Install the On-Prem Worker

BigPanda provides a pre-signed URL for the Docker image. Download and load it:

curl -L '<PRESIGNED-URL>' -o adr-temporal-worker.tar.gz
docker load < adr-temporal-worker.tar.gz

BigPanda provides your organization's mTLS certificates during onboarding. Place them in a certs/ directory:

Example file structure:

certs/
├── client.pem       # Client certificate (identifies your organization)
├── client-key.pem   # Client private key
└── ca.cert          # BigPanda CA certificate

The filenames above are examples. The worker uses whatever paths you set in TEMPORAL_TLS_CERT_PATH, TEMPORAL_TLS_KEY_PATH, and TEMPORAL_TLS_CA_PATH. The names on disk do not matter as long as those variables point to the right files.

If you are upgrading an existing worker, stop and remove the current container:

docker stop adr-temporal-worker && docker rm adr-temporal-worker

Create an .env file with the following variables:

# --- Connection (provided by BigPanda) ---
TEMPORAL_ADDRESS=temporal.bigpanda.io:7233
TEMPORAL_TLS_CERT_PATH=/certs/client.pem
TEMPORAL_TLS_KEY_PATH=/certs/client-key.pem
TEMPORAL_TLS_CA_PATH=/certs/ca.cert

# --- Secrets (configured by you) ---
DEVICE_API_KEY=<your-monitoring-platform-api-key>

docker run -d \
  --name adr-temporal-worker \
  --restart unless-stopped \
  --log-opt max-size=50m \
  --log-opt max-file=3 \
  -p 8080:8080 \
  -v $(pwd)/certs:/certs:ro \
  --env-file .env \
  adr-temporal-worker:latest

Check the worker logs to confirm a successful start:

docker logs -f adr-temporal-worker

You should see output similar to:

Starting Temporal Worker
Worker state changed { state: 'RUNNING' }
Worker started
Health server listening

Then verify the health endpoints:

curl http://localhost:8080/health    # Returns: {"status":"ok","startedAt":"..."}
curl http://localhost:8080/ready     # Returns: {"status":"ready"}

apiVersion: v1
kind: Secret
metadata:
  name: adr-temporal-worker-secrets
  namespace: bigpanda
type: Opaque
stringData:
  DEVICE_API_KEY: "<your-monitoring-platform-api-key>"
---
apiVersion: v1
kind: Secret
metadata:
  name: adr-temporal-worker-certs
  namespace: bigpanda
type: Opaque
data:
  client.pem: <base64-encoded-cert>
  client-key.pem: <base64-encoded-key>
  ca.cert: <base64-encoded-ca>

apiVersion: apps/v1
kind: Deployment
metadata:
  name: adr-temporal-worker
  namespace: bigpanda
spec:
  replicas: 1
  selector:
    matchLabels:
      app: adr-temporal-worker
  template:
    metadata:
      labels:
        app: adr-temporal-worker
    spec:
      containers:
        - name: worker
          image: adr-temporal-worker:latest
          ports:
            - containerPort: 8080
          envFrom:
            - secretRef:
                name: adr-temporal-worker-secrets
          env:
            - name: TEMPORAL_ADDRESS
              value: "temporal.bigpanda.io:7233"
            - name: TEMPORAL_TLS_CERT_PATH
              value: "/certs/client.pem"
            - name: TEMPORAL_TLS_KEY_PATH
              value: "/certs/client-key.pem"
            - name: TEMPORAL_TLS_CA_PATH
              value: "/certs/ca.cert"
          volumeMounts:
            - name: certs
              mountPath: /certs
              readOnly: true
          resources:
            requests:
              memory: "256Mi"
              cpu: "100m"
            limits:
              memory: "512Mi"
              cpu: "500m"
          livenessProbe:
            httpGet:
              path: /health
              port: 8080
            initialDelaySeconds: 30
          readinessProbe:
            httpGet:
              path: /ready
              port: 8080
            initialDelaySeconds: 15
      volumes:
        - name: certs
          secret:
            secretName: adr-temporal-worker-certs

Primary connection configuration is provided by the Bigpanda team.

Secrets are configured by you, following the procedure for the connected monitoring platform.

Use these endpoints for container orchestration health probes such as Docker healthcheck or Kubernetes liveness and readiness probes.

docker logs -f adr-temporal-worker          # View live logs
docker logs --tail 100 adr-temporal-worker  # View last 100 lines
docker restart adr-temporal-worker          # Restart the worker
docker stop adr-temporal-worker             # Stop the worker
docker rm adr-temporal-worker               # Remove the worker
curl http://localhost:8080/health           # Check health status
curl http://localhost:8080/ready            # Check readiness status