Install dmsforall on a server

This page covers an installation on a server. The Quick start gives the short version for localhost.

At the end of this page, the stack runs on your server, and you have checked that it answers.

Requirements

Docker Engine and Docker Compose v2.
For HTTPS on a domain: a DNS name that points to the server, and ports 80 and 443 open to the Internet.
Disk space for the PostgreSQL data, the backups and the uploaded documents.

Settings

Copy .env.example to .env and edit the values you need. Every setting is documented in the file and in the configuration reference. The most common ones are:

Variable	Default	Effect
`DFA_SITE_ADDRESS`	`http://localhost`	Address of the site. Set a domain name to get HTTPS.
`DFA_PUBLIC_URL`	`http://localhost:8080`	Public address that users type in the browser. Must match the site address.
`DFA_HTTP_PORT`	`8080`	Host port for HTTP.
`DFA_HTTPS_PORT`	`8443`	Host port for HTTPS.
`DFA_VERSION`	`latest`	Image version to run.
`DFA_TRUST_PROXY_HOPS`	`1`	Number of reverse proxies in front of the API.

The database passwords are not in the file. The init-secrets service generates them on the first start and keeps them in the dfa_secrets volume.

HTTPS

When DFA_SITE_ADDRESS is a domain name, Caddy obtains and renews a Let’s Encrypt certificate by itself. Ports 80 and 443 must reach the server.

The services

Service	Role
`proxy`	Caddy. Publishes the HTTP and HTTPS ports and routes requests.
`web`	The web interface.
`api`	The API. Not published.
`worker`	Background jobs, from the same image as the API.
`migrate`	Applies the database migrations before the API starts.
`postgres`	PostgreSQL 16. Not published.
`redis`	Redis. Not published.
`init-secrets`	Generates the database passwords once.

PostgreSQL and Redis are never published on a host port.

Optional profiles

--profile ocr: starts the image ghcr.io/selfhostr/dmsforall-ocr, which reads vehicle registration documents. This profile has not been started yet.
--profile backup: starts the nightly encrypted backups. It needs AGE_CLE_PUBLIQUE in .env. See Back up and restore.

docker compose --profile backup up -d

Build from source

To build the images from the repository instead of pulling them:

docker compose -f docker-compose.yml -f docker-compose.build.yml up -d --build

Check the installation

docker compose ps
curl -s http://localhost:8080/api/v1/sante

Replace localhost:8080 with your domain for a server. Expected result: postgres and redis are healthy, migrate has exited without error, api and worker are running, and the health endpoint returns a JSON document.