Install Attest

These steps describe a new evaluation instance. A clean Linux-host installation and complete live workflow are not yet release-accepted. Do not overwrite an existing environment file, encryption key or database.

Configure the instanceCopy Anchor Link

From the repository root, create a private environment file only for a new instance:

umask 077
cp .env.example .env
chmod 600 .env

Set a strong URL-safe POSTGRES_PASSWORD, the public HTTPS origin in APP_BASE_URL, a persistent 32-byte base64 INSTANCE_ENCRYPTION_KEY, and a random INSTANCE_BOOTSTRAP_SECRET of at least 32 characters. Set ANTHROPIC_API_KEY and the exact account-supported ANTHROPIC_MODEL. Store secrets securely and never commit .env.

Back up the encryption key separately from the database. Losing it makes encrypted credentials unrecoverable. Existing instances must retain their key across restarts.

Start the servicesCopy Anchor Link

Configure HTTPS ingress to the API's loopback port, including the GitHub webhook and callback paths. Keep PostgreSQL and the browser worker private. Then run:

docker compose config --quiet
docker compose up --build -d --wait
docker compose ps
curl --fail http://127.0.0.1:8080/readyz

Do not print the expanded Compose configuration: it contains secrets. /readyz checks database connectivity; it does not prove GitHub, model or browser readiness. Create the administrator at the HTTPS /login page using the bootstrap secret.

Continue to connect GitHub. For backups, recovery and upgrades, consult the repository's docs/operations.md before operating an instance.