System & Database Prerequisites

Before deploying Aqiled, review the server specifications, PostgreSQL version pinning, and database privilege model.

متاح الآن. آخر مراجعة: 26 October 2026.

Hardware Sizing

Resource consumption varies depending on student count and active concurrent users (such as morning attendance registration):

| School Size | Students | Recommended vCPU | Recommended RAM | Storage (SSD) | |---|---|---|---|---| | Small | 50 – 500 | 2 vCPU | 4 GB | 25 GB | | Medium | 500 – 1,500 | 4 vCPU | 8 GB | 50 GB | | Large | 1,500 – 3,000 | 4 – 8 vCPU | 16 GB | 100 GB+ |

Operating System & Software

• Operating System: Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, or Debian 12 (x64 / arm64).
• Database Engine: PostgreSQL 18.x (Strictly enforced at startup).
• Application Runtime: .NET 8, 9, or 10 Runtime.
• Build Tools (if building from source): Node.js 20+ and npm.
• Web Server: Nginx, Caddy, or Traefik with HTTP/1.1 WebSocket reverse proxy capabilities.

Strict PostgreSQL 18.x Requirement

Always install PostgreSQL 18 using the official PostgreSQL Global Development Group (PGDG) repositories:

# Add official PostgreSQL 18 APT repository on Ubuntu/Debian
sudo apt-get install -y curl ca-certificates gnupg
sudo install -d /etc/apt/keyrings
curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc | sudo gpg --dearmor -o /etc/apt/keyrings/postgresql.gpg
echo "deb [signed-by=/etc/apt/keyrings/postgresql.gpg] http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" | sudo tee /etc/apt/sources.list.d/pgdg.list

sudo apt-get update
sudo apt-get install -y postgresql-18 postgresql-client-18

3-Tier Database Role Architecture

Aqiled enforces a security-by-design database architecture. You must configure three distinct database identities:

graph TD
    M[Migrator: school_migrator] -->|Runs Migrations / Owns Schema| DB[(school_db)]
    APP[Runtime App: school_app] -->|DefaultConnection NOBYPASSRLS| DB
    ADM[Auth & Background Jobs: school_admin] -->|AdminConnection BYPASSRLS| DB

1. school_migrator (DDL Schema Owner):
   • Used exclusively during database updates and migrations (dotnet ef database update).
   • Never used as a runtime application connection.
2. school_app (DefaultConnection):
   • Used by general end-user API endpoints.
   • Must NOT be superuser.
   • Must NOT have BYPASSRLS.
   • Must NOT own tenant tables.
   • Queries executed through this role are automatically guarded by PostgreSQL Row-Level Security policies.
3. school_admin (AdminConnection):
   • Used exclusively for authentication lookups, Hangfire background workers, and provisioning.
   • Must NOT be superuser.
   • Must have BYPASSRLS to inspect tenant metadata across partitions.

Role Setup SQL Script

Run this script as the postgres superuser when initializing your database:

-- 1. Create the database
CREATE DATABASE school_db;
\c school_db

-- 2. Create required extensions
CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
CREATE EXTENSION IF NOT EXISTS "pg_trgm";
CREATE EXTENSION IF NOT EXISTS "btree_gist";

-- 3. Create Migrator user (Schema Owner)
CREATE USER school_migrator WITH PASSWORD 'REPLACE_WITH_STRONG_MIGRATOR_PASSWORD';
GRANT ALL PRIVILEGES ON DATABASE school_db TO school_migrator;
GRANT ALL ON SCHEMA public TO school_migrator;

-- 4. Create Runtime App user (NOBYPASSRLS)
CREATE USER school_app WITH PASSWORD 'REPLACE_WITH_STRONG_APP_PASSWORD' NOBYPASSRLS;

-- 5. Create Administrative user (BYPASSRLS, non-superuser)
CREATE USER school_admin WITH PASSWORD 'REPLACE_WITH_STRONG_ADMIN_PASSWORD' BYPASSRLS;

-- 6. Grant schema usage
GRANT USAGE ON SCHEMA public TO school_app, school_admin;