Install with Docker Compose

Bring it up

export IMAGE_REGISTRY=ghcr.io/salusapp-ai
export IMAGE_TAG=v0.4.0            # the release you are installing
export VAULT_KEY="$(openssl rand -hex 32)"
export FPE_KEY="$(openssl rand -hex 32)"
export AUDIT_ENC_KEY="$(openssl rand -hex 32)"
export GATEWAY_ASSERTION_KEY="$(openssl rand -hex 32)"
export BOOTSTRAP_KEY="$(openssl rand -hex 32)"
export BOOTSTRAP_ADMIN_SHA256="$(printf '%s' "$BOOTSTRAP_KEY" | openssl dgst -sha256 | awk '{print $NF}')"

docker compose -f docker-compose.prod.yml pull
docker compose -f docker-compose.prod.yml up -d

The console and the API are served on host port 8080. Place a reverse proxy with your certificate in front of it; the stack itself speaks plain HTTP.

What is different from the chart

• The Compose stack runs the gateway, the main service, the rule service, the entity model and the verifier. The role model service and the OCR services are not part of it, so date-of-birth detection by role and scanned-page reading are available on the chart only.
• The production Compose file ships with a default database password. Change it before the host sees real data.
• Metrics ports are published on the host. Firewall them or bind them to a private interface.

Verify and bootstrap

curl -fsS http://localhost:8080/health
curl -fsS http://localhost:8080/admin/v1/bootstrap \
  -H "Authorization: Bearer $BOOTSTRAP_KEY" -H 'content-type: application/json' \
  -d '{"name":"platform-admin","expires_at":"2027-01-01T00:00:00Z","reason":"initial setup"}'

Then open http://localhost:8080/console/ through your proxy, bootstrap the first console account with the same key, and continue with Keys and tenants.

Upgrade and roll back

Pin IMAGE_TAG to the release you want and run docker compose -f docker-compose.prod.yml pull && up -d. Rolling back is the same command with the previous tag. Back up PostgreSQL before either.