Quickstart
Fifteen minutes to a verified CA.
goca (the ngca engine) installs from one Compose file or one
binary. At the end of the short path you have a running CA, a changed
admin password, a real hierarchy with a test certificate issued, and an
audit chain the system itself has verified as intact.
Free early access — download on request. A person reviews every request.
Docker Compose Available
The fifteen-minute path. Two containers, no external services, no internet access after the image build. All-in-one to start; the same file carries a distributed profile when you want the issuance split to be real network segments.
Windows + YubiKey
The honest Windows path. There is no Windows service today — you run the Compose bundle on Docker Desktop, or pass the YubiKey into a real WSL2 distro for hardware custody. Facts first, then the recipe, gotchas included.
Linux standalone Available
One cgo-built binary and a hardened systemd unit, with the console, migrations and the manual compiled in. You bring the PostgreSQL — and the firewall.
What ships today — and what doesn't
Built and supported in v0.1.0: Docker Compose (all-in-one and distributed profiles) and Linux standalone (one binary, systemd, external PostgreSQL). Designed but not built: the Linux appliance with embedded PostgreSQL, the Windows all-in-one service, the offline root kit, and Kubernetes/Helm packaging — no chart or manifests ship. This page will not pretend otherwise; the manual doesn't either.
Every command on these pages is taken from the product manual — the same
manual that is embedded in the binary (ngca docs) and served
by the console.