Markdown Editor

Installation and Configuration Guide Template (ISO/IEC/IEEE 26514)

Install guide – requirements, checklist, per-platform steps, verification, config parameters, upgrade, uninstall, hardening

ドキュメント・サポートフルISO/IEC/IEEE 26514:2022installationguide

使い方: Use when people install or self-host your software. Fill system requirements and the per-platform steps first, with the expected output after each command. The main pitfall is publishing steps that were never tested on a clean machine.

プレビュー

Installation and Configuration Guide: [Product name] [version]

Complete guide for installing, configuring, verifying, upgrading and removing a software product. The structure follows the installation information for users described in ISO/IEC/IEEE 26514:2022. Replace every [bracketed] value and every row marked Example.

Document control

FieldValue
Document ID[IG-PRODUCT-001]
Product and version[Product name] [3.2.0]
Guide version[0.1]
Status[Draft / In review / Approved / Superseded]
Owner[@docs-owner]
Approvers[@release-manager], [@security-lead]
Classification[Public / Customer confidential / Internal]
Last updatedYYYY-MM-DD

Approvals

RoleNameDecisionDate
Release manager[@name][Approved / Rejected / Approved with comments]YYYY-MM-DD
Platform engineer (tested installs)[@name][Decision]YYYY-MM-DD
Security reviewer[@name][Decision]YYYY-MM-DD

Revision history

VersionDateAuthorChange summary
0.1YYYY-MM-DD[@name]Initial draft
1.0YYYY-MM-DD[@name]Example: Tested on Ubuntu 24.04, Windows Server 2022, macOS 15
1.1YYYY-MM-DD[@name]Example: Added container install and TLS hardening steps

Contents

1. Introduction

1.1 Purpose and scope

This guide explains how to install [Product name] [3.2.0] on [Linux, Windows, macOS and container platforms], verify the installation, apply the initial configuration, upgrade from earlier versions and remove the product. Day-to-day operation is covered in the [Administrator Guide]; end-user features in the [User Manual].

1.2 Audience

This guide is for system administrators and DevOps engineers who have administrator or root access to the target host and are comfortable with a command line, package managers and basic networking (ports, DNS, TLS).

1.3 Installation overview

A typical single-node installation takes [20] minutes. The flow is:

1.4 Choosing an installation method

MethodBest forNot recommended when
Native package (APT, DNF, MSI)Long-lived servers managed with standard OS toolingYou need several versions side by side
Container imageTeams already running Docker or Kubernetes; fast rollbackThe host forbids container runtimes
Offline bundleAir-gapped or regulated networksThe host has normal internet access
Homebrew (macOS)Evaluation and local developmentProduction use

If you are unsure, choose the native package on a supported Linux distribution: it is the most widely tested path and the one support can reproduce fastest.

1.5 Conventions

Commands prefixed with $ run as a normal user; # means run as root or with sudo. Values in [brackets] must be replaced. Notes marked Caution describe a step that can cause data loss or downtime.

2. System requirements

2.1 Hardware

ResourceMinimumRecommended (production)Notes
CPU2 vCPU4 vCPUx86_64 or arm64
Memory4 GB8 GBAdd 1 GB per 100 concurrent users
Disk20 GB100 GB SSDData directory grows about [2 GB per month]
Network100 Mbit/s1 Gbit/sStatic IP or stable DNS name

2.2 Software

ComponentSupported versionsTested version
Operating systemUbuntu 22.04 / 24.04, RHEL 9, Windows Server 2022, macOS 14+[Ubuntu 24.04]
DatabasePostgreSQL 15 to 17[16.4]
Runtime[None, self-contained binary][n/a]
Container runtime (optional)Docker 26+, Podman 5+[Docker 27.1]
Browser for admin consoleCurrent Chrome, Edge, Firefox, Safari[Chrome 129]

2.3 Network

PortProtocolDirectionPurpose
443TCP (HTTPS)InboundUser and API traffic
8443TCP (HTTPS)Inbound, admin network onlyAdmin console
5432TCPOutbound to databasePostgreSQL
[Port][Protocol][Direction][Purpose]

2.4 Accounts and permissions

  • Root or administrator rights on the host for installation.
  • A dedicated service account (created by the installer as [appuser]).
  • A database role with CREATE rights on the target database.

3. Pre-installation checklist

#ItemDone
1Host meets the minimum requirements in section 2[ ]
2DNS name [app.example.com] resolves to the host[ ]
3TLS certificate and private key are available (PEM)[ ]
4Database is reachable and credentials are stored in a secret manager[ ]
5Firewall rules from 2.3 are in place[ ]
6Licence key received ([XXXX-XXXX-XXXX])[ ]
7Backup of any existing installation taken (upgrades only)[ ]
8Maintenance window agreed with users (production only)[ ]

4. Installation

4.1 Linux (Debian and Ubuntu)

  1. Add the signing key and the package repository:

    curl -fsSL https://packages.example.com/gpg.key | sudo gpg --dearmor -o /usr/share/keyrings/example.gpg
    echo "deb [signed-by=/usr/share/keyrings/example.gpg] https://packages.example.com/apt stable main" | sudo tee /etc/apt/sources.list.d/example.list
    
  2. Install the package:

    sudo apt-get update
    sudo apt-get install -y productname=3.2.0
    

    Expected output ends with Setting up productname (3.2.0) ....

  3. Enable and start the service:

    sudo systemctl enable --now productname
    

4.2 Linux (RHEL and compatible)

Run the following as a user with sudo rights. The repository file contains the signing key URL, so dnf verifies the package signature automatically; answer y when asked to import the key and check that its fingerprint matches [ABCD 1234 ...] from the download page.

sudo dnf config-manager --add-repo https://packages.example.com/rpm/example.repo
sudo dnf install -y productname-3.2.0
sudo systemctl enable --now productname

4.3 Windows Server

  1. Download productname-3.2.0-x64.msi and check its SHA-256 checksum against the value on the download page:

    Get-FileHash .\productname-3.2.0-x64.msi -Algorithm SHA256
    
  2. Run the installer silently with a log file:

    msiexec /i productname-3.2.0-x64.msi /qn /l*v install.log INSTALLDIR="C:\Program Files\ProductName"
    
  3. The service ProductName starts automatically. Confirm with Get-Service ProductName; the status is Running.

4.4 macOS

macOS is supported for evaluation and development only, not for production. Install with Homebrew; the service then runs under your user account and stores data in $(brew --prefix)/var/productname.

brew install example/tap/[email protected]
brew services start productname

4.5 Container

services:
  app:
    image: ghcr.io/example/productname:3.2.0
    ports: ["443:8443"]
    env_file: ./productname.env
    volumes: ["app-data:/var/lib/productname"]
    restart: unless-stopped
volumes:
  app-data: {}

Start with docker compose up -d. Pin the image tag; do not use latest in production. Keep productname.env out of version control because it holds the database URL and licence key.

4.6 Offline (air-gapped) installation

For hosts without internet access, download the offline bundle productname-3.2.0-offline.tar.gz on a connected machine, verify its checksum, and copy it to the target host with your approved transfer method. Then run:

tar -xzf productname-3.2.0-offline.tar.gz
cd productname-3.2.0-offline
sudo ./install.sh --offline --license-file ./license.key

The script installs the bundled dependencies, creates the service account and starts the service. Updates follow the same process with a new bundle.

4.7 Installation record

Record what you installed so that support and the next administrator can reproduce it.

ItemValue
Host name and IPExample: app01.internal, 10.0.4.21
Installation methodExample: APT package
Version installed3.2.0
Installed by and date[@name], YYYY-MM-DD
Data directory/var/lib/productname
Configuration file/etc/productname/config.yaml
Deviations from this guide[None / description and reason]

5. Post-installation verification

#CheckCommand or actionPass condition
V-01Service is runningsystemctl status productnameactive (running)
V-02Version is correctproductname --version3.2.0
V-03Health endpoint answerscurl -fsS https://[host]/healthz{"status":"ok"}
V-04Database connectionAdmin console > System > DatabaseStatus Connected
V-05Admin sign-inOpen https://[host]:8443Dashboard loads without errors
V-06Logs are cleanjournalctl -u productname --since "10 min ago"No ERROR lines

6. Configuration

6.1 Configuration file

The main file is /etc/productname/config.yaml (Windows: C:\ProgramData\ProductName\config.yaml). Environment variables override file values; see the [Configuration Reference] for precedence.

server:
  public_url: https://app.example.com
  port: 8443
database:
  url: postgres://[email protected]:5432/productname
  pool_size: 20
logging:
  level: info

6.2 Parameters

ParameterTypeDefaultAllowed rangeRestart neededDescription
server.portinteger84431024 to 65535YesPort the service listens on
server.public_urlURLnone (required)HTTPS URLYesAddress users reach; used in links and emails
database.pool_sizeinteger205 to 200YesMaximum open database connections
logging.levelenuminfodebug, info, warn, errorNoLog verbosity
session.timeout_minutesinteger72015 to 10080NoIdle time before sign-out
[parameter][type][default][range][Yes / No][Description]

Size the database pool from expected concurrency, for example pool_size≈peak requests per second×mean query time in seconds×2\text{pool\_size} \approx \text{peak requests per second} \times \text{mean query time in seconds} \times 2.

6.3 Apply and validate changes

sudo productname config validate
sudo systemctl restart productname

config validate prints Configuration OK or the first invalid key with its line number.

6.4 Environment-specific settings

Keep one configuration per environment and change only the values that must differ. A typical split looks like this:

ParameterDevelopmentStagingProduction
logging.leveldebuginfoinfo
database.pool_size52050
session.timeout_minutes10080720480
server.public_urlhttps://localhost:8443https://staging.example.comhttps://app.example.com

Store these files in version control without secrets, and inject secrets at deploy time from the secret manager.

7. Upgrade

From versionTo 3.2.0Notes
3.0.x, 3.1.xDirectDatabase migration runs automatically on start
2.xVia 3.0.4Upgrade to 3.0.4 first, then to 3.2.0
1.xNot supportedExport data and reinstall

Caution: Back up the database and /etc/productname before upgrading.

sudo productname backup create --output /var/backups/productname-pre-3.2.0.tar.gz
sudo apt-get install -y productname=3.2.0
sudo productname --version

Upgrade checklist:

  1. Read the release notes for every version between yours and 3.2.0, especially breaking changes and deprecated parameters.
  2. Run the upgrade on staging first with a copy of production data.
  3. Take the backup shown above and confirm the archive is readable.
  4. Upgrade, then repeat the checks in section 5.
  5. Watch error rates and logs for one hour before closing the window.

Rollback: reinstall the previous package version and restore the backup with productname backup restore [file]. Rollback after users have written new data loses that data; agree the cut-off with the service owner.

8. Uninstall

  1. Stop and disable the service: sudo systemctl disable --now productname.

  2. Remove the package: sudo apt-get remove productname (Windows: Settings > Apps > ProductName > Uninstall).

  3. Optional, irreversible: delete data and configuration.

    Caution: This permanently deletes all application data.

    sudo rm -rf /var/lib/productname /etc/productname
    
  4. Drop the database and remove the service account if no longer needed.

9. Security hardening

IDControlHow to applyVerify
SH-01TLS 1.2+ only, strong ciphersserver.tls.min_version: "1.2"nmap --script ssl-enum-ciphers -p 443 [host]
SH-02Admin console on internal network onlyFirewall rule on port 8443External scan shows 8443 closed
SH-03Default admin password changedAdmin console > UsersSign-in with default fails
SH-04Secrets outside config fileUse DATABASE_URL from secret managergrep password config.yaml returns nothing
SH-05Service runs as non-rootInstaller creates appuserps -o user= -C productname shows appuser
SH-06Automatic security updates for the OSunattended-upgrades enabledPackage log shows recent updates

10. Troubleshooting

SymptomWhere to lookCauseFix
Example: Service fails to startjournalctl -u productname shows bind: address already in usePort 8443 takenChange server.port or stop the other service
Example: Health check returns 503Log shows database unreachableWrong host or firewallTest with psql; open port 5432
Example: MSI rolls back on Windowsinstall.log shows error 1603Missing admin rights or pending rebootRun as administrator after rebooting
[Symptom][Log location][Cause][Fix]

11. Support

Before contacting support, run productname support-bundle and attach the generated archive (it excludes secrets). Include the product version, operating system, installation method and the step that failed.

ChannelAddressHours
Support portal[https://support.example.com][24x7 for severity 1]
Email[[email protected]][Business days, 09:00 to 18:00 UTC]
Release notes and known issues[https://docs.example.com/releases]Continuous

Appendix A. Glossary

TermMeaning in this guide
Service accountOperating system user that runs the product with minimum rights
Health endpointURL that reports whether the service and its dependencies work
Offline bundleArchive containing the product and all dependencies for hosts without internet
RollbackReturning to the previous version and data after a failed upgrade
[Term][Meaning]

Standard and licence note

Structure aligned with ISO/IEC/IEEE 26514:2022, Systems and software engineering: Design and development of information for users, for the installation, configuration and maintenance information given to users. This template is original text written for this collection and reproduces no text from the standard; obtain the standard from ISO, IEC or IEEE for its normative requirements. Template licence: MIT.

関連テンプレート