Self-hosting in one command

Every service — gateway, control plane, console, agent artifacts, Postgres and a Caddy ingress with TLS — comes up from one Docker Compose command on infrastructure you control. Every secret is generated on first boot; the first administrator’s password is printed once, in the logs, and nowhere else.

The whole stack self-hosts with one command; an air-gap bundle ships every image.

Prerequisites

• Docker Engine 24+ with the Compose plugin (docker compose version).
• Ports 443 (and 80 for the letsencrypt TLS mode) free on the host.
• For a real hostname: DNS for DSH_HOSTNAME pointing at the host.

Get the bundle

Customers get the deployment bundle from the licensing portal’s Downloads page, not by cloning this repository. Two bundle types are offered there: an air-gapped tarball with every image embedded, or a lighter compose bundle that pulls its images from the registry using the credentials in your licence e-mail.

Install: air-gapped tarball

Extract the bundle and, optionally, set a hostname and TLS mode in .env — the default is localhost with a self-signed certificate. No registry access needed:

tar -xzf dsh-stack-0.1.0-airgap.tar.gz && cd dsh-stack-0.1.0-airgap
for t in images/*.tar; do docker load -i "$t"; done
# optional: DSH_HOSTNAME / DSH_TLS_MODE in .env as above (no image variables needed)
docker compose up -d --wait
docker compose logs control-plane | grep -A6 'FIRST-BOOT ADMIN'

Open https://<DSH_HOSTNAME>/ and sign in with admin@localhost (or DSH_ADMIN_EMAIL if set) and that password. With the registry-access compose bundle, skip the docker load loop — sign in to the registry with the credentials in your licence e-mail instead, and the images pull automatically — then bring it up and check the log the same way.

Day 2

One operator CLI covers status, backup, upgrade and restore — the backup includes the key-encryption key, so guard the archive like a credential:

./dsh-stack status
./dsh-stack backup            # includes the KEK — guard the archive like a key
./dsh-stack upgrade 0.2.0
./dsh-stack restore <archive>

Bring your own model — OpenAI-compatible endpoints, Ollama, Anthropic, or Cloudflare AI Gateway / Workers AI — with keys envelope-encrypted at rest.