Docs › Discovery

Installation — On-Premises

Last updated 2026-04-27

On-Premises Installation

System Requirements

Control Plane Server

Assets	vCPUs	RAM	Disk	Notes
Up to 500	2	4 GB	20 GB SSD	Small lab / PoC
500 – 2,000	4	8 GB	50 GB SSD	Small office / single site
2,000 – 10,000	4	16 GB	100 GB SSD	Medium enterprise
10,000 – 30,000	8	32 GB	200 GB SSD	Large enterprise — consider dedicated DB server
30,000 – 60,000+	8–16	32–64 GB	500 GB SSD	Enterprise — dedicated DB server recommended, increase MariaDB connection pool

Disk estimates include database storage. Flow analytics data (if enabled) can grow 1-5 GB/day depending on volume — plan accordingly or configure retention policies.

Worker Agent

Assets at Site	vCPUs	RAM	Disk
Up to 500	2	2 GB	10 GB
500 – 5,000	2	4 GB	20 GB
5,000+	4	8 GB	40 GB

Software Prerequisites

Component	Requirement
Java	OpenJDK 21+ (Temurin, Corretto, or Oracle)
Application Server	Apache Tomcat 10.1+ (included in deployment package)
Database	MariaDB 10.5+ or MySQL 8.0+
OS	Linux (RHEL/CentOS/Rocky 8+, Ubuntu 20.04+, Debian 11+) or Windows Server 2019+
PowerShell Core	Required on the scanning host for WinRM/Windows discovery (pwsh 7.x)

Step-by-Step Installation

1. Install Java 21

# Ubuntu/Debian
sudo apt update && sudo apt install -y openjdk-21-jdk

# RHEL/Rocky/CentOS
sudo dnf install -y java-21-openjdk java-21-openjdk-devel

# Verify
java -version

2. Install MariaDB

# Ubuntu/Debian
sudo apt install -y mariadb-server
sudo systemctl enable --now mariadb

# RHEL/Rocky
sudo dnf install -y mariadb-server
sudo systemctl enable --now mariadb

# Secure installation
sudo mysql_secure_installation

3. Create Database and User

CREATE DATABASE ucontrolinsight CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'ucontrolinsight'@'localhost' IDENTIFIED BY 'YourSecurePassword';
GRANT ALL PRIVILEGES ON ucontrolinsight.* TO 'ucontrolinsight'@'localhost';
FLUSH PRIVILEGES;

4. Install Tomcat 10

# Download and extract
wget https://downloads.apache.org/tomcat/tomcat-10/v10.1.x/bin/apache-tomcat-10.1.x.tar.gz
tar xzf apache-tomcat-10.1.x.tar.gz -C /opt/
ln -s /opt/apache-tomcat-10.1.x /opt/tomcat

# Create service user
useradd -r -s /sbin/nologin tomcat
chown -R tomcat:tomcat /opt/tomcat

5. Configure Environment

Create /opt/tomcat/bin/setenv.sh:

#!/bin/bash
export JAVA_HOME=/usr/lib/jvm/java-21
export CATALINA_OPTS="-Xms256m -Xmx1024m"
export SPRING_DATASOURCE_URL="jdbc:mariadb://localhost:3306/ucontrolinsight"
export SPRING_DATASOURCE_USERNAME="ucontrolinsight"
export SPRING_DATASOURCE_PASSWORD="YourSecurePassword"
export UCONTROL_MASTER_KEY="$(openssl rand -hex 32)"

Important: The UCONTROL_MASTER_KEY is used to encrypt credentials at rest. Back it up securely — if lost, all stored credentials must be re-entered.

6. Deploy the WAR

# Copy WAR to Tomcat webapps
cp uControlInsight.war /opt/tomcat/webapps/

# Start Tomcat
/opt/tomcat/bin/startup.sh

# Check logs
tail -f /opt/tomcat/logs/catalina.out

The application will be accessible at http://your-server:8080/uControlInsight/

7. Create Systemd Service (recommended)

Create /etc/systemd/system/ucontrolinsight.service:

[Unit]
Description=uControl Insight (Tomcat 10)
After=network.target mariadb.service

[Service]
Type=forking
User=tomcat
Group=tomcat
Environment="JAVA_HOME=/usr/lib/jvm/java-21"
Environment="SPRING_DATASOURCE_URL=jdbc:mariadb://localhost:3306/ucontrolinsight"
Environment="SPRING_DATASOURCE_USERNAME=ucontrolinsight"
Environment="SPRING_DATASOURCE_PASSWORD=YourSecurePassword"
Environment="UCONTROL_MASTER_KEY=your-master-key-here"
ExecStart=/opt/tomcat/bin/startup.sh
ExecStop=/opt/tomcat/bin/shutdown.sh
Restart=on-failure

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable --now ucontrolinsight.service

8. Configure Reverse Proxy (optional, recommended)

Use Apache or Nginx to terminate TLS and proxy to Tomcat:

<VirtualHost *:443>
    ServerName ucontrol.yourcompany.com
    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/your-cert.pem
    SSLCertificateKeyFile /etc/ssl/private/your-key.pem

    ProxyPreserveHost On
    ProxyPass /uControlInsight/ http://127.0.0.1:8080/uControlInsight/
    ProxyPassReverse /uControlInsight/ http://127.0.0.1:8080/uControlInsight/
</VirtualHost>

9. First Login

The database schema is created automatically on first start via Flyway migrations. A default administrator account is created:

Username	`admin`
Password	`admin`

Change the default password immediately after first login via Profile → Change Password.