Install DurpDeploy

This guide uses the supplied Docker Compose stack on a Linux host with rootful Docker. It runs DurpDeploy, Caddy for HTTPS, and Litestream for database backups. You do not need Go or Node.js on the host for this installation.

Before you start

Prepare these items:

• A Linux host with Docker Engine, Docker Compose v2, Git, and OpenSSL.
• A domain name pointing to that host, such as deploy.example.com.
• Inbound ports 80 and 443 for HTTPS setup and browser access.
• An S3 or S3-compatible bucket and credentials for database backups.
• Access to the container registries named in the supplied Compose file.

The stack also publishes 23187 for remote agents. Restrict this port to your agent networks with your host or network firewall. Keep the application backend port 8080 private.

The execution runtime can run scripts with access to host resources. Allow only trusted people to author scripts.

1. Get the files

Run these commands on the server:

git clone https://gitlab.durp.info/durfy/apps/durpdeploy.git
cd durpdeploy
cp compose.example.yml compose.yml

Keep this directory for later administration commands. The examples below run from this directory. Record the source revision with git rev-parse HEAD.

2. Create the encryption key

DurpDeploy uses this key to protect stored secrets. Keep it with your recovery materials, separately from the database backup. Use the same key after a restart or restore.

mkdir -p secrets
openssl rand -base64 32 > secrets/durpdeploy_key
chmod 0600 secrets/durpdeploy_key
sudo chown 10001:10001 secrets/durpdeploy_key

Run key generation only for a new installation. Replacing an existing key makes stored encrypted values unreadable. The ownership command lets the application container read the file without making it public.

3. Set the public addresses

Create compose.caddy.env with these lines:

DURPDEPLOY_URL=https://deploy.example.com
BACKEND=app:8080

Replace deploy.example.com with your domain. Create .env with the direct agent address:

DURPDEPLOY_AGENT_PUBLIC_URL=https://deploy.example.com:23187

Agents use this separate port directly. Their traffic does not pass through Caddy.

Create the optional application settings file:

touch compose.app.env

Leave it empty for now. Later, you can add email or sign-in settings.

4. Configure backups

Create compose.litestream.env with your backup settings:

LITESTREAM_S3_BUCKET=your-backup-bucket
AWS_ACCESS_KEY_ID=your-access-key
AWS_SECRET_ACCESS_KEY=your-secret-key

For S3-compatible storage, add LITESTREAM_S3_ENDPOINT=https://your-storage-endpoint. Edit deploy/litestream.example.yml to set the region and a unique replica path for this installation. The Compose stack mounts that file directly.

Protect the settings files:

chmod 0600 .env compose.app.env compose.caddy.env compose.litestream.env

Keep these files out of source control. Read Backups and upgrades before relying on replication for recovery.

5. Build and start

Build the app and check key access:

docker compose build app
docker compose run --rm --no-deps --entrypoint /bin/sh app -ec \
  'su-exec 10001:10001 test -r /etc/durpdeploy/key'

The key check succeeds without printing the key. If it fails, fix file ownership before continuing.

Cache the staging helper in the execution runtime:

docker pull harbor.durp.info/dockerhub/library/alpine@sha256:ce64758a109eb420d874a118f87920e625e12d3634e03b4a5573fd9f6e5d3507
docker compose up -d
docker compose ps
docker compose logs --tail=50 app caddy litestream

Wait for the application to become healthy. Caddy obtains the HTTPS certificate when DNS and ports are ready.

6. Create the first administrator

Replace the example address and password:

docker compose run --rm --no-deps app admin create \
  --email admin@example.com --password '<strong-password>'

The password argument can enter shell history. Use a private administration session and handle its history according to your credential policy.

Open https://deploy.example.com and sign in with that account. There is no default administrator password. Continue with Your first deployment.

Other installation methods

• Rootless Podman: Follow the Podman instructions. Use the mapped key ownership and the compose.podman.yml override.
• Kubernetes: Follow the Helm chart guide. Use standalone agents for executable steps.
• Build locally: Follow the development guide for Go, Node.js, and generated assets.
• External databases: Follow the database configuration guide for PostgreSQL or SQL Server.

SQLite needs no separate database server and suits one application instance. Database migrations run automatically when DurpDeploy starts.