Deployment

Deployment

Requirements

• Server: Docker and Docker Compose (for the path below), or Rust + PostgreSQL for local development.
• Agent: Windows 10/11 (64-bit). Build on Windows, or cross-compile from Linux with cargo-xwin.

Docker Compose

1. Configure

Copy the example environment file from the repository root and edit it:

cp env.example .env

Set at least:

Variable	Purpose
POSTGRES_PASSWORD	Database password (required by Compose).
UI_PASSWORD	Password for the web dashboard login.
AGENT_SECRET	Shared secret; agents must use the same value (see Usage).

Optional: POSTGRES_DB, POSTGRES_USER (defaults: monitor / monitor).

Full variable reference: Configuration.

2. Direct port (LAN or testing)

Use this when you open http://host:9000 without a TLS reverse proxy in front:

• Set PUBLISH_PORT=9000 (or another host port) in .env.
• Set ENFORCE_HTTPS=false. Otherwise the server expects X-Forwarded-Proto: https and plain HTTP gets HTTP 426.

Then:

docker compose up -d --build

Open http://localhost:9000 (or http://<server-ip>:9000) and sign in with UI_PASSWORD.

3. Traefik or another reverse proxy (TLS)

The Compose file includes Traefik labels:

1. Ensure the external Docker network exists (default name traefik, or set TRAEFIK_NETWORK).
2. In .env: TRAEFIK_ENABLE=true, TRAEFIK_HOST=your.domain.example, and match TRAEFIK_ENTRYPOINT / TRAEFIK_CERTRESOLVER to your Traefik config.
3. You can omit PUBLISH_PORT if traffic only goes through Traefik.
4. Keep ENFORCE_HTTPS=true so the server trusts requests where the proxy sets X-Forwarded-Proto: https.

Point agents at wss://your.domain.example/ws/agent when the public URL is HTTPS.

4. Health check

curl -sS -o /dev/null -w "%{http_code}" http://127.0.0.1:9000/healthz

Expect 200. The server image defines a Docker HEALTHCHECK on /healthz.

Docker image

The image is built from server/Dockerfile (multi-stage: frontend build, Rust build, slim runtime). From the repo root:

docker compose build