AXIS Documentation / Getting Started / Installation

Installation

Docker ComposeSource buildPorts 6543 / 5432 / 3000

AXIS runs as a Rust HTTP service in front of PostgreSQL. The recommended path is the bundled Docker Compose stack; a source build with cargo run is supported when PostgreSQL is already reachable.

Prerequisites

Platform	Required
Windows	Git · Rust toolchain via `rustup` · Docker Desktop (recommended, bundles PostgreSQL) · Node.js LTS + npm (Control Plane)
Linux / macOS	Git · Rust toolchain via `rustup` · Docker and Docker Compose (recommended) · Node.js LTS + npm (Control Plane)

The reviewer package explicitly states: offline environments are not supported; restricted corporate networks (VPN, SSL inspection, firewalls) may fail the build phase before AXIS runs. Treat that as an environment/setup failure, not an enforcement failure.

Clone and static checks

shell

git clone <repository-url>
cd AXIS
cargo fmt --check
cargo check
cargo test

Docker Compose stack (recommended)

shell

docker compose up --build

Component	Endpoint	Notes
AXIS backend (`dbguard`)	`http://localhost:6543`	HTTP gate; `6544` is also mapped to the same backend for validation scripts that must avoid a stale local listener
PostgreSQL	`localhost:5432`	Database `prod_main`, demo credentials (`varux`/`varux`) — compose uses demo passwords only
Control Plane	`http://localhost:3000`	Optional Next.js surface, started separately

Configuration is loaded from the process environment and a .env file through dotenvy. The compose file mounts ./policies into /app/policies.

Direct run (source)

PostgreSQL must already be reachable. Configuration comes from environment variables or .env.

shell

cargo run

Control Plane frontend (optional)

shell

cd control-plane
npm install
npm run build
npm run dev

The Control Plane reaches AXIS through a server-side proxy (/api/axis/...). If an operator token is configured, set it only in the Control Plane server environment — the browser must never receive or edit it.

Verify the installation

shell (Windows CMD)

curl.exe http://localhost:6543/health
curl.exe http://localhost:6543/runtime/stats
curl.exe "http://localhost:6543/logs?limit=10"
curl.exe http://localhost:6543/evidence/verify
curl.exe http://localhost:3000/api/axis/health
curl.exe "http://localhost:3000/api/axis/logs?limit=10"

Health must report status: ok. For a deeper check, run the baseline suites (see Testing & Verification):

shell

python axis_regression.py --base http://localhost:6543 --fail-fast
python axis_gate_stress.py --base http://localhost:6543 --requests 1000 --concurrency 50 --approval-requests 50
python axis_audit_restart_test.py --base http://localhost:6543
python axis_chaos_test.py --base http://localhost:6543 --pool-requests 2000 --pool-concurrency 100

Compose variants

Production-like profile — docker compose --env-file .env.production.local --profile production-like up --build -d postgres dbguard-production-like; publishes http://localhost:6545; demonstrates fail-fast config and operator auth behavior. It does not replace secret management, TLS termination, backups or monitoring.
Enterprise compose — docker compose -f docker-compose.enterprise.yml up --build; AXIS at http://127.0.0.1:65431; PostgreSQL is internal-only (must not publish host port 5432); boundary check via python scripts/enterprise_boundary_check.py → AXIS ENTERPRISE BOUNDARY CHECK: PASS.
Reviewer stack — docker compose -f demo/docker-compose.reviewer.yml up --build; uses AXIS :65430 and PostgreSQL :54320 to avoid conflicts with the main stack.

See Deployment for topology details and the enterprise boundary.

Configuration

All environment variables, defaults and validation rules are documented on the Configuration page. Invalid configuration values fail startup rather than degrading silently.

Next steps

Getting Started — run the first ALLOW / BLOCK / REQUIRE_APPROVAL queries
Configuration — environment variables and defaults
Architecture — what you just installed