> For the complete documentation index, see [llms.txt](https://docs.alpha-security.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.alpha-security.app/deployment/docker-compose.md).

# Docker Compose

This is the recommended way to deploy Alpha. The production compose file runs the server behind nginx, so you only expose one port.

## Setup

```bash
git clone https://github.com/shoamshilo/alpha-security.git
cd alpha-security/deploy
cp .env.example .env
```

Edit `.env` with real values. At minimum:

```
POSTGRES_PASSWORD=<strong-password>
ALPHA_JWT_SECRET=<openssl rand -hex 32>
ALPHA_TOTP_ENCRYPTION_KEY=<openssl rand -hex 32>
```

See [Environment Variables](/deployment/environment.md) for the full list.

## Start

```bash
docker compose -f docker-compose.prod.yml up -d
```

This starts three containers:

* **postgres** on an internal network (not exposed)
* **server** on an internal network (not exposed)
* **web** (nginx) on port 80 (configurable via `ALPHA_WEB_PORT`)

Nginx proxies `/api/*` requests to the server internally.

## Create the first admin

```bash
docker compose -f docker-compose.prod.yml exec server \
  node dist/main.js cli create-admin \
  --email admin@yourfirm.com \
  --password YourPassword
```

## Stopping and restarting

```bash
docker compose -f docker-compose.prod.yml down     # stop
docker compose -f docker-compose.prod.yml up -d     # start again
```

Data persists in Docker volumes (`pgdata`, `objdata`). Removing containers does not lose data. Only `docker compose down -v` removes volumes.

## Optional: object store

For large binary artifacts (screenshots, pcaps), enable MinIO:

```bash
docker compose -f docker-compose.prod.yml --profile objectstore up -d
```

Set `ALPHA_OBJECT_STORE=s3` in `.env` along with the MinIO credentials.

## Updating

Pull the latest code and rebuild:

```bash
git pull
docker compose -f docker-compose.prod.yml up -d --build
```

Migrations run automatically on server startup.