SETUP · OPERATIONS · INTEGRATORS · TROUBLESHOOTING

Clear guidance for running 1ProNAS safely.

Use these guides for the live production API, server updates, PostgreSQL recovery, client pricing, free integrator partners, delegated permissions, connector planning, UAT and common operational issues.

Infrastructure and the production API are live. Human client and integrator portals remain previews until email OTP, sessions and server-side role enforcement are connected.

Start here

OPERATIONS

Server and production

Inventory, updates, backups, restore testing, preflight, burn-in and rollback.

Open section

PARTNERS

Integrator / MSP guide

Free partner account, client ownership, roles, onboarding, permissions and troubleshooting.

Open guide

REFERENCE

Platform dictionary

Canonical terminology shared by sales, clients, partners, developers and support.

Open dictionary

TESTING

Production UAT

Track what works now, what evidence is required and what must still be built.

Open UAT

Service map

The German Axon server keeps application ports on localhost. Apache exposes only approved HTTPS hostnames.

Marketing, docs, UAT and previews
127.0.0.1:3010 -> https://1pronas.oneproits.com

Pilot rollback API
127.0.0.1:3020

Production API
127.0.0.1:3030 -> https://api.1pronas.oneproits.com

PostgreSQL and Valkey
Docker network only

The public API is currently routed to production port 3030. The private SQLite pilot on 3020 remains available for emergency rollback.

Production update and validation

Before update

cd /opt/1pronas
1pronas inventory
1pronas status
1pronas production-status
1pronas production-backup

Deploy current main

1pronas update
bash deploy/install-cli.sh
hash -r

After update

1pronas production-status
1pronas production-backup
1pronas production-restore-test
1pronas production-preflight

High-risk changes should also run:

1pronas burn-in 60

Current migration head

0003_integrator_foundation

Do not declare a release complete merely because containers started. Backup, isolated restore, migration, routes, authentication assumptions and logs must also be reviewed.

Free Integrator / MSP Partner programme

Integrator workspace: USD 0 · Free Forever
Client subscription: selected and paid by client
Client data: owned by client
Integrator service fees: separate
Sensitive permissions: client-controlled by default

One integrator can manage multiple assigned client tenants and multiple partner technicians. Each client remains isolated with its own users, subscription, NAS devices, connector identities, settings and audit records.

First release: one active primary integrator per client.
Technicians see only explicitly assigned clients.
Integrator staff are not counted as client subscription users.
Client can revoke the relationship immediately.
Integrator suspension does not suspend client tenants.
Archive approval, billing changes and reclaim authorisation remain client-only by default.

Partner programme Detailed operations guide Portal preview

Tenant machine credentials

Each client, connector and integration receives a separate tenant-bound credential. API keys are not human portal passwords.

Create and test

1pronas key-create axon admin "Axon production administrator" 90
1pronas key-test axon

List or revoke

1pronas key-list axon
1pronas key-revoke CREDENTIAL_ID

A key pasted into chat, email, screenshots or tickets must be revoked and replaced. Never share one connector credential across clients or NAS devices.

DNS and TLS

1pronas.oneproits.com      A   161.97.137.234
api.1pronas.oneproits.com  A   161.97.137.234

Recommended future hostnames include app, admin, integrator, docs, downloads and status. Do not publish wildcard tenant DNS until host validation and tenant routing are enforced.

apache2ctl configtest
apache2ctl -S
certbot certificates

Client and integrator pricing

Client Free Forever: exactly 1 NAS and 1 client user.
Paid client pricing uses NAS and client-user totals.
Integrator / MSP Partner account: USD 0 Free Forever.
Integrator technicians do not count as client users.
Client owns and pays its subscription.
Integrator service charges remain separate.

Open client pricing calculator

Connector deployment

The preferred design installs an outbound-only connector directly on each supported NAS. SMB, NFS and NAS administration ports remain private.

Separate identity per client NAS.
Short-lived single-use pairing.
Signed packages and upgrades.
Command signature, expiry and nonce validation.
Policy and legal-hold revalidation.
Dry run before sensitive source action.
Checksum and restore verification before reclaim.

Connector release status

Email and alert settings

Axon configures the email provider. Clients configure recipients, quiet hours and thresholds. Integrators see only alerts for assigned clients and granted scopes.

Capacity advisory, warning and critical thresholds.
Capacity forecast alerts.
Connector offline and version alerts.
Backup and restore-test failures.
Archive verification failures.
Credential and temporary-permission expiry.

Billing model

1ProNAS uses client subscription entitlements. Stripe Checkout and Customer Portal will be available only to authenticated client billing owners. Integrators may see limited status only when the client permits it and never see payment-card details.

Documentation AI help

The first AI assistant is documentation-only. Kimi configuration remains server-side. Normal documentation must remain usable without AI, and AI cannot approve or execute file-lifecycle actions.

Troubleshooting

Production API not ready

curl -i http://127.0.0.1:3030/ready
1pronas production-logs

Migration not at 0003

docker compose -f docker-compose.yml -f docker-compose.production.yml   exec -T 1pronas-space-manager-prod alembic current

Git pull failure

cd /opt/1pronas
git remote set-url origin git@github.com:amitaxonsg/1ProNAS.git
git config core.sshCommand "ssh -i /root/.ssh/id_ed25519_1pronas -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new"
git ls-remote --exit-code origin refs/heads/main

Wrong client visible to integrator

Treat this as a security incident. Revoke access, preserve logs, record the request ID and investigate tenant filters, assignments, permissions and cache keys.

More integrator troubleshooting