Skip to content

Docker Installation

For servers where the full stack runs as containers via Docker Compose.

See Prerequisites for hardware/software requirements.

Container topology

Five services on an internal bridge network (itsm-network): nginx (80/443) in front of frontend (3000) and backend (3001), with backend talking to db (PostgreSQL 15), redis (Redis 7), and ai (the AI microservice, 3002).

Security features baked into the images:

  • Multi-stage build — all .ts/.tsx source is stripped in stage 1; only compiled JS ships in the runtime image
  • Fail-closed license validation — if vendor_public.pem is missing or tampered with, all API mutation requests return 403
  • Read-only license mount — license.key is mounted :ro
  • Isolated DB/Redis — not exposed to the host network directly
  • Redis eviction policy — allkeys-lru with enableOfflineQueue: false

Step 1 — Unpack the distribution archive

tar -xzf itsm-onprem-v1.1.0.tar.gz
cd itsm-onprem-v1.1.0

Step 2 — Configure environment parameters

cp .env.example .env

Edit .env:

# Database credentials
DB_USER=itsm_admin
DB_PASSWORD=YOUR_STRONG_POSTGRES_PASSWORD
DB_NAME=itsm_db_prod

# Security keys
JWT_SECRET=YOUR_SUPER_SECRET_JWT_KEY_AT_LEAST_32_CHARS

# Domain & networking
DOMAIN_NAME=itsm.yourcompany.com
NEXT_PUBLIC_API_URL=https://itsm.yourcompany.com/api

Lock down the file:

chmod 600 .env

How the DB password is used in this compose stack

docker-compose.prod.yml reads DB_USER/DB_PASSWORD/DB_NAME from .env twice: once to initialize the db container's POSTGRES_PASSWORD (only takes effect on the first container start against an empty volume), and once to build DATABASE_URL for the backend container. See Database Setup for how these fit together, and Changing the Database Password if you need to rotate it later — editing .env alone does not change an already-initialized Postgres volume's password.

Step 3 — Install the license key

cp /path/to/customer.license.key ./license.key
ls -la license.key backend/vendor_public.pem

Step 4 — Launch the stack

docker compose -f docker-compose.prod.yml up -d
docker compose -f docker-compose.prod.yml ps      # confirm all 5 services are healthy
docker compose -f docker-compose.prod.yml logs -f --tail=50

First-boot setup

  1. Open https://itsm.yourcompany.com (or http://localhost).
  2. The app detects a fresh install and shows the First-Boot System Setup screen.
  3. Fill in the Super Admin name, business email, and initial password.
  4. Click Complete System Setup.

Maintenance commands

# Restart services
docker compose -f docker-compose.prod.yml restart

# Full shutdown
docker compose -f docker-compose.prod.yml down

# One-off DB dump
docker exec -t itsm-db-prod pg_dump -U ${DB_USER} ${DB_NAME} > backup_$(date +%F).sql

Data persists across container restarts in named volumes: postgres_prod_data, redis_prod_data, itsm_uploads. docker compose down alone does not delete these — only down -v does.

Next steps