# Deploy in Exoscale

Learn how to deploy your first TrapEye instance in Exoscale. This guide focuses on the manual deployment through the Exoscale portal, but the same workflow applies when using IaC tools such as **Terraform** or the [Exoscale CLI](https://github.com/exoscale/cli).

---

## Create a New Instance

1. Navigate to **Compute → Private Networks** in the **Exoscale** Portal and choose the private network where the TrapEye deception engine will be deployed. Write down the `name` and `zone` of the private network, you will need this information during the instance creation process.

1. Go to **Compute → Instance** and create a new instance.

2. Choose a name for your virtual machine. Then click on the **Commercial Template** icon, search for the TrapEye template, and select it from the list.

   ![Template List](~/assets/images/docs/installation/exoscale/template_list.webp)

3. Select the zone that corresponds to your chosen private network. Then choose a size for your instance using the recommended values below:

   | Resource | Minimum Value | Recommended Value |
    |-----------|-------------------| -------------------|
    | **CPU**   | 1 vCPUs           | 1 vCPUs           |
    | **Memory**| 1024 MiB (1 GB)   | 2048 MiB (2 GB)   |
    | **Disk**  | 10GB              | 10GB              |

4. In the instance configuration section:  
   - Do **not** configure SSH keys.  
    - For **Public IP Assignment**, select: `inet4 (IPv4)`.

    ![Instance Config](~/assets/images/docs/installation/exoscale/instance_config.webp)

5. Select the private network identified in the earlier steps.

   :::note
        TrapEye agents are specifically designed to support only **one** network interface per instance. This design ensures attackers cannot use a trap to pivot or move laterally within your environment.
        
        When multiple network interfaces are present, TrapEye automatically detects and prioritizes binding to the private network interface over any public interface.
        :::

6. You may select the default Security Group. Since TrapEye is only intended to interact with your internal (private) network, there is no requirement to expose the instance via ingress rules.

7. From the TrapEye Platform, go to **Management → Installation** and copy the values for `url`, `entity_uuid`, and `auth_token`.

8. **Replace** the placeholder values in the template below with your TrapEye configuration parameters, then paste the final result into the **User Data** field.

   ```
    #cloud-config
    write_files:
      - path: /etc/trapeye/auth-config.toml
        permissions: '0600'
        content: |
          entity_uuid = "ENTITY-UUID-HERE"
          auth_token = "ENTITY-TOKEN-HERE"
          url = "INGESTION-URL-HERE"
    ```

    **Example:**

    ![Config Menu](~/assets/images/docs/installation/exoscale/user_data.webp)

9.  Click **Create** to provision the virtual machine.

## Setup complete

Your TrapEye virtual machine has been successfully deployed in **Exoscale**. 

It will now appear in the **Devices** section of the TrapEye Deception Platform, and you will begin receiving real-time alerts as soon as any activity is detected.