Linux appliance, step by step

The example: Northwind, domain corp.example, files on \\files01\Company. Gate goes on an Ubuntu 24.04 VM at ai.corp.example, together with the Open WebUI chat. The VM does not join the domain.

What you end with: one box running Gate, its database, HTTPS, the chat and (optionally) a local model. People on domain PCs are signed in as themselves, and their AI opens file shares with their own permissions.

Time: about an hour.

What you need

Server	Ubuntu 22.04 or 24.04, or Debian 12. 8 GB RAM minimum (16 GB or more if the model runs here), 40 GB disk. Docker is installed for you.
Network	Ports 80, 443 and 8443 open to your users. Gate must reach your domain controllers (DNS, 88, 389) and file servers (445).
DNS	ai.corp.example pointing at the server, and the server using your domain's DNS servers.
Clock	Within 5 minutes of your DCs. timedatectl should say System clock synchronized: yes.
AD	A domain admin for about ten minutes.
License	Your license file from app.acutisgo.com/gate → License.

Step 1. The service account in Active Directory

On the Linux edition, Gate uses an ordinary AD user, gate-svc.

In Active Directory Users and Computers:

1. Create a user gate-svc with a long random password. Untick User must change password at next logon, tick Password never expires. (If you rotate it later, re-enter it in Gate.)
2. Open gate-svc → Account tab → under Account options tick This account supports Kerberos AES 128 bit encryption and AES 256 bit encryption. Without this, some PCs get RC4 tickets that Gate refuses.
3. Give it the web service name, so browsers can sign people in. On a DC, in an administrator command prompt:

   setspn -S HTTP/ai.corp.example CORP\gate-svc
   

4. Close and reopen gate-svc. A Delegation tab now appears (it only shows once the account has a service name). Choose Trust this user for delegation to specified services only → Use any authentication protocol → Add… → Users or Computers → files01 → select the cifs service → OK. Add each of your domain controllers the same way (Gate reads your Group Policy drive maps from SYSVOL on them).

Steps 2 to 4 in PowerShell (on a DC)

Set-ADUser gate-svc -KerberosEncryptionType AES128,AES256
setspn -S HTTP/ai.corp.example CORP\gate-svc
Set-ADAccountControl gate-svc -TrustedToAuthForDelegation $true
Set-ADUser gate-svc -Add @{'msDS-AllowedToDelegateTo'=@(
  'cifs/files01.corp.example','cifs/files01',
  'cifs/dc1.corp.example','cifs/dc1')}

Protect your admins

Mark domain admin accounts Account is sensitive and cannot be delegated (user → Account tab). Then no service, Gate included, can ever act as them.

Step 2. Install

On the server:

curl -fsSLO https://get.acutisgo.com/dl/AcutisGate-Linux.tar.gz
tar xzf AcutisGate-Linux.tar.gz && cd AcutisGate-Linux-*
sudo bash install.sh --name ai.corp.example --license ~/acutis-gate.license

About 10 minutes, mostly downloads. It installs Docker if needed, creates fresh secrets and a certificate, starts everything, and picks a local model by the server's memory. It ends with Acutis Gate ... is running at https://ai.corp.example and the next steps.

Useful options:

Option	When
--model none	Your model runs elsewhere (a DGX Spark, a GPU server). Then point the chat at it.
--model qwen2.5:14b	Choose the local model yourself. Without a GPU, local models are slow; 7B is a sensible size on CPU.
--cert ai.crt --key ai.key	Use a certificate from your company CA (PEM, full chain). Recommended.
--dir /srv/acutis-gate	Install somewhere other than /opt/acutis-gate.

The certificate

Without --cert, the installer creates a small Gate CA on the box and a certificate for ai.corp.example. Browsers will warn until your PCs trust that CA, and Windows sign-in works best with a trusted certificate. Either:

• Trust the Gate CA on your PCs: copy /opt/acutis-gate/gate-appliance/tls/ca.crt to a DC, then in Group Policy Management edit a GPO linked to your computers → Computer Configuration → Policies → Windows Settings → Security Settings → Public Key Policies → Trusted Root Certification Authorities → Import, or
• Use your company CA: issue a Web Server certificate for ai.corp.example, export it as PEM with the full chain plus its key, and run the installer again with --cert and --key.

Step 3. The first admin and the license

1. Open https://ai.corp.example/signup. Create your account (no email step on an on-prem Gate).
2. Sign in and set up your authenticator.
3. If you did not pass --license: License → Load a license.

Step 4. Connect Active Directory

Identity → Active Directory:

Field	Example
AD domain	corp.example
Domain controller	blank (found in DNS), or dc1.corp.example
Service account	gate-svc
Its password	the password from step 1 (used once to derive Gate's Kerberos keys, never stored)
Who gets Gate	AI-Users (blank = every enabled user)
Gate admins	AI-Admins

Keep Windows sign-in ticked. Press Connect, then Sync now.

Step 5. Windows sign-in for the browsers

Identity → Active Directory → Browser setup: one Group Policy → Copy. Run the script once on a DC in an administrator PowerShell. It creates and links one GPO that lets Edge and Chrome send Windows sign-in to ai.corp.example.

Then on a PC: gpupdate /force, reopen the browser, open https://ai.corp.example/gate. Details and fixes: Windows sign-in (Kerberos).

Step 6. The chat

The chat is already running at https://ai.corp.example:8443. Open it and create the first account (it becomes the chat's admin).

Give it a model. With a local model it already has one. With --model none, point it at your model server: Admin Panel → Settings → Connections → Ollama API URL, for example http://spark.corp.example:11434.

Connect it to Gate for everyone (company connection):

1. In Gate: Connect an AI → Open WebUI → + Create the company connection. Copy the secret and the key (shown once).
2. On the server, add two lines to /opt/acutis-gate/gate-appliance/.env:

   OWUI_FORWARD_USER_INFO=true
   OWUI_JWT_SECRET=<the secret Gate showed>
   

3. Apply it:

   cd /opt/acutis-gate/gate-appliance && sudo docker compose up -d open-webui
   

4. In Open WebUI (0.11 or later): Settings → Admin → Integrations → External Tool Servers → +. Click the Type until it says MCP Streamable HTTP, then fill in Name (Acutis Gate), ID (acutis-gate: required for MCP even though it says optional, or Save silently does nothing), URL and Auth: Bearer with the key. Press Verify Connection (the circular arrows): it should say Connection successful. Save, then Save on the page. (Older Open WebUI: Admin Panel → Settings → External Tools → +.) The URL is http://gate:8010/api/v1/gate/mcp (Gate's address inside the appliance, so no certificate is involved).
5. People create their Open WebUI accounts with the same email Gate has for them (their AD mail, or the UPN when mail is empty).
6. In each chat, people turn Gate on: the tools icon next to + under the message box → Tools → switch Acutis Gate on.

Step 7. File shares, guardrails, proof

• File shares as each person
• Guardrails, a worked example
• Prove it works

Then Health check → Run all checks, and fix whatever says Start here.

Day two

Task	How
Back up	/opt/acutis-gate/gate-appliance/.env and tls/ (secrets, certificate). Data is in the Docker volumes acutis-gate_*.
Logs	cd /opt/acutis-gate/gate-appliance && sudo docker compose logs gate --tail 200
Restart	sudo docker compose restart gate (in the same folder)
Upgrade	Download the new package, unpack, run its install.sh again with the same --name. Data, secrets, certificate and license are kept.
gate-svc password changed	Identity → Active Directory: enter the new password, Connect.
New file server	Add it to gate-svc's Delegation tab (cifs).
Remove	sudo docker compose down (keeps data); sudo docker compose down -v (deletes it).