This is the path after you create an account or buy a paid tier. Lab compose (make up) is Install. Kubernetes examples are k8s — not a SKU.
1. Download
Signed-in Downloads for lattice-<version>-linux-amd64.tar.gz or arm64. Verify SHA256SUMS. Unpack:
lattice-api lattice-dhcpd lattice-worker lattice-dns lattice-dhcptest
README.md docs/deploy.md docs/k8s.md VERSION
Copy the four production binaries to /usr/local/bin. Same bits for community and paid. The entitlement is a separate file.
2. Postgres
Managed Postgres with failover, or Patroni. Single writer. Do not run the lease store on the dhcpd host.
- Database
lattice, role for api/dhcpd/worker sslmode=require(orverify-full)- NTP/chrony on every host. UTC. Clock
lattice-api -migrate-only against that DSN once.
3. Env
/etc/lattice/lattice.env mode 0600. Config.
LATTICE_PG_DSN=postgres://lattice_dhcpd@pg-primary:5432/lattice?sslmode=require
LATTICE_NODE_NAME=dhcp-a
LATTICE_LISTEN_DHCP=:67
LATTICE_LISTEN_HTTP=:8080
LATTICE_LOG_LEVEL=info
LATTICE_TRUSTED_RELAYS=10.0.0.0/8
LATTICE_ENTITLEMENT_PATH=/etc/lattice/entitlement.json
Each dhcpd host needs a unique LATTICE_NODE_NAME. Do not share LATTICE_LISTEN_HTTP between dhcpd and api on one host.
Place lattice.entitlement.json at that path (mode 0640) or upload it in the console after first login — Postgres then feeds every process.
4. Processes
systemd units ship in the product repo deploy/systemd/ for api, dhcpd, and worker. lattice-dhcpd.service uses CAP_NET_BIND_SERVICE for :67.
Minimum production:
| Role | Count | Notes |
|---|---|---|
lattice-api | 2 | HTTP + console. Front with TLS. |
lattice-worker | 2 | Expiry, DNS, webhooks |
lattice-dhcpd | 2+ | Behind the UDP VIP |
| Postgres | failover | Single writer |
lattice-dns only if you picked a Lattice DNS mode (DNS modes). Run two identical processes on :53 with CAP_NET_BIND_SERVICE, same VIP pattern as dhcpd. No unit ships in the tarball yet; copy lattice-dhcpd.service and point ExecStart at lattice-dns.
5. UDP VIP
Relays point at one address. Health-check HTTP /readyz, not UDP/67. VIP.
6. First Ack
First login → First subnet (use a real prefix; skip lattice-dhcptest on :67) → Relays → one DNS mode.
Community has no SLA. Stay on this shape unless you have a reason not to.