Install Arcanum

Arcanum ships as a single Docker image plus a Postgres database. Everything — the WSAA signing, the encrypted private keys, the SOAP traffic to ARCA — happens inside your container. Nothing authenticates through a third party.

Requirements

Docker

The supported path. The bundled docker compose brings up the app and Postgres together.

Two secrets

An API key (protects the REST surface) and a master key (encrypts the private keys at rest). Generate them with openssl.

An ARCA certificate

Per CUIT, in homologation or production. Arcanum generates the CSR; you upload it to ARCA and paste back the .crt.

Run with Docker

Generate the two secrets first:

openssl rand -hex 24   # ARCANUM_API_KEY     (protects the API)
openssl rand -hex 32   # ARCANUM_MASTER_KEY  (encrypts the private keys — keep it safe)

docker compose

git clone https://github.com/diegoparras/arcanum.git && cd arcanum
cp .env.example .env
# edit .env: set ARCANUM_API_KEY and ARCANUM_MASTER_KEY
docker compose up -d

The compose file starts Postgres and the app together, maps port 8094 and restarts unless stopped. Then open http://localhost:8094.

Prebuilt image

Use the image published to GHCR with your own Postgres:

docker run -d -p 8094:8094 \
  -e ARCANUM_ENV=homo \
  -e ARCANUM_API_KEY="$(openssl rand -hex 24)" \
  -e ARCANUM_MASTER_KEY="$(openssl rand -hex 32)" \
  -e DATABASE_URL="postgres://arcanum:arcanum@your-db:5432/arcanum" \
  ghcr.io/diegoparras/arcanum:latest

Guard the master key

ARCANUM_MASTER_KEY encrypts every private key at rest (AES-256-GCM) and lives only in the environment, never in the database. If you lose it, the stored certificates can’t be decrypted. Keep a secure backup.

First run

1. Open http://localhost:8094 and sign in (ARCANUM_ADMIN_USER / ARCANUM_ADMIN_PASS, or the password printed once in the logs if you left it empty).
2. Pick the environment — homologation or production — from the menu (ARCA environment). You can switch it later, hot, without redeploying.
3. Add a client (CUIT). Arcanum generates the CSR; upload it to ARCA and paste back the .crt. The private key is stored encrypted.
4. Follow the per-service activation guide to authorize each web service, then issue your first call from the panel or over REST.

Environment variables

All configuration lives in .env (copy it from .env.example).

Variable	Default	Description
PORT	8094	Port the app listens on.
ARCANUM_ENV	homo	Default ARCA environment: homo (testing) or prod. Switchable in the UI.
ARCANUM_API_KEY	(empty)	Key for the REST API (X-API-Key). Empty → generated and printed once in the log.
ARCANUM_MASTER_KEY	(empty)	32-byte hex key that encrypts the private keys at rest.
DATABASE_URL	(compose)	PostgreSQL connection string. The compose file wires this to the bundled arcanum-db.
POSTGRES_USER / POSTGRES_PASSWORD / POSTGRES_DB	arcanum	Credentials for the bundled Postgres.
ARCANUM_ADMIN_USER	(empty)	Admin username for the web panel.
ARCANUM_ADMIN_PASS	(empty)	Admin password. Empty → generated and printed once in the log.
ARCANUM_OIDC_ISSUER	(empty)	Lockatus issuer URL — set to federate the login (optional SSO).
ARCANUM_OIDC_CLIENT_ID	(empty)	App slug in Lockatus (arcanum) when federated.
ARCANUM_OIDC_CLIENT_SECRET	(empty)	OIDC client secret, when federated.

Single sign-on

Set the ARCANUM_OIDC_* variables to federate Arcanum with Lockatus, the suite’s identity hub — one login, two-factor and per-app roles across the whole family. Leave them empty to keep the standalone admin login.