Docs › Discovery

Installation — Cloud Deployment

Last updated 2026-05-14

Cloud Deployment

Deploy the uControl Insight control plane to any cloud provider or VPS. On-premises worker agents handle local scanning — credentials stay on-prem.

Sizing Guide

AWS EC2 / Azure VM / GCP Compute

Assets	Instance Type (AWS)	Instance Type (Azure)	vCPUs	RAM	Storage
Up to 500	t3.medium	B2s	2	4 GB	30 GB gp3
500 – 2,000	t3.large	B2ms	2	8 GB	50 GB gp3
2,000 – 10,000	m5.xlarge	D4s_v5	4	16 GB	100 GB gp3
10,000 – 30,000	m5.2xlarge	D8s_v5	8	32 GB	200 GB gp3
30,000 – 60,000+	m5.4xlarge	D16s_v5	16	64 GB	500 GB gp3

Database Options

Assets	AWS RDS	Azure Database	Notes
Up to 2,000	db.t3.small (local MariaDB on same instance is fine)	Local MariaDB	Co-located DB is simplest
2,000 – 10,000	db.r6g.large (MariaDB)	D4s MariaDB	Managed DB recommended
10,000+	db.r6g.xlarge+	D8s+	Dedicated managed DB with provisioned IOPS

AWS Deployment Example

1. Launch EC2 Instance

AMI: Amazon Linux 2023 or Ubuntu 22.04 LTS
Instance type: t3.large (for up to 2,000 assets)
Security group: see Firewall Rules below
Storage: 50 GB gp3 root volume

2. Install Dependencies

# Amazon Linux 2023
sudo dnf install -y java-21-amazon-corretto mariadb105-server
sudo systemctl enable --now mariadb

# Ubuntu 22.04
sudo apt update && sudo apt install -y openjdk-21-jdk mariadb-server
sudo systemctl enable --now mariadb

3. Create Database

CREATE DATABASE ucontrolinsight CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'ucontrolinsight'@'localhost' IDENTIFIED BY 'YourSecurePassword';
GRANT ALL PRIVILEGES ON ucontrolinsight.* TO 'ucontrolinsight'@'localhost';
FLUSH PRIVILEGES;

4. Install Tomcat & Deploy

Follow the same Tomcat installation steps as the on-premises guide. Deploy uControlInsight.war to /opt/tomcat/webapps/.

5. Configure TLS

Use an Application Load Balancer (ALB) with an ACM certificate, or install Certbot for Let's Encrypt:

# Certbot with Nginx reverse proxy
sudo apt install -y nginx certbot python3-certbot-nginx
sudo certbot --nginx -d ucontrol.yourcompany.com

6. Configure Security Group

Rule	Port	Protocol	Source
HTTPS	443	TCP	0.0.0.0/0 (or your office IP)
SSH (admin)	22	TCP	Your admin IP only

No other inbound rules needed. Workers connect outbound to port 443. Discovery of cloud resources (AWS API) uses the instance's internet access.

Using AWS RDS Instead of Local MariaDB

For larger deployments, use Amazon RDS MariaDB:

Create an RDS MariaDB 10.5+ instance in the same VPC
Set the environment variable: SPRING_DATASOURCE_URL=jdbc:mariadb://your-rds-endpoint:3306/ucontrolinsight
Create the database and user via the RDS master credentials
Ensure the EC2 security group allows outbound TCP 3306 to the RDS security group

Docker Deployment (Alternative)

uControl Insight can also run as a Docker container. A Dockerfile and docker-compose.yml are available in the project repository. The compose file includes both the application and MariaDB:

docker-compose up -d

Deploying Workers to Remote Sites

Once the cloud control plane is running:

Go to sidebar → Workers and generate an API key for the remote site
Download the worker agent installer (Windows EXE or Linux tar.gz)
Install at the remote site — the installer prompts for the control plane URL and API key
The worker registers automatically and appears in the Workers list
Create discovery targets with the site label matching the worker's site

High Availability Considerations

For production deployments requiring high availability:

Database: Use RDS Multi-AZ or MariaDB Galera Cluster
Application: Run behind an ALB with health checks on /actuator/health
Workers: Deploy multiple workers per site for redundancy — the control plane load-balances scan jobs across available workers
Backups: Automate database backups (RDS snapshots or mysqldump). Back up the UCONTROL_MASTER_KEY separately.