لاڠکاو ککاندوڠن دوکومينتاسي
Aqiled Logoدوکومينتاسي

ترجمهن سدڠ دجالنکن

دوکومين اين دسدياکن دالم بهاس ايڠݢريس بوات سمنتارا وقتو سمنتارا ترجمهن جاوي دسياڤکن.

School Provisioning & Single-School Mode

Dedicated installations require a deliberate two-phase provisioning workflow. This ensures that the database is isolated, the initial School Admin account is seeded, and the deployment marker is securely bound to your instance.

ترسديا سکارڠ. سيمقن تراخير: 26 October 2026.

The Two-Phase Workflow

sequenceDiagram
    autonumber
    actor Admin as Systems Operator
    participant CLI as School.Api CLI
    participant DB as PostgreSQL 18
    participant Env as /etc/school/api.env
    
    Admin->>CLI: Apply AppDbContext Migration Bundle
    CLI->>DB: Create Tables & RLS Policies
    Admin->>CLI: provision-school (Name, Slug, Country, Admin Email)
    CLI->>DB: Advisory Lock & Create Tenant
    CLI->>DB: Seed deploymentidentity Marker
    CLI-->>Admin: Prints School Tenant ID (UUID)
    Admin->>Env: Set Deployment__Mode=SingleSchool & SchoolTenantId
    Admin->>CLI: Start API Service
    CLI->>DB: ValidateDatabaseAsync (Marker Matches Config)
    CLI-->>Admin: API Ready (/health/ready 200 OK)

Phase 1: Apply Database Migrations

Before provisioning, the database schema and Row-Level Security policies must be applied using the school_migrator user:

export ConnectionStrings__MigrationConnection="Host=127.0.0.1;Port=5432;Database=school_db;Username=school_migrator;Password=MIGRATOR_PASSWORD;"

# Apply EF Core migrations
dotnet School.Api.dll --migrate

Verify that the deploymentidentity table exists and no migrations remain pending.

Phase 2: Run the Provisioning Command

Temporarily set Deployment__Mode=MultiTenant and leave Deployment__SchoolTenantId blank in /etc/school/api.env while provisioning. Do not start the HTTP service in this intermediate state.

Execute the provisioning command with your school details:

sudo -u school dotnet /opt/school/current/School.Api.dll provision-school \
  --name "Madrasah Al-Falah" \
  --slug "alfalah" \
  --country "TH" \
  --school-type "kindergarten" \
  --admin-email "admin@alfalah.ac.th" \
  --admin-first-name "Ahmad" \
  --admin-last-name "Dahlan"

Parameter Reference

  • --name: Full display name of the school.
  • --slug: Lowercase alphanumeric URL slug (e.g., alfalah).
  • --country: ISO two-letter country code (TH for Thailand, MY for Malaysia, ID for Indonesia). This configures localization rules such as grading schemes, calendar active days, and statutory official document formats.
  • --school-type: School category validated against the specified country:
    • For Thailand (TH): kindergarten, standard
    • For Malaysia (MY): kindergarten, standard, tahfiz
    • For Indonesia (ID): standard, pesantren, madrasah
  • --admin-email: Initial School Admin email address used for signing in.
  • --admin-first-name / --admin-last-name: Administrator profile name.

Password Prompt

The CLI will prompt for the administrator password without echoing characters to the terminal:

Initial school admin password:

Enter a strong password (minimum 8 characters with numbers, lowercase, uppercase, and symbols).

Output

Upon successful provisioning, the command takes a database advisory lock (71942001), creates the school tenant, assigns the School Admin role, seeds the deployment marker, and prints:

School tenant ID: 4a2f8b1c-9e23-4d56-a789-0123456789ab

Phase 3: Lock to Single-School Mode

Open /etc/school/api.env and configure the service to run permanently in SingleSchool mode:

Deployment__Mode=SingleSchool
Deployment__SchoolTenantId=4a2f8b1c-9e23-4d56-a789-0123456789ab

Start the application service:

sudo systemctl start school-api.service
sudo systemctl status school-api.service

Phase 4: Verify Deployment Readiness

Test the readiness endpoint:

curl -i http://127.0.0.1:5216/health/ready

Expected response:

HTTP/1.1 200 OK
Content-Type: text/plain
Healthy
→ ݢمبارن کستوجوان ڤڠهوسن سنديري دان ڤلنچرن