Central Server Setup

Set up the BlueSentinel central server with PostgreSQL, Flask, and Gunicorn.

Prerequisites

Python 3.9+ (3.11+ recommended)
PostgreSQL 14+ (16+ recommended)
Linux server (Ubuntu 22.04 LTS recommended) or macOS
TLS certificate for HTTPS (Let's Encrypt or self-signed for testing)

Database Setup

bash

# Install PostgreSQL
sudo apt update && sudo apt install postgresql postgresql-contrib

# Create database and user
sudo -u postgres psql <<EOF
CREATE USER bluesentinel WITH PASSWORD 'your_secure_password';
CREATE DATABASE bluesentinel OWNER bluesentinel;
\c bluesentinel
CREATE EXTENSION "uuid-ossp";
EOF

# Run the schema migration
psql -U bluesentinel -d bluesentinel -f central_server/migrations/init_schema.sql

The schema creates 11 tables with:

UUID primary keys (VARCHAR(36))
JSONB columns for guard configurations and alert details
BIGSERIAL for the alerts table (high-volume)
Partial indexes for performance (unacknowledged alerts, pending commands, default policies)

Server Installation

bash

# Clone the repository
git clone https://github.com/your-org/BlueSentinel.git
cd BlueSentinel

# Create virtual environment
python3 -m venv venv
source venv/bin/activate

# Install dependencies
pip install -r requirements.txt

Configuration

Set the following environment variables:

Variable	Required	Default	Description
`DATABASE_URL`	Yes	`postgresql://localhost/bluesentinel`	PostgreSQL connection string
`SECRET_KEY`	Yes	Random	Flask session secret
`JWT_SECRET`	Yes	Random	JWT signing key
`PORT`	No	`5100`	Server port
`CORS_ORIGINS`	No	`*`	Allowed CORS origins

bash

export DATABASE_URL="postgresql://bluesentinel:your_secure_password@localhost/bluesentinel"
export SECRET_KEY="$(python3 -c 'import secrets; print(secrets.token_hex(32))')"
export JWT_SECRET="$(python3 -c 'import secrets; print(secrets.token_hex(32))')"
export PORT=5100

First Run

bash

python central_server/app.py

On first startup, the server automatically bootstraps:

Default tenant: "BlueSentinel Default"
Default policy: All guards enabled (USB=block, Network=block, Browser=block, etc.)
Super admin: admin@bluesentinel.com / admin123

Critical: Change the default admin password immediately!

Production Deployment

Gunicorn

bash

gunicorn -w 4 -b 0.0.0.0:5100 \
  --timeout 120 \
  --access-logfile /var/log/bluesentinel/access.log \
  --error-logfile /var/log/bluesentinel/error.log \
  "central_server.app:create_app()"

Systemd Service

Create /etc/systemd/system/bluesentinel.service:

[Unit]
Description=BlueSentinel Central Server
After=network.target postgresql.service

[Service]
Type=simple
User=bluesentinel
WorkingDirectory=/opt/BlueSentinel
Environment=DATABASE_URL=postgresql://bluesentinel:password@localhost/bluesentinel
Environment=SECRET_KEY=your-secret-key
Environment=JWT_SECRET=your-jwt-secret
ExecStart=/opt/BlueSentinel/venv/bin/gunicorn -w 4 -b 0.0.0.0:5100 "central_server.app:create_app()"
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target

bash

sudo systemctl enable bluesentinel
sudo systemctl start bluesentinel

Nginx Reverse Proxy (TLS Termination)

server {
    listen 443 ssl;
    server_name bluesentinel.yourcompany.com;

    ssl_certificate /etc/letsencrypt/live/bluesentinel.yourcompany.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/bluesentinel.yourcompany.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:5100;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Database Connection Pool

The server uses a connection pool with these defaults:

Pool size: 10 connections
Recycle: Every 300 seconds
Pre-ping: Enabled (detects stale connections)

For large deployments (500+ devices), increase the pool size and PostgreSQL max_connections.

Health Check

bash

curl http://localhost:5100/health

Returns:

json

{
  "status": "healthy",
  "database": "connected",
  "version": "1.0.0"
}