Docker Compose

Runtime requirements and other platforms: deployment overview. BaoTa / aaPanel and deploy.sh: baota.en.md.

Compose servicesCopy Anchor Link

The compose.yml project name is edgeweir: the volume is edgeweir_postgres-data, the network edgeweir_default.

The image is public; pulling needs no login. Tag rules: versions, upgrades, and rollback.

1. PrepareCopy Anchor Link

1. Provision a Linux server (amd64 or arm64) with Docker Engine and Docker Compose v2:

   Copy Text

   docker compose version

2. Open 8443/TCP in the cloud security group. Ports Docker publishes skip host firewalls such as ufw and firewalld; to limit sources, use the cloud security group or the DOCKER-USER chain. Before Docker Engine 28, hosts on the same layer-2 network can reach ports published to 127.0.0.1: use 28 or later. Exposure of 3000/TCP: ports and reverse proxy.

2. Fetch the filesCopy Anchor Link

The server needs only compose.yml and .env.

mkdir -p /opt/edgeweir && cd /opt/edgeweir
curl -fsSLO https://raw.githubusercontent.com/marvinli001/edgeweir/master/compose.yml
umask 077
curl -fsSL -o .env https://raw.githubusercontent.com/marvinli001/edgeweir/master/.env.example

3. Generate secretsCopy Anchor Link

sed -i "s|^EDGEWEIR_MASTER_KEY=.*|EDGEWEIR_MASTER_KEY=$(openssl rand -base64 32)|" .env
sed -i "s|^POSTGRES_PASSWORD=.*|POSTGRES_PASSWORD=$(openssl rand -hex 24)|" .env

Master key fileCopy Anchor Link

The master key can stay out of .env: put it in a file mounted as a Compose secret and leave EDGEWEIR_MASTER_KEY in .env empty.

umask 077
openssl rand -base64 32 > master.key
chown 1000 master.key   # the image runs as the node user (uid 1000)
sed -i "s|^EDGEWEIR_MASTER_KEY=.*|EDGEWEIR_MASTER_KEY=|" .env

compose.override.yml next to compose.yml (Compose merges it automatically):

services:
  console:
    environment:
      EDGEWEIR_MASTER_KEY_FILE: /run/secrets/edgeweir_master_key
    secrets:
      - edgeweir_master_key
secrets:
  edgeweir_master_key:
    file: ./master.key

The file's trailing newline is ignored; the console refuses to start when EDGEWEIR_MASTER_KEY is also set to a non-empty value or the file is empty or cannot be read.

Other secret filesCopy Anchor Link

These variables can be read from files too: set <variable>_FILE, mount the file as above, and leave the variable out of .env. The rules of the master key file apply.

Rotating the master keyCopy Anchor Link

To replace the master key (for example after a suspected leak) and move the encrypted data to the new one:

1. In .env, move the old value to EDGEWEIR_MASTER_KEY_PREVIOUS and set EDGEWEIR_MASTER_KEY to the output of openssl rand -base64 32. With files, use EDGEWEIR_MASTER_KEY_PREVIOUS_FILE and EDGEWEIR_MASTER_KEY_FILE.

2. docker compose up -d.

3. Wait for the log line no envelope uses EDGEWEIR_MASTER_KEY_PREVIOUS any more:

   Copy Text

   docker compose logs console | grep EDGEWEIR_MASTER_KEY_PREVIOUS

   On envelopes still use EDGEWEIR_MASTER_KEY_PREVIOUS: keep it set, keep the old key and look into the cannot re-seal lines.

4. Remove EDGEWEIR_MASTER_KEY_PREVIOUS and run docker compose up -d again.

4. Configure .envCopy Anchor Link

Set the console URL:

sed -i "s|^EDGEWEIR_PUBLIC_URL=.*|EDGEWEIR_PUBLIC_URL=https://cdn-admin.example.com|" .env

Required variables:

Common optional variables (uncomment in .env):

All variables: environment variables.

After setup, the node release source and the origin allow list are configured in System settings, GeoIP in Protection settings, and SMTP on the Alerts page; saving applies them without a restart. Values saved there take precedence over EDGEWEIR_SMTP_CA_FILE and EDGEWEIR_NODE_RELEASE_BASE_URL in .env, which take precedence over the defaults. EDGEWEIR_OUTBOUND_ALLOW_CIDRS bounds the outbound addresses saved there; the web console cannot widen it.

5. StartCopy Anchor Link

docker compose pull
docker compose up -d
docker compose logs -f console

Startup sequence:

6. Run setupCopy Anchor Link

1. Read the setup token:

   Copy Text

   docker compose logs console | grep setupToken

   An uninitialized console prints the same token at every start until it is used. The token is stored encrypted with the master key; a new master key yields a new token.

2. Open <EDGEWEIR_PUBLIC_URL>/setup and enter the setup token, name, email, and password to create the console account. The console also creates the default cluster default. Setup wizard: quick start.

Setup requests without a token or with a wrong token are rejected and written to the audit log. The token expires after a successful setup.

7. VerifyCopy Anchor Link

curl -s http://127.0.0.1:3000/healthz
docker compose ps

Expected: {"status":"ok","version":"<image tag>"}; console is healthy.

Optional componentsCopy Anchor Link

COMPOSE_PROFILES=analytics
EDGEWEIR_ANALYTICS=clickhouse
CLICKHOUSE_PASSWORD=<password>

docker compose up -d

Compose reads COMPOSE_PROFILES from .env, so every later docker compose command (up, pull, logs, down) includes ClickHouse without --profile analytics.

Console charts and alerts use PostgreSQL rollups. Access-log sampling is off by default and is enabled on a site's logs page; raw logs are retained for 7 days. Switching the storage mode does not migrate history. Details: access logs and AccessKeys.

Build from sourceCopy Anchor Link

git clone https://github.com/marvinli001/edgeweir.git /opt/edgeweir
cd /opt/edgeweir
docker compose up -d --build

The remaining steps are the same. The locally built image takes the same tag and reports version dev; run docker compose pull before returning to a published image.

Without Compose: standalone containersCopy Anchor Link

compose.yml is equivalent to two containers on a dedicated network. With an existing PostgreSQL 18, omit edgeweir-postgres and point DATABASE_URL at that database.

cd /opt/edgeweir
umask 077
POSTGRES_PASSWORD=$(openssl rand -hex 24)
cat > console.env <<ENV
DATABASE_URL=postgres://edgeweir:${POSTGRES_PASSWORD}@edgeweir-postgres:5432/edgeweir
EDGEWEIR_MASTER_KEY=$(openssl rand -base64 32)
EDGEWEIR_PUBLIC_URL=https://cdn-admin.example.com
EDGEWEIR_NODE_API_URL=https://cdn-admin.example.com:8443
ENV

docker network create edgeweir
docker run -d --name edgeweir-postgres --network edgeweir --restart unless-stopped \
  -e POSTGRES_USER=edgeweir -e POSTGRES_DB=edgeweir -e POSTGRES_PASSWORD="$POSTGRES_PASSWORD" \
  -v edgeweir-postgres:/var/lib/postgresql \
  postgres:18.6-alpine@sha256:77f585114c32fbca283dc835b0596f4e52b51b4c6662d7810b2f4084f60a1873
docker run -d --name edgeweir-console --network edgeweir --restart unless-stopped \
  --env-file console.env -e ROLE=all \
  -p 127.0.0.1:3000:3000 -p 8443:8443 \
  --read-only --tmpfs /tmp --security-opt no-new-privileges:true \
  ghcr.io/marvinli001/edgeweir:20260929-a1b2c3d

Upgrading standalone containers: upgrade.

TroubleshootingCopy Anchor Link