Recluda | Install Recluda Server

Recluda Server is the sign-in server your people's Recluda apps approve sign-ins for. It runs on your own hardware: the database, the token signing key and every sign-in record stay with you. Without a license it runs as a 30-day trial for up to 25 people; email business@recluda.com for a license.

The current version is 0.4.0.

What you need

A Linux server or VM with Docker Engine and its Compose plugin. 2 vCPU and 2 GB of memory is plenty. x86 and ARM both work.
A hostname for it, such as auth.example.com, with DNS pointing at the server.
HTTPS: ports 80 and 443 open to the internet so the bundled proxy can get a certificate from Let's Encrypt, or your own load balancer in front of port 8080.
For VPN sign-ins: UDP 1812 reachable from your VPN.
People's iPhones, iPads or Macs with Recluda and Face ID or Touch ID set up.

1. Download

curl -fLO https://recluda.com/downloads/recluda-server-0.4.0.tar.gz
curl -fsSL https://recluda.com/downloads/SHA256SUMS | grep recluda-server-0.4.0.tar.gz | sha256sum -c -
tar xzf recluda-server-0.4.0.tar.gz
cd recluda-server-0.4.0

The second line checks the download against its published SHA-256 and should print OK.

2. Install

./recluda install --hostname auth.example.com
./recluda admin set-password

install writes recluda.env with fresh secrets (readable only by its owner), downloads the server's images, starts them, and turns on sign-in notifications through Recluda's push service (push.recluda.com). Add --no-https if your own load balancer handles HTTPS. Then choose the admin console's password (at least 12 characters).

3. Point Recluda at your server

On your iPhone, open Recluda, tap Server and enter https://auth.example.com. Each person in your organization does the same before they're set up.

The admin console listens on port 5004 of the server itself, never on the internet. From your computer:

ssh -L 5004:localhost:5004 you@your-server

Then open http://localhost:5004, enter the admin password, and approve the sign-in in Recluda: tap the number the console shows, then Face ID or Touch ID. The first account to approve becomes the administrator.

5. Set people up

Anyone: a person is added the first time they approve a sign-in with Recluda pointed at your server. Their device's key registers itself; there's nothing to type.
A VPN user: in the admin console, VPN → Set Up a Person, enter their VPN username and click Make setup QR. They scan it with Recluda (or tap Link and type the code under it).
Another device for someone: Devices → Add device next to one of their devices makes a one-time code for the new one.

6. Connect your apps and VPN

Apps and single sign-on that accept an OpenID Connect provider with the device flow: point them at https://auth.example.com/.well-known/openid-configuration.
VPNs: follow the VPN guide. Each VPN sign-in arrives on the person's phone as a notification; they tap it, tap the number the VPN shows and confirm with Face ID or Touch ID. Without the notification (a server with no internet access, or notifications turned off), the VPN also shows a code to enter in Recluda.

7. Add your license

./recluda license install recluda-example-inc.license
./recluda license status

The license is a signed file from Quantum V^. It's checked before it replaces anything. It sets how many people can be enrolled; it never stops anyone from signing in. Past the license (plus 10% grace) or after the trial, only new people can't be enrolled. The admin console's dashboard shows how many people are enrolled.

About notifications

Only Apple and the app's publisher can send notifications to an app, so your server hands each one to Recluda's push service, which passes it to Apple. It receives the phone's notification token, the sign-in code and the app's name, never the number to tap, and keeps nothing once Apple has it. Each server has its own key for the service, made at install with your license or trial.

Keep it running

Command	What it does
`./recluda status`	the three services and their health
`./recluda logs`	follow the logs (add `server`, `admin` or `radius` for one)
`./recluda push status`	whether sign-in notifications are on (`./recluda push register` turns them on)
`./recluda backup`	the database, signing key and settings, to `backups/` (keep a copy off the server, somewhere private)
`./recluda update 0.5.0`	back up, check your license's support covers that version, and switch to it
`./recluda admin break-glass`	password-only admin sign-in for 15 minutes, if approvals aren't working

Updates released after your license's support date don't install until support is renewed; the server keeps running the version it has.

Questions

Email support@recluda.com. For licenses, pilots and partnerships: business@recluda.com.