Deployment
On your servers, or hosted by us.
Both options run the same signed software with the same features. The difference is who runs the servers.
Compare the options
| Self-hosted | Hosted by us | |
|---|---|---|
| Who runs the servers | Your IT team, with our installer | We do |
| Where personal data lives | In your data centre | In an isolated node on our EU infrastructure |
| Web address | Your own domain | Your own domain, pointed to us |
| Upgrades | When you choose, with automatic backup and rollback | Applied by us, with a backup of each node first |
| Backups | Encrypted, on your schedule, with your passphrase | Encrypted daily, with a passphrase unique to your node |
| TLS certificate | Let's Encrypt or your own certificate | Managed by us with Let's Encrypt |
| If you leave | Read-only mode; your data never moved | A full encrypted export for your university |
Self-hosted
The node is a set of containers installed and operated with one script, erasmus-node. It is meant for the IT team that runs the server.
Server requirements
| Minimum | Recommended | |
|---|---|---|
| CPU | 2 vCPU, x86_64 | 4 vCPU |
| Memory | 4 GB | 8 GB, for OCR of scanned transcripts |
| Disk | 40 GB, 20 GB free for Docker | 100 GB SSD, as documents and backups grow |
| Operating system | 64-bit Linux | Ubuntu 22.04 or 24.04 LTS, Debian 12 or 13, RHEL, Rocky or AlmaLinux 9 or 10 |
Software
- Docker Engine 24 or later with the Compose plugin 2.20 or later
- bash, curl, openssl and tar, present on every supported system
- Time synchronised with NTP
Network
- Inbound: TCP 443 for users and EWP partners, and TCP 80 for the HTTPS redirect and Let's Encrypt
- Outbound HTTPS to the ErasmusPath platform, our image registry and Sigstore
- With EWP: the EWP registry and your partners' EWP hosts
- Your SMTP relay for e-mail
- Databases and internal services publish no port at all
Installation in five steps
- 1
Check the server
Operating system, resources, Docker, ports, DNS, the clock and outbound access, without changing anything.
- 2
Install
Generates every secret, pulls and verifies the signed images, sets up TLS, migrates the database and creates the first administrator.
- 3
Enrol
With the one-time code we send you. The node creates its private key, which never leaves the server.
- 4
Verify
Every service up, the licence and its features, the certificate and the disk.
- 5
Schedule backups
Daily encrypted backups, copied off the server. Keep the passphrase somewhere safe.
$ ./erasmus-node check --domain mobility.university.edu
✓ All checks passed
$ ./erasmus-node install --version 1.4.0 \
--domain mobility.university.edu \
--admin-email it-admin@university.edu \
--registry registry.example.org/erasmuspath
✓ Node installed and running
$ ./erasmus-node enroll ERAS-7K2M-9QX4-HT3P-D8VW
✓ Enrolled with the ErasmusPath platform
$ ./erasmus-node status
Mode: fullWhat the installer does for you
- Upgrades with a full backup first and an automatic rollback if anything fails
- Encrypted backups and restores, on the same server or a new one
- A status command that follows the Nagios, Icinga and Zabbix plugin convention
- A support bundle with secrets, e-mail addresses and IP addresses removed
Hosted by us
For universities without spare infrastructure, we run the node for you: the same software, in its own isolated compartment.
- 1
We create your node
With its own database, secrets, keys and backups.
- 2
You point your domain to us
We obtain the certificate and the portal answers at your address.
- 3
You receive the administrator access
A one-time password, handed over through a secure channel.
If you leave
We take a final backup and prepare an encrypted export of your database, documents and EWP keys. You can restore it into a node of your own or read it with standard tools.
Not sure which fits?
Tell us about your infrastructure and we'll recommend an option in the demo.