> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pawsql.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> PawSQL 是一个产品：Cloud 是公网部署形态，Engine / Optimizer / Auditor / Advisor / Patroller 是同一产品的组件与交付形态，不是彼此独立的产品。 / PawSQL is a single product: Cloud is the public deployment form, while Engine / Optimizer / Auditor / Advisor / Patroller are components and delivery forms of the same product, not separate products.
> 术语以站内术语表为准：SQL 审核对应英文 SQL Review，查询重写对应 Query Rewrite，索引推荐对应 Index Recommendation；英文内容统一用 Review，不用 Audit。 / Use the site glossary for terminology: 审核 is SQL Review, 重写 is Query Rewrite, 索引推荐 is Index Recommendation; English content uses Review, never Audit.
> 引用能力范围或版本支持时以对应页面为准；标注 unknown、或 status 非 published 的内容表示尚未经产品核实，不应作为事实引用。 / Cite capability scope and version support from the corresponding page; content marked unknown, or with a status other than published, is not yet product-verified and must not be cited as fact.

# Deploy PawSQL Server

> Plan, deploy, initialize, and validate a private PawSQL Server environment.

PawSQL Server provides SQL analysis and governance inside an organization-controlled environment. This page defines the stable deployment lifecycle. Package names, commands, ports, and component versions must come from the release-specific delivery bundle.

<Note>
  Use installation media and deployment instructions that match the exact PawSQL Server version. Do not reuse commands from another release without verification.
</Note>

## Goal

Plan, deploy, initialize, and validate a private PawSQL Server environment.

## Prerequisites

* Installation media and deployment instructions that match the exact PawSQL Server version.
* A separate, non-production environment to validate the release and rollback process before production.

## Plan the environment

| Area                  | Decisions to make                                                       |
| --------------------- | ----------------------------------------------------------------------- |
| Environment           | Development, validation, staging, or production                         |
| Compute               | CPU, memory, disk, operating system, and runtime                        |
| Platform dependencies | Metadata database, cache, or other release-specific services            |
| Network               | DNS, ports, proxy, load balancer, and firewall rules                    |
| TLS                   | Certificate source, hostname, validity, and rotation                    |
| Database access       | Network path from PawSQL to managed databases                           |
| Identity              | Local accounts, enterprise SSO, or another supported method             |
| Persistence           | Configuration, task data, logs, and reports                             |
| Recovery              | Backup scope, frequency, retention, and recovery objectives             |
| Ownership             | Operators responsible for deployment, security, upgrades, and incidents |

Production should not double as an installation test environment. Validate the release and rollback process in a separate environment first.

## Deployment workflow

<Steps>
  <Step title="Verify the delivery bundle">
    Confirm the version, integrity information, release notes, deployment guide, and license.
  </Step>

  <Step title="Prepare infrastructure">
    Provision the required hosts, dependencies, service accounts, storage, DNS, and network policies.
  </Step>

  <Step title="Configure the service">
    Set endpoints, persistence, logging, authentication, and notifications. Store sensitive values securely.
  </Step>

  <Step title="Install and start PawSQL">
    Use the release-provided script or deployment template and record all local changes.
  </Step>

  <Step title="Initialize the platform">
    Create the initial administrator, apply the license, and establish organization-level settings.
  </Step>

  <Step title="Complete acceptance testing">
    Validate sign-in, permissions, task processing, persistence, logs, notifications, and database connectivity.
  </Step>
</Steps>

## Network paths to validate

| Source                 | Destination                        | Purpose                                              |
| ---------------------- | ---------------------------------- | ---------------------------------------------------- |
| User browser           | PawSQL Server                      | Web console access                                   |
| IDE, MCP, or CI runner | PawSQL Server                      | SQL analysis requests                                |
| PawSQL Server          | Platform dependencies              | Configuration and task persistence                   |
| PawSQL Server          | Managed databases                  | Metadata, plans, patrol data, or approved validation |
| PawSQL Server          | Identity and notification services | SSO, email, or webhooks                              |

## Security baseline

* Run services under dedicated system identities.
* Grant platform and database accounts only the permissions they need.
* Use HTTPS and establish certificate rotation.
* Restrict administrative endpoints by network and role.
* Keep secrets out of repositories, ordinary scripts, and logs.
* Protect backups and diagnostic data with explicit retention policies.
* Require review, backup, validation, and rollback for production changes.

## Acceptance checklist

* [ ] All required services are healthy.
* [ ] The expected URL is reachable.
* [ ] TLS is trusted and the hostname matches.
* [ ] Administrator and standard-user permissions behave correctly.
* [ ] The license is valid.
* [ ] A workspace and test task can be created.
* [ ] Data persists across a controlled restart.
* [ ] Monitoring, logging, and notifications are operational.
* [ ] Backup and restore have been tested.
* [ ] Version, configuration, ownership, and rollback details are recorded.

<Warning>
  Do not upgrade production without a verified backup and rollback plan. Validate the release with sanitized SQL and non-production databases first.
</Warning>

## Next steps

<CardGroup cols={2}>
  <Card title="Verify the installation" href="/en/user-guide/installation/verify-installation" />

  <Card title="Authentication" href="/en/user-guide/installation/authentication" />

  <Card title="Workspaces" href="/en/user-guide/workspaces" />
</CardGroup>