Nectere Arch

01The app

The mock works like the app. Click through the sidebar, open a deployment, or step through Deploy with Next and Back. The switch changes who is signed in.

A user handles day-to-day work. Users, Server Logs and Backup are admin only. Array sign-on hides Users and Logout because Array owns the accounts.

02Concepts

Arch doesn't build images. It starts from an image already pushed to a registry.

Typical order

1. Credentials: add the cloud login for the target, plus a registry login if the image is private and not on GHCR. Press Test.
2. Apps: register the image and press Inspect.
3. Deploy: pick a target and app, step through to Review, press Deploy.
4. Deployments: wait for succeeded and open the URL.

03Getting Arch

In Nectere Array, open Menu › Deploy › Nectere Arch, name the tile, pick a sign-in mode and press Deploy. Press Open once the tile shows Running. Restarts, Arch updates and its logs are on the back of the tile.

04Sign-in and setup

With Application sign-in, the first visit shows a setup form. The name and password entered there become the admin account. After that everyone uses Log In.

Array sign-on

These forms don't appear. Opening the tile from Array signs you in, and the sidebar shows your name with no Logout button. If the Array session expires while Arch is open, Arch shows its own Log In page. Don't log in there. Go back to Array and reopen the tile.

05Sidebar and notifications

Dialogs close with ×, Cancel, Close or Escape. Clicking outside a dialog does nothing, so a half-filled form isn't lost.

06Dashboard

The landing page.

1. 1Counts. Active Deployments counts only deployments that are running. The rest are totals.
2. 2Shortcuts. Register App and Add Credential open their panel with the form up. New Deployment opens the wizard.
3. 3Recent Deployments. The ten newest. Click a row to open it.

07Apps

An app points at one image tag in one registry. Auth means Arch holds a login for it, Public means it doesn't. Deleting an app leaves its deployments alone.

Register App

The registry decides where the login comes from. GHCR takes a token in the form and the rest use a saved credential. Public images need neither. When editing, the token box is always blank; leave it blank to keep the saved token.

Inspect

Inspect reads the image from the registry without running it and saves its exposed ports and folder list. The wizard uses these to fill in Port and offer volumes. Large images take a minute or so, and closing the window doesn't stop it.

08Credentials

Cloud and registry logins. Row icons, left to right: Test, Access report (cloud only), Edit, Delete.

Credential types

Type sets the fields. Saved secrets show as dots: leave them to keep the secret, type over them to replace it. Type can't be changed after saving.

Test

Test signs in for real and reports back in a notification. Azure results end with the client secret length, which catches a secret truncated on paste. Tests time out after 90 seconds.

Access report

The shield icon runs read checks for an Azure, AWS or Google credential at three levels: tenant or organisation, then subscription, account or project, then billing. Denied rows with an orange i have a fix as a copyable command. A run takes 15 to 60 seconds. The last result stays, marked cached, until Refresh.

09Deploy

Steps depend on the target: seven for ACI, five for Cloud Run. The mock lets you click the rail to jump between steps. The app only moves with Next and Back.

App and Credential

Next stays disabled until an app card is selected. The Credential step lists Azure Service Principals for both Azure targets and GCP Service Accounts for Cloud Run. With none saved it shows No matching credentials. Add a azure-sp in the Credentials panel first. Local Bundle skips the step and uses the app's registry login.

Configure

Port is pre-filled for inspected apps (Auto-detected from image inspection). Otherwise the hint reads No port discovered — inspect the image or enter manually. Names take letters, numbers, hyphens and underscores, up to 63 characters, and are lowercased.

Registry login in a bundle

Sets which pull login ships in the README. Embed the app's credential writes the app's own token. Embed a different token takes a read-only token for this bundle only; Arch doesn't save it. Keep it private leaves the login out for whoever runs the bundle to supply.

Network (ACI only)

Public IP is open to anyone. Private VNet has no public address. VNet + Load Balancer sits behind a public load balancer that admits only the source addresses you list. Both VNet modes take an existing network and subnet, or Create New makes a /28.

Env Vars and Volumes

Key and value rows, passed to the container as environment variables or written to .env in a bundle. Empty rows are ignored. The × on the last row clears it.

Volumes lists the folders found by inspection. Tick the ones that need to survive a restart; anything below a ticked folder greys out. On Azure each becomes a file share on a storage account created with the deployment. In a bundle each becomes a folder under ./data. Uninspected apps can skip the step.

Review

Press Deploy (Generate Bundle for a Local Bundle). Arch shows Deployment started and opens the new deployment.

10Deployments

Every deployment, failed ones included. ACI rows show their resource group under the target. Click a row for its detail view.

Detail view

Layout varies by target and outcome. Callouts refer to the ACI view.

1. 1Header buttons. Show Deployment Template is always there. Succeeded ACI deployments add Check for Updates, Redeploy Image and Restart Container.
2. 2Summary cards. Status, location, timing and the rest at a glance.
3. 3Configuration. Includes the digest actually deployed and the URL.
4. 4Deployed Resources. Created means Arch made it, Existing means it was reused. Destroy All Resources is underneath.
5. 5Helpful Commands. az commands to open a shell in the container and follow its logs. Container Apps adds platform logs and a replica list.
6. 6Persistent Storage. ACI volumes, with Add Volume Mount and a Remove per row.
7. 7Logs. Every step of every action, newest last, following live while something runs. Delete is here.

Updates and restarts (ACI)

Arch records the image digest at deploy time. Check for Updates compares it with what the tag points to now, and if they differ Apply Update moves the container to the newer image. Redeploy Image does the same without checking. Both end with Image updated — restart the container to apply changes.

Restart Container confirms with Restart the container? It will be briefly unavailable. The container is down for a few seconds.

Storage after deploy (ACI)

In Add Volume Mount, press Inspect, pick a folder and press Attach Storage. Arch adds a 50 GB file share and restarts the container with it mounted over that folder. The share starts empty, so copy out anything worth keeping first.

The folder list comes from the app's inspection. No cached paths. Go to GHCR Apps and click Inspect Image first. means the app needs inspecting under Apps. Remove confirms with Remove this volume mount? The container app will be restarted.

Custom domain (Container Apps)

Arch doesn't edit DNS. With a custom domain set in the wizard, the detail view lists two records to create: a TXT proving ownership and a CNAME pointing at the app (an A record for a bare domain such as corp.lab). Then press Bind Domain. Azure issues a free certificate in 5 to 20 minutes.

A bind before DNS has propagated fails. Press it again later.

Local bundle downloads

Download Bundle (.zip) gets everything. The other buttons preview single files. Docker install scripts… covers hosts without Docker: apt and dnf Linux, generic Linux, Windows and macOS.

On the target host, unzip and follow the README from that folder: create the data folders, log in to the registry if told to, then docker compose pull and docker compose up -d. Update and stop steps are in the README too.

Deployment template

ARM Template is the exact template sent for an ACI deployment. Other targets show No saved template available for this deployment. Deployment Inputs lists every wizard choice, for any target.

Destroy and delete

Destroy All Resources (Destroy Service on Cloud Run) deletes what Arch built in the cloud and logs each item. It confirms first with This will DELETE the cloud resources created by this deployment. This cannot be undone. Continue? The resource group is kept, as is anything Arch didn't create, such as a pre-existing Container Apps environment.

Delete removes the deployment from Arch with its log, template and bundle. Cloud resources keep running.

11Statuses

The Deployments filter has no Destroyed or Interrupted option. Those show under All.

12Users

Admin only, Application sign-in only. A user can register apps, manage credentials, deploy, update and destroy; an admin also gets Users, Server Logs and Backup. Edit changes the role and nothing else, so a forgotten password means deleting and re-adding the account. Your own account can't be deleted.

Under Array sign-on the panel is hidden and shows User accounts are managed in Nectere Array. if reached.

13Server Logs

The last 500 lines of today's app-wide activity, tagged by area. Refresh loads newer lines.

14Backup and restore

• Export configuration downloads necterearch-conf-YYYYMMDD-HHmmss.zip with apps, credentials, deployments, logs and bundles.
• Import configuration replaces everything, with no merge. It confirms with This OVERWRITES all current configuration with the uploaded backup. Continue?
• After Import complete. Restart the app container to apply., restart from the Array tile with State › Restart.
• Credentials in the backup are encrypted with the tile's AZ_CREDENTIAL_KEY, so the zip holds no readable secrets. They only open on a tile with the same key value in its .env.

15Things to know

• Delete doesn't destroy. Destroy first.
• Inspect before deploying. No inspection means no port auto-fill, no volumes, and no storage on ACI later.
• Aftercare is ACI only. Other targets update by deploying again.
• A tag isn't a version. An ACI deployment of latest stays on the recorded digest until an update is applied.
• Cloud Run only pulls from Google's registries. Push GHCR or Docker Hub images to Artifact Registry first.
• Container Apps lose their disk unless volumes are picked in the wizard.
• HTTPS on ACI is a label. The image must serve TLS.
• Arch doesn't touch DNS.
• Old login subtitle. GHCR → Azure Container Instances is left over from the first version.

16Troubleshooting