Prerequisites

Check everything below before you start the Installation.

Server

A user with sudo rights, and SSH access to the server.
A fixed IP address. In domain mode, also a DNS name pointing at it.
Docker Engine 24+, Docker Compose v2, and Nginx are installed during the Installation - they do not need to be present beforehand.

Decide how users will reach AuthNull, because it changes the .env settings and the Nginx configuration:

Mode	Use when	You also need
Domain with HTTPS	The server is reachable by a DNS name	Control of the customer's DNS, to create two A records (`onprem.<domain>` and `default.<org>.<domain>`), and port 80 open for certificate validation
Bare IP over HTTP	The server is reached by IP address only - for example on a private network over VPN	Nothing extra. Passkeys are not available in this mode; push MFA and authenticator app codes are

Port	From	Needed for
`22/tcp`	Administrators	SSH
`80/tcp`	Users	The console (bare-IP mode), and HTTPS redirect and certificate validation (domain mode)
`443/tcp`	Users	The console (domain mode)

Products add their own ports later - for example 6133 (PostgreSQL) or 6033 (MySQL) for Database MFA. Each product guide lists them.

The server must be able to reach:

Destination	Port	Why
`docker-repo-public.authnull.com`	443	Pulling the AuthNull container images
`download.docker.com`, Ubuntu package mirrors	443 / 80	Installing Docker, Nginx, and other packages
`github.com`, `raw.githubusercontent.com`	443	Product agent installers (for example the database agent and ProxySQL)
`smtp.elasticemail.com`	2525	Sending verification, invitation, and enrolment emails
Your MFA provider	443	Delivering pushes: your Okta org or Duo API hostname; for the AuthNull Authenticator, Google Firebase Cloud Messaging
`api.ipify.org`	443	Used by ProxySQL on each database login (Database MFA only)

note

If image pulls are refused, log in to the registry with the credentials AuthNull provided: docker login docker-repo-public.authnull.com.

An email address you can read - the organization's sign-up and verification emails go there.
The organization name (ORG_NAME). It becomes part of the tenant name, so choose it before you start.
An MFA provider:
- AuthNull Authenticator - nothing to prepare; users install the app on their phones.
- Duo Security - an admin account to create an application and obtain its API hostname, Integration key, and Secret key.
- Okta Verify - an Okta admin account to create an API token. Users need Okta Verify enrolled, with the same email address as in AuthNull.
A phone for each user who will approve pushes, including you for testing.

Continue to Installation.