Tools, and Hooks","\u002Fdethereal\u002Fagents-and-architecture","03.dethereal\u002F08.agents-and-architecture","How the 5 AI agents, 22 MCP tools, and 3 lifecycle hooks work together",{"title":3447,"path":3448,"stem":3449,"description":3450},"Dethereal Glossary","\u002Fdethereal\u002Fglossary","03.dethereal\u002F09.glossary","Definitions for Dethereal-specific terminology",{"title":3452,"description":3453,"path":3454,"stem":3455,"children":3456,"page":-1},"Threat Report","The residual-risk report over a threat model: reading it, filtering it and exporting it.","\u002Fthreat-report","04.threat-report",[3457,3460,3465,3470,3475,3480],{"title":3452,"path":3454,"stem":3458,"description":3459},"04.threat-report\u002Findex","Read, filter, drill into, and export a residual-risk report over a threat model",{"title":3461,"path":3462,"stem":3463,"description":3464},"Getting Started with the Threat Report","\u002Fthreat-report\u002Fgetting-started","04.threat-report\u002F01.getting-started","Generate, open, refresh, and export a threat report over a model",{"title":3466,"path":3467,"stem":3468,"description":3469},"Reading the Report","\u002Fthreat-report\u002Freading-the-report","04.threat-report\u002F02.reading-the-report","Navigating the report, the shared visual language, and the Posture and Boundary Crossings views",{"title":3471,"path":3472,"stem":3473,"description":3474},"Understanding Coverage and Gaps","\u002Fthreat-report\u002Funderstanding-coverage","04.threat-report\u002F03.understanding-coverage","Reading the MITRE ATT&CK coverage matrix: tiers, prevent vs detect, off-grid notes, and what coverage does and does not mean",{"title":3476,"path":3477,"stem":3478,"description":3479},"Reachability and Flow Routes","\u002Fthreat-report\u002Freachability","04.threat-report\u002F04.reachability","Exploring flow routes to crown-jewel assets and between any two elements — and what the analysis does and does not model",{"title":3481,"path":3482,"stem":3483,"description":3484},"Working with Findings","\u002Fthreat-report\u002Fworking-with-findings","04.threat-report\u002F05.working-with-findings","The Residual Risk ledger, triaging findings, filtering, and the per-element Component Profile",{"title":3486,"description":3487,"path":3488,"stem":3489,"children":3490,"page":-1},"Risk assessment","The risk assessment module: the register, the reports and the method behind them.","\u002Frisk-assessment","05.risk-assessment",[3491,3495,3500,3505,3510,3515,3519,3524],{"title":3492,"path":3488,"stem":3493,"description":3494},"Dethernety Risk Assessment User Guide","05.risk-assessment\u002Findex","Dethernety Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report. From one point-in-time assessment of your model you get a prioritized worklist, a likelihood × impact risk matrix, a security-coverage posture, ten kinds of finding, a management risk register your team authors and maintains, and audience-tiered stakeholder reports — Board, Risk Committee, and Technical — plus machine-readable data exports.",{"title":3496,"path":3497,"stem":3498,"description":3499},"FAQ and Troubleshooting","\u002Frisk-assessment\u002Ffaq","05.risk-assessment\u002F01.faq","Short answers to the questions analysts, risk managers, and compliance officers ask most often about the Risk Assessment. Each answer links to the guide that covers it in full.",{"title":3501,"path":3502,"stem":3503,"description":3504},"Findings","\u002Frisk-assessment\u002Ffindings","05.risk-assessment\u002F02.findings","A finding is a specific observation the Risk Assessment makes about your threat model. Every finding is grounded in something concrete you have declared — an element, a data flow, a trust zone, a crown jewel — and it points you at a place worth a closer look. This guide is the reference to open when you see a finding and want to know what it means and what to do about it.",{"title":3506,"path":3507,"stem":3508,"description":3509},"Getting Started","\u002Frisk-assessment\u002Fgetting-started","05.risk-assessment\u002F03.getting-started","Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report — a prioritized worklist, a likelihood × impact matrix, a security-coverage posture, ten kinds of finding, a risk register your team authors, and audience-tiered stakeholder reports and exports.",{"title":3511,"path":3512,"stem":3513,"description":3514},"Methodology and Trust","\u002Frisk-assessment\u002Fmethodology-and-trust","05.risk-assessment\u002F04.methodology-and-trust","Every number in a Risk Assessment is meant to survive scrutiny. This chapter explains why you can trust the report and — just as importantly — what it deliberately declines to claim, so you can put it in front of your board, a regulator, or an external auditor and defend every line.",{"title":3466,"path":3516,"stem":3517,"description":3518},"\u002Frisk-assessment\u002Freading-the-report","05.risk-assessment\u002F05.reading-the-report","The Risk Assessment turns your threat model into a single, scannable draft risk report: an executive summary at the top and a set of analytical tabs below it. This guide explains how to read what you see — what a matrix cell means, how coverage is stated, what a severity band is (and is not), and how to interpret each tab.",{"title":3520,"path":3521,"stem":3522,"description":3523},"Stakeholder Reports and Exports","\u002Frisk-assessment\u002Fstakeholder-reports","05.risk-assessment\u002F06.stakeholder-reports","One assessment produces reporting for every audience you answer to. From a single generated Risk Assessment you can hand your board a one-page brief, give your risk committee the full reconciliation, keep the complete technical detail for your own team, and export the underlying data into your GRC tool — without ever re-running anything or reconciling one document against another.",{"title":3525,"path":3526,"stem":3527,"description":3528},"The Risk Register","\u002Frisk-assessment\u002Fthe-risk-register","05.risk-assessment\u002F07.the-risk-register","The Risk Register is where your team records and manages the real risks your organisation is carrying — on top of, but separate from, what the analysis computed for you. Each entry is written by a person: a plain-language risk statement, your own assessment of how likely it is and how much it would hurt, the findings and elements from the analysis that back it up, a treatment decision, an owner, a review date, and a reference handle you can quote in a ticket or a board pack.",{"title":3530,"description":3531,"path":3532,"stem":3533,"children":3534,"page":-1},"Threat Patterns","The Threat Patterns module and its modelling checklist.","\u002Fthreat-patterns","06.threat-patterns",[3535,3539],{"title":3536,"path":3532,"stem":3537,"description":3538},"Threat Patterns User Guide","06.threat-patterns\u002Findex","Threat Patterns finds threats in your model that no single element shows on its own. Each one appears only when several elements line up. For example, an agent may read content anyone can write, hold private data, and be able to send data where an outsider reads it. Each element can look acceptable alone, but together they form a path an attacker can use.",{"title":3540,"path":3541,"stem":3542,"description":3543},"Modelling Checklist","\u002Fthreat-patterns\u002Fmodelling-checklist","06.threat-patterns\u002F01.modelling-checklist","Threat Patterns decides a leg only from what your model states. An unanswered attribute or field is undetermined, never read as \"no\". This checklist lists the facts and drawings the analysis asks for most often. For each one it says where to set it and which leg it settles. Attribute names are shown as they appear on the class, in code.",{"title":3545,"description":3546,"path":3547,"stem":3548,"children":3549,"page":-1},"Agentic modelling","A hands-on training: model one agentic system step by step, with Threat Patterns after each step.","\u002Fagentic-modelling","07.agentic-modelling",[3550,3554,3559,3564,3569,3574,3579,3584,3589,3594,3599,3604,3609],{"title":3551,"path":3547,"stem":3552,"description":3553},"Model an Agentic Architecture","07.agentic-modelling\u002Findex","A hands-on training in modelling systems that run AI agents, so that Threat Patterns can analyse them. You build one system, a fictional customer-support copilot, in eleven short lessons. Each lesson adds one thing to the model, and you run Threat Patterns after each one to see what the change did.",{"title":3555,"path":3556,"stem":3557,"description":3558},"Lesson 1: Draw the Agent and What It Talks To","\u002Fagentic-modelling\u002F01-draw-the-agent","07.agentic-modelling\u002F01.01-draw-the-agent","Training overview · Lesson 1 of 11 · Next: Say what data moves",{"title":3560,"path":3561,"stem":3562,"description":3563},"Lesson 2: Say What Data Moves","\u002Fagentic-modelling\u002F02-say-what-data-moves","07.agentic-modelling\u002F02.02-say-what-data-moves","Training overview · Lesson 2 of 11 · Previous: Draw the agent · Next: Mark who is outside",{"title":3565,"path":3566,"stem":3567,"description":3568},"Lesson 3: Mark Who Is Outside","\u002Fagentic-modelling\u002F03-mark-who-is-outside","07.agentic-modelling\u002F03.03-mark-who-is-outside","Training overview · Lesson 3 of 11 · Previous: Say what data moves · Next: Draw a tool that reaches any host",{"title":3570,"path":3571,"stem":3572,"description":3573},"Lesson 4: Draw a Tool That Reaches Any Host","\u002Fagentic-modelling\u002F04-draw-a-tool-that-reaches-any-host","07.agentic-modelling\u002F04.04-draw-a-tool-that-reaches-any-host","Training overview · Lesson 4 of 11 · Previous: Mark who is outside · Next: State what the agent can do",{"title":3575,"path":3576,"stem":3577,"description":3578},"Lesson 5: State What the Agent Can Do","\u002Fagentic-modelling\u002F05-state-what-the-agent-can-do","07.agentic-modelling\u002F05.05-state-what-the-agent-can-do","Training overview · Lesson 5 of 11 · Previous: Draw a tool that reaches any host · Next: Fix a finding with a fact",{"title":3580,"path":3581,"stem":3582,"description":3583},"Lesson 6: Fix a Finding With a Fact","\u002Fagentic-modelling\u002F06-fix-a-finding-with-a-fact","07.agentic-modelling\u002F06.06-fix-a-finding-with-a-fact","Training overview · Lesson 6 of 11 · Previous: State what the agent can do · Next: Record a compensating control",{"title":3585,"path":3586,"stem":3587,"description":3588},"Lesson 7: Record a Compensating Control","\u002Fagentic-modelling\u002F07-record-a-compensating-control","07.agentic-modelling\u002F07.07-record-a-compensating-control","Training overview · Lesson 7 of 11 · Previous: Fix a finding with a fact · Next: Leave what you don't know open",{"title":3590,"path":3591,"stem":3592,"description":3593},"Lesson 8: Leave What You Don't Know Open","\u002Fagentic-modelling\u002F08-leave-unknowns-open","07.agentic-modelling\u002F08.08-leave-unknowns-open","Training overview · Lesson 8 of 11 · Previous: Record a compensating control · Next: Follow a credential",{"title":3595,"path":3596,"stem":3597,"description":3598},"Lesson 9: Follow a Credential","\u002Fagentic-modelling\u002F09-follow-a-credential","07.agentic-modelling\u002F09.09-follow-a-credential","Training overview · Lesson 9 of 11 · Previous: Leave what you don't know open · Next: Watch what gets into knowledge and memory",{"title":3600,"path":3601,"stem":3602,"description":3603},"Lesson 10: Watch What Gets Into Knowledge and Memory","\u002Fagentic-modelling\u002F10-what-gets-in","07.agentic-modelling\u002F10.10-what-gets-in","Training overview · Lesson 10 of 11 · Previous: Follow a credential · Next: Draw tools from others and hand-offs",{"title":3605,"path":3606,"stem":3607,"description":3608},"Lesson 11: Draw Tools From Others and Hand-offs","\u002Fagentic-modelling\u002F11-tools-and-handoffs","07.agentic-modelling\u002F11.11-tools-and-handoffs","Training overview · Lesson 11 of 11 · Previous: Watch what gets into knowledge and memory",{"title":3610,"path":3611,"stem":3612,"description":3613},"The recipe at a glance","\u002Fagentic-modelling\u002Frecipe-at-a-glance","07.agentic-modelling\u002F12.recipe-at-a-glance","The ten steps of the training on one page. Each lesson teaches one or two of them.",{"title":3615,"description":3616,"path":3617,"stem":3618,"children":3619,"page":-1},"BYODt subscription","Subscribing on the BYODt Portal, and moving a deployment you already run to a new team.","\u002Fbyodt-subscription","08.byodt-subscription",[3620,3624,3629],{"title":3621,"path":3617,"stem":3622,"description":3623},"BYODt Subscription","08.byodt-subscription\u002Findex","Buy content for the deployment you run yourself, and decide where that deployment goes when you buy a team edition",{"title":3625,"path":3626,"stem":3627,"description":3628},"Your Subscription","\u002Fbyodt-subscription\u002Fyour-subscription","08.byodt-subscription\u002F01.your-subscription","Create an account, subscribe by card, and find the values your deployment needs on the portal",{"title":3630,"path":3631,"stem":3632,"description":3633},"Moving a Deployment to a New Team","\u002Fbyodt-subscription\u002Fmoving-a-deployment-to-a-new-team","08.byodt-subscription\u002F02.moving-a-deployment-to-a-new-team","What to do with the deployment you already run once you buy a team edition: three ways forward, best first",1793748185298]