- It runs in your account. Your cloud bills you for what it runs.
- You approve every change. Nothing is installed or updated until you approve it in your cloud. There are no automatic updates.
- No cloud keys. OpenWork never asks for your cloud credentials. You run the installer yourself.
- Your first sign-in stays yours. The first administrator’s sign-in code is kept in your cloud’s secret store. OpenWork never receives it.
Who can use it
Managing deployments asks you to sign in again if you haven’t signed in
recently.
If Create deployment is locked with a message about the installer, no
installer has been published for that cloud yet. Only OpenWork can fix that; it
isn’t something your cloud sign-in can change.
What you need
AWS
- An AWS account, and someone who can create a CloudFormation stack with IAM resources. An account that holds nothing else is best.
- A public Route 53 hosted zone in that account for the address. For
openwork.example.com, that’s theexample.comzone or a delegatedopenwork.example.comzone. The installer createsopenwork.example.com,api.openwork.example.com, and their HTTPS certificates. - If the domain has CAA records, they must allow
amazon.com. - A network, chosen in the form:
- New dedicated network: creates its own VPC, NAT gateway and ECS cluster. The form estimates about $100–150 a month at the small size.
- Existing VPC: runs in your VPC, with two or more private subnets with outbound internet through NAT, two or more public subnets for the load balancer, and optionally your ECS cluster. The form estimates about $60–100 a month at the small size, plus your network’s own costs. The installer checks your network before changing anything.
Google Cloud
- A dedicated Google Cloud project with billing turned on. Don’t use a shared production project.
- A public Cloud DNS zone in that project that serves the address.
- Costs include Cloud Run, Cloud SQL, a load balancer and storage. Check Google Cloud pricing.
Create a deployment
- Open Manage › Deployments and click Create deployment.
- Choose the Cloud and fill in the form:
- Name, for example
Production - AWS: AWS account ID, Region, Network, and the Route 53 hosted zone ID for that address
- Google Cloud: Google Cloud project ID, Google Cloud project number, Region, and the Cloud DNS managed zone name for that address
- Address, for example
openwork.example.com - First administrator email
- Name, for example
- Confirm that you control the account, and that you understand the permissions and costs.
- Click Create deployment.
Approve the install
- AWS: click Prepare AWS approval, then Review and approve in AWS. The CloudFormation console opens with the installer filled in. Review its permissions, acknowledge IAM, and create the stack.
- Google Cloud: click Prepare Google Cloud approval. Click Copy command, then Open Google Cloud Shell, and run the command there. It checks the installer before running it, asks you to type the project ID to approve, and asks for your consent to use your Google credentials. It never asks for service account keys.
Sign in for the first time
When the install finishes, openhttps://<your address>/setup. Enter the
one-time code from the deployment’s secret in AWS Secrets Manager or Google
Cloud Secret Manager, field DEN_INITIAL_ADMIN_BOOTSTRAP_CODE. Technical
details on the deployment shows where to look. See
Create the first administrator.
Then set up email and single sign-on in your new OpenWork.
Status checks
A read-only health agent in your account reports every 5 minutes. Status checks shows API, Database connection, Web app, Services, Load balancer, Database instance, Database storage, Backups and HTTPS certificate. Reports contain only check results. Each deployment reads:- Operational: everything passes.
- Degraded: a warning, or a check that isn’t critical failed.
- Down: the API, web app, database connection or services are failing.
- Not reporting: no report recently. The last known checks stay visible.