rConfig Vector Prism Installation and Deployment

rConfig Vector Prism Installation and Deployment

After reading this page, you can stand up a new rConfig Vector Prism instance: confirm the licence and host prerequisites, run the deployment, wire Prism to your rConfig server, and sign in for the first time. Prism is the white-label, read-only customer portal that sits in front of rConfig Vector, so this guide covers the portal host only, not the Vector control plane.

Authoritative install docs live in-app

The version-locked installation runbook ships inside every Prism release at /admin/docs. It updates with each version and is the source of truth for exact command syntax and version-specific behaviour. Use this page for orientation and the high-level flow. If the in-app docs and this page disagree, trust the in-app docs.

Draft: deployment commands pending confirmation

The deployment script name, download URL, install path, web server vhost, and licence-activation commands on this page are marked TODO (confirm) and must be replaced with the verified values from /admin/docs before this page is published. See the Outstanding doc needs list at the foot of the page.

Licensing Requirements

rConfig Vector Prism is a separately licensed commercial product. A valid Prism licence is required to deploy and run an instance, in addition to your rConfig Vector licence. Organisations without current Prism licensing should contact info@rconfig.com for licensing information.

Prism is licensed independently of Vector. Holding a Vector licence does not by itself entitle you to run Prism.

When to use this

Use this guide when you run rConfig Vector for multiple end customers and want to give each of them branded, tag-scoped, read-only access to their own configuration data without exposing your internal tooling. Prism is the right fit for MSPs and service providers; if you only need internal operator access to Vector, you do not need Prism. Read the Vector Prism overview first if you are not sure Prism is what you need.

Prerequisites

Verify the following before you begin:

Licence and upstream rConfig

• A valid Prism licence (see Licensing Requirements above).
• A running rConfig server (rConfig Vector or compatible v8) reachable over HTTPS, with API access enabled.
• An rConfig API token, generated under your rConfig user’s API tokens screen. Prism uses this to read device and tag data.
• A planned tag taxonomy in rConfig (for example one cust:<name> tag per customer). Prism isolates customers by tag, so plan this before onboarding.

Host specifications

Prism is a lightweight portal and needs far less than a Vector server. A modest virtual machine is sufficient for typical MSP customer counts.

• 2 CPU cores minimum
• 4 GB RAM minimum
• 20 GB storage minimum

Right-size to your concurrency

Reference figures from the product team: cold-start memory around 80 MB, steady state around 180 MB at 50 concurrent users, and a database footprint around 20 MB on MariaDB. Scale CPU and RAM up if you expect many concurrent customer sessions.

Software and infrastructure

• A supported Linux host with the Apache web server and PHP for the Laravel application runtime. TODO (confirm): exact PHP version and required extensions from /admin/docs.
• MariaDB or MySQL, either on the same host or reachable on the network.
• A valid TLS certificate for the Prism hostname (a wildcard certificate works well for per-customer subdomains). Self-signed certificates are not suitable for a customer-facing portal.
• DNS resolution configured for the Prism hostname.
• An SMTP relay (host, port, credentials, encryption mode) for invites, password resets, and alerts.
• A second person who can be promoted to a backup admin once Prism is up.

Prism is internet-facing by design

A customer portal is exposed to the public internet. Terminate TLS at your reverse proxy or load balancer, place Prism behind a WAF where possible, and patch the host (OS, PHP, database) on a regular cadence. You are responsible for the security controls around the host.

Step-by-step deployment

All commands require root or sudo privileges on the Prism host. The RHEL-family and Ubuntu flows are identical apart from the deployment script name and the sudo prefix, so each step below is shown once with the command variant tabbed where it differs.

1. Prepare the database

Authenticate to MariaDB or MySQL as the root account and create a dedicated database user for Prism. Implement an organisationally appropriate username and password policy in place of the example values.

sudo mariadb -u root -p

GRANT ALL PRIVILEGES ON *.* TO 'prism'@localhost IDENTIFIED BY 'changeMe';
FLUSH PRIVILEGES;
quit;

2. Download the deployment script

Create the install directory and download the deployment script for your distribution.

CentOS / Rocky / RHEL / Alma

mkdir -p /var/www/html/prism
cd /var/www/html/prism
wget https://dl.rconfig.com/downloads/prism-deploy.sh -O prism-deploy.sh
chmod +x prism-deploy.sh

Ubuntu

sudo mkdir -p /var/www/html/prism
cd /var/www/html/prism
sudo wget https://dl.rconfig.com/downloads/prism-deploy-ubuntu.sh -O prism-deploy.sh
sudo chmod +x prism-deploy.sh

3. Run the deployment

Prepare these parameters before running the script:

• Database host - localhost for a single-server deployment
• Database username - the user created in step 1
• Database password - the password created in step 1
• Hostname - the fully qualified domain name for the Prism portal
• Licence / API token - your Prism licence token from the rConfig portal

CentOS / Rocky / RHEL / Alma

# TODO (confirm): exact init and deploy invocation from /admin/docs
./prism-deploy.sh --mode=init --apitoken=yourPrismToken --dbuser=prism --dbpass="changeMe" --hostname=prism.example.com
./prism-deploy.sh --mode=deploy --apitoken=yourPrismToken

Ubuntu

# TODO (confirm): exact init and deploy invocation from /admin/docs
sudo ./prism-deploy.sh --mode=init --apitoken=yourPrismToken --dbuser=prism --dbpass="changeMe" --hostname=prism.example.com
sudo ./prism-deploy.sh --mode=deploy --apitoken=yourPrismToken

Respond to prompts as required. Default values may be accepted by pressing Enter.

4. Set up the default data

Once the application is deployed, seed the default data Prism needs to run. Change into the Prism application directory and run the install command.

cd /var/www/html/prism/current
php artisan prism:install

Confirm the working directory

cd into the active release before running the command. If Prism deploys without a current release symlink, run it from /var/www/html/prism instead. This is the same path question raised under the Apache vhost step below.

5. Configure the Apache vhost

Create an Apache virtual host that points at the Prism application’s public/ directory and terminates TLS. The configuration below mirrors the rConfig V8 vhost. Adjust ServerName, the certificate paths, and DocumentRoot to match your environment. For deeper TLS guidance, including Let’s Encrypt, see the SSL Configuration guide.

# HTTPS Virtual Host — rConfig Vector Prism
<VirtualHost *:443>
    ServerName prism.example.com
    DocumentRoot /var/www/html/prism/current/public

    # SSL Configuration
    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/prism.crt
    SSLCertificateKeyFile /etc/ssl/private/prism.key

    # Modern SSL/TLS Configuration
    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
    SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
    SSLHonorCipherOrder off
    SSLSessionTickets off

    # Security Headers
    Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
    Header always set X-Frame-Options DENY
    Header always set X-Content-Type-Options nosniff
    Header always set Referrer-Policy "strict-origin-when-cross-origin"

    # Laravel Application Configuration
    <Directory /var/www/html/prism/current/public>
        Options -Indexes +FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>

    # Error and Access Logs
    ErrorLog /var/log/httpd/prism-ssl-error.log
    CustomLog /var/log/httpd/prism-ssl-access.log combined
</VirtualHost>

# HTTP to HTTPS Redirect
<VirtualHost *:80>
    ServerName prism.example.com
    Redirect permanent / https://prism.example.com/
</VirtualHost>

Confirm the document root

/var/www/html/prism/current/public assumes Prism uses the same symlink-based release layout as rConfig V8, where current points at the active release. Confirm the real document root before going live: if Prism deploys without a current symlink, use /var/www/html/prism/public instead.

Save the vhost to the correct location for your distribution, enable the required modules, and restart Apache.

CentOS / Rocky / RHEL / Alma

vim /etc/httpd/conf.d/prism-ssl.conf
# paste the vhost above, then restart Apache
systemctl restart httpd

Ubuntu

sudo vim /etc/apache2/sites-available/prism-ssl.conf
# paste the vhost above (set log paths under /var/log/apache2/), then:
sudo a2enmod ssl headers rewrite
sudo a2ensite prism-ssl.conf
sudo systemctl restart apache2

6. Sign in for the first time

Browse to the Prism hostname and sign in with the seeded admin credentials from your install output. Change both the email and password immediately, then enrol two-factor authentication when prompted. TOTP enrolment is enforced at the route layer, so there is no opt-out.

Common gotchas

• No queue worker running. Prism queues all mail (invites, resets, alerts). Without Horizon or php artisan queue:work running on the host, messages never leave the queue. Confirm the worker before you invite any customer.
• Base URL includes a path. The rConfig API base must be the host only, for example https://rconfig.example.com. Anything containing /api/... is rejected. Prism resolves API paths itself.
• Default admin left in place. The seeded admin credentials are well-known. An internet-facing instance still using them is an open door. Change them, then promote a backup admin so you are not running a single-admin instance.
• Empty tag mappings. Prism fails closed. A customer with no mapped tags sees zero devices. Map at least the customer’s own tag before inviting their users.

What’s next

• Getting Started — first-day operator setup, from branding through to onboarding your first customer.
• Vector Prism Overview — what Prism is and how it fits into the rConfig stack.
• Admin Guide — day-to-day operator workflows once Prism is live.

Outstanding doc needs

Replace every TODO (confirm) marker above with the verified values from the in-app docs at /admin/docs before publishing:

• Deploy script — confirm the Prism deployment script name and dl.rconfig.com download URL (and any separate Ubuntu variant).
• Install path — confirm the supported install directory (the prism placeholder).
• Init / deploy invocation — confirm the exact --mode=init and --mode=deploy parameters Prism expects.
• Default data — confirm the exact php artisan prism:install command and the directory it runs from (whether Prism uses a current release symlink).
• Apache vhost — confirm the document root (whether Prism uses a current release symlink) and any Prism-specific directives beyond the rConfig V8 vhost shown.
• PHP runtime — confirm the required PHP version and extensions.