# Install on Azure App Services

Azure App Services runs Sentinel as a managed Linux container — no cluster or CLI required if you deploy through the portal template, and a familiar target if your infrastructure is already on Azure.

## Prerequisites

- An active Microsoft Azure account.

## Instance sizing

- **Testing/small deployments** — Basic B2 (3.5 GB RAM, 2 vCPU).
- **Production** — Premium tier, 2 vCPUs minimum. RAM beyond 16 GB provides no additional benefit.

## Step 1 — Deploy the stack

The quickest path is the pre-built ARM template:

1. Click **Deploy to Azure** (or open the [template directly](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2Faltcha-org%2Faltcha-sentinel-deploy-azure%2Fmain%2Fazuredeploy.json)) from [altcha-org/altcha-sentinel-deploy-azure](https://github.com/altcha-org/altcha-sentinel-deploy-azure).
2. Follow the Azure portal instructions, proceeding with the default pre-configured values.
3. Adjust the application version parameter if you want a specific release — see [Releases](/docs/sentinel/releases/) for available versions.

### Manual deployment

If you'd rather set it up by hand instead of using the template:

1. In the Azure Portal, go to **App Services → Create → Web App**.
2. Choose **Container** publishing, **Linux** as the OS, and **Basic B2** or higher as the tier.
3. Skip database configuration during setup — see [Configuring a database](#configuring-a-database) below.
4. On the container step, set:
- Image source: public registry
- Registry: `https://ghcr.io`
- Image and tag: `altcha-org/sentinel:<version>`

## Persistent storage

Sentinel needs `/data` to persist across restarts. Create an Azure Files share, then mount it under the Web App's **Configuration → Path mappings → New Azure Storage Mount**:

- **Name**: `altcha_sentinel_data`
- **Type**: Azure Files
- **Protocol**: SMB
- **Mount path**: `/data`

## Configuring a database

By default Sentinel uses its own embedded storage under `/data`. For an external database, add the connection string as an app setting (environment variable) under **Configuration → Application settings** — see [Databases](/docs/sentinel/databases/) for supported engines and connection formats.

## Step 2 — Access the application

Once deployed, Sentinel is reachable at:

- Web interface: `https://[your-app-name].azurewebsites.net/`
- API: `https://[your-app-name].azurewebsites.net/v1`
- API documentation: `https://[your-app-name].azurewebsites.net/v1/docs`

App Service provides HTTPS on the `azurewebsites.net` domain by default; see Azure's own docs if you want to map a custom domain.

Sign in with the default credentials `root` / `root` and change the password immediately.

## Production configuration

<Callout>

Multi-replica (multi-instance) deployments require a **Professional** or **Enterprise** license. Trial licenses support up to 3 instances for testing; other tiers must run a single instance. See [License](/docs/sentinel/security/license/) and [Pricing](/pricing/).

Production deployments should run multiple instances for high availability, which needs four app settings configured identically across every instance. Add them under **Configuration → Application settings**, or via the CLI:

```bash
az webapp config appsettings set \
--name <app-name> \
--resource-group <group> \
--settings \
SECRET_SEED="<a long random string, identical on every node>" \
LICENSE_KEY="<license key>" \
POSTGRES_URL="postgresql://user:password@your-db-host:5432/altcha_sentinel" \
REDIS_URL="redis://default@your-redis-host:6379"
```

See [Clustering](/docs/sentinel/operations/clustering/#minimum-production-configuration) for what each variable does, and [ENV Variables](/docs/sentinel/operations/env-variables/) for the full reference.

## Upgrading Sentinel

Point the Web App at a new image tag and restart:

```bash
az webapp config container set \
--name <app-name> \
--resource-group <group> \
--docker-custom-image-name ghcr.io/altcha-org/sentinel:<version>

az webapp restart --name <app-name> --resource-group <group>
```

Verify the running image:

```bash
az webapp config container show \
--name <app-name> \
--resource-group <group> \
--query "docker_image_name"
```

## Next steps

- **[Configure](/docs/sentinel/configure/)** — set up your first Security Group and API Key.
- **[Monitoring & Logging](/docs/sentinel/operations/monitoring-logging/)** — track Sentinel's health once it's live.