Elyse DEPLOYMENT GUIDE

OVERVIEW

Elyse is a three-layer document management application consisting of an Angular frontend, a .NET backend, and a SQL Server database with FILESTREAM. In a server deployment, the backend uses Kerberos Constrained Delegation (KCD) to impersonate the connected user when accessing SQL Server, ensuring that every database connection is made under the authenticated user's Windows identity.

There are three backend variants:

• SERVER — For domain-joined multi-user environments with KCD.
• WORKGROUP — For single-user workstation environments without a domain. The backend connects to SQL Server directly as the user's own Windows account. KCD is not used.
• WORKGROUP READ ONLY — Backend with all delete, update, create and all elevated privilege endpoints disabled. Use this to create a read-only public-facing anonymous-user interface. KCD is not used.

ARCHITECTURE

DEPLOYMENT PACKAGES

Each layer is deployed from a separate deployment package:

DOCUMENT DISTRIBUTION

The instruction documents are distributed within deployment packages as follows:

1. Database Deployment Package

The following Elyse Installation Guide documents are included as plain-text files with the database package (Elyse_DB_*.zip):

2. Application Deployment Packages

Each application layer zip contains a self-contained README for that layer, plus copies of the domain and KCD configuration guides:

DEPLOYMENT SCENARIOS

Choose the scenario that matches your environment and follow the documents in the order listed.

Scenario 1: Production Server, Existing Domain

The organisation already has an Active Directory domain. Elyse is being deployed onto domain-joined servers.

Scenario 2: Production Server, New Domain

A new Active Directory domain is being created for Elyse. Follow the same steps as Scenario 1, but execute Domain Setup in full rather than reviewing it for an existing domain.

Scenario 3: Lab / Test Environment from Scratch

A self-contained test environment is being built using Hyper-V virtual machines on a single host.

Scenario 4: Single-User Workgroup (No Domain)

A single user on a Windows 10/11 workstation, not joined to a domain. No Active Directory, no KCD. The backend connects to SQL Server directly as the user's Windows account.

Scenario 5: Read-Only Public-Facing Interface

A read-only backend that serves anonymous users. This may run alongside an existing SERVER or WORKGROUP deployment on the same database. All write, update, delete, and elevated-privilege endpoints are removed from the code. Only the READER application role is used.

PREREQUISITES SUMMARY

The following prerequisites apply across all scenarios:

NAMING CONVENTIONS

These documents use the following prescribed names. These are recommended defaults and may be replaced with names that conform to your organisation's naming standards. If you change them, apply the change consistently across all documents and configuration files.