JAS Service Mode Installation

Install JFrog Advanced Security (JAS) in service mode with Xray 3.156.x+ using installV2.sh or configV2.sh, in standalone (separate VM) or bundled (same VM) deployment, or with Helm.

Starting from JFrog Xray version 3.156.x, you can install JFrog Advanced Security (JAS) as separate services. On VMs, you install JAS with the interactive installer script, in one of two deployment modes:

Standalone (recommended for production): Xray and JAS run on different VMs. The Xray VM runs Xray only, and one or more dedicated JAS VMs run the JAS services together with the router and observability services.
Bundled (not production-ready): Xray and JAS run on the same VM. Use it only for a POC when there are resource constraints.

In both modes, JAS is installed optionally by passing a flag to the interactive installV2.sh script (RPM, Debian, and Linux Archive) or configV2.sh script (Docker Compose).

On Kubernetes, you enable JAS service mode in the Xray Helm chart. For more information, see Helm JAS Installation.

Service mode is a completely new installation mode. It is not related to the previous JAS installation methods, such as the Ansible-based installation without Helm.

Prerequisites

Xray version 3.156.x or later.
Xray and JAS must run the same version. In the standalone mode, install each JAS VM with the same version of the Xray archive as the Xray VM.
On VMs, JAS service mode is supported only with installV2.sh / configV2.sh. It is not supported with the legacy install.sh / config.sh scripts.
Check and follow the Xray interactive script installation prerequisites before proceeding with the installation.
JAS uses the Xray database. No separate database is needed for JAS.
For the standalone mode, each JAS VM connects to the same database and RabbitMQ as the Xray VM. Make sure the following ports are open from each JAS VM:

Service Port
PostgreSQL 5432
RabbitMQ 5672
For the standalone mode, have the Xray master key available. The installer prompts you for it on each JAS VM. You can retrieve the master key from the Xray VM by running the following command:

For RPM, Debian, and Docker Compose:
```
cat /var/opt/jfrog/xray/etc/security/master.key
```
For Linux Archive:
```
cat /opt/jfrog/xray/var/etc/security/master.key
```

Service	Port
PostgreSQL	5432
RabbitMQ	5672

Sizing Requirements

JAS sizing requirements are determined by the scale of your environment. Use the indexed artifact count as the primary decision input.

Standalone JAS ( Separate VM )

The following table lists the resources required for each JAS VM, and the number of JAS VMs to deploy, in the standalone mode.

Indexed artifacts	Builds per day	JAS cores per node	JAS RAM [GB] per node	JAS nodes	JAS disk space / node [GB]
100,000	1,000	6	24	1	500
1,000,000	10,000	8	24	2	300
2,000,000	20,000	8	24	4	300
10,000,000	50,000	8	24	8	300
20,000,000	100,000	8	24	10	300
40,000,000	200,000	8	24	18	300
80,000,000	500,000	8	24	30	300

For the bundled mode sizing, see Bundled JAS Installation ( Not Production-Ready ).

Supported Installer Types

RPM / Debian
Linux Archive
Docker Compose
Helm

Install JFrog Advanced Security in Service Mode

Follow the instructions for your deployment mode:

Standalone JAS ( Separate VM )

Recommended for production. Install JAS on one or more dedicated VMs, separate from Xray, for RPM, Debian, Linux Archive, and Docker Compose.

Bundled JAS ( Not Production-Ready )

For POC only. Install JAS on the same VM as Xray, for RPM, Debian, Linux Archive, and Docker Compose.

Helm JAS

Enable JAS service mode in the Xray Helm chart on Kubernetes.

Add JAS to an Existing Xray Installation

If Xray is already installed, you can add JAS in service mode, bundled on the Xray VM or standalone on new JAS VMs, by following the same instructions. This is a fresh installation of JAS. It is not a migration from the previous Ansible-based JAS installation to service mode.

Xray must be on version 3.156.x or later and installed with installV2.sh / configV2.sh. For Helm installations, see Helm JAS Installation.
Each JAS VM must run the same version as the Xray VM.
On the Xray VM, re-run the installer with --include-jas and select the deployment mode. This sets jas.separate.service.enabled: true in the Xray system.yaml. Then restart Xray.
For the standalone mode, install each new JAS VM with --jas-node.

Prerequisites

Sizing Requirements

Standalone JAS ( Separate VM )

Supported Installer Types

Install JFrog Advanced Security in Service Mode

Add JAS to an Existing Xray Installation

Related Topics