# Enterprise fresh install

Single-tenant deployment: each customer runs their own SovereignRepository on their SQL instance.

## Prerequisites

- Windows Server or Windows 11 with SQL Server 2019+
- Node.js 20–22 (not 24+ for Windows integrated SQL auth)
- PowerShell 5.1+

## Steps

1. Clone or extract the release bundle from `dist/DBAOps-Sovereign-<version>-enterprise/`
2. Verify `CHECKSUMS-SHA256.json` if provided
3. Copy `.env.example` → `.env` and set `SOVEREIGN_DB_CONNECTION`
4. Install dependencies: `npm run install:all`
5. Cold deploy proof (optional but recommended): `npm run deploy:cold`
6. Create production database: `npm run deploy:from-source -- -CreateDatabase`
7. Apply repository grants: run `src/database/grants-repository-app.sql`
8. Start: `npm run start`
9. Register SQL targets in Fleet, then: `npm run collect:catalog`

## Security defaults

- Connection encryption on by default (`SOVEREIGN_SQL_ENCRYPT` unset = true)
- Trust server certificate off by default; set `SOVEREIGN_SQL_TRUST_SERVER_CERT=true` only in lab/pilot
- Secrets via credential-by-reference (`SOVEREIGN_CRED_*_USER/PASSWORD`), never in SQL

See `SECURITY-PERMISSIONS.md` and `UNINSTALL.md`.
