Skip to main content

First Deployment

This guide runs the Smart Corridors & e-Gates stack for the first time using the official Docker Compose package. By the end, the dashboard and the Hub's GraphQL API are reachable.

1. Clone the deployment repository​

The deployment package — Compose file, environment files, and the helper scripts — lives in the border-control repository:

git clone https://github.com/innovatrics/border-control.git
cd border-control/smart-corridors-and-e-gates

2. Registry access​

The deployment pulls images from two registries: the Innovatrics registry for the Smart Corridors & e-Gates images (corridor-foundation-service, corridor-identity-grouping-service, biometriccorridor, at registry.dot.innovatrics.com/border-control/), and the GitLab registry for the VPP platform and the license-manager image. Authenticate to both before the first run.

Access to the Innovatrics registry is granted through a robot account — one dedicated account per client, scoped to the products you are entitled to, with no expiration. The robot account name and token, and the GitLab registry credentials, are provided from the Innovatrics Customer Portal:

docker login registry.dot.innovatrics.com -u 'inno-border-control+puller' -p '<token>'
docker login registry.gitlab.com

The robot account name (inno-border-control+puller above) and token are exactly as provided in the Customer Portal — substitute your own values. Both logins persist in ~/.docker/config.json.

Replaces the old GitLab shared account

Earlier Smart Corridor deliveries used a shared GitLab account (sf-distribution) for image pulls. The Smart Corridors & e-Gates images now live in the Innovatrics registry with a per-client robot account instead of a shared login.

3. Obtain a license​

The platform requires an iengine.lic file tied to the hardware of the host. Get the hardware ID by running the license-manager image:

docker run registry.gitlab.com/innovatrics/smartface/license-manager:3.2.7

Provide the printed hardware ID when requesting a license from the Customer Portal. Once you receive the file, place it at:

./secrets/iengine.lic
note

On WSL2 the hardware ID differs from a native Linux host. Contact your Innovatrics sales representative for a WSL2-compatible license.

4. Configure the environment​

Two files drive configuration:

  • .env — image registry and version tags: HARBOR, CIGS_VERSION, HUB_VERSION, FRONTEND_REGISTRY, FRONTEND_VERSION, and FRONTEND_PORT (dashboard port, default 8095). Use the version values from your release notes.
  • .env.hub — Hub wiring: VPP_ADAPTER_ALLOWED_WATCHLISTS (watchlist IDs that grant GREEN clearance), the FOUNDATION_UNITS_0_* unit/camera definitions, and the MinIO storage settings.

If you want face-crop thumbnails to load in the browser, set HOST_S3_IP to the host's LAN IP so the browser can reach MinIO directly; otherwise it defaults to the in-network minio hostname and thumbnails won't render.

5. Run the stack​

run.sh links the license into the VPP folder, starts VPP and its dependencies, creates the MinIO bucket, and brings up the corridor services:

bash run.sh

6. Verify​

When the script finishes, these endpoints are available on the host:

ServiceURL
Corridor dashboardhttp://localhost:8095
Hub GraphQLhttp://localhost:8090/corridor-foundation/graphql
Hub GraphiQL explorerhttp://localhost:8090/corridor-foundation/graphiql
CIGS healthhttp://localhost:8096/actuator/health
VPP Adminhttp://localhost:8000

Default credentials for the supporting services (development defaults — change for production): RabbitMQ http://localhost:15672 (guest / guest), MinIO http://localhost:9001 (minioadmin / minioadmin), pgAdmin http://localhost:7070 (admin@admin.com / Test1234).

Open the GraphiQL explorer, or check container status:

docker compose ps
docker compose logs <service-name>

Stopping and resetting​

bash stop.sh            # stop all services, keep data
bash factory-reset.sh   # stop and wipe all containers, images, and volumes

Next steps​