Deployment — Docker Compose

Run VisionPush on a single server without Kubernetes. Suitable for small deployments, staging, or evaluation.

Prerequisites

Quick start

Shell
git clone https://github.com/VisionLab-de/VisionPush.git
cd VisionPush

# Copy and configure environment
cp .env.example .env
# At minimum set JWT_SECRET and CREDENTIAL_ENCRYPTION_KEY

docker compose -f infra/docker/docker-compose.yml up -d --build

# Admin panel dev server
cd admin && npm install && npm start

Services

Environment variables

Copy .env.example to .env and fill in the required values:

.env
# Required
JWT_SECRET=$(openssl rand -base64 32)
CREDENTIAL_ENCRYPTION_KEY=$(openssl rand -base64 32)

# Database (pre-configured for Docker Compose)
DATABASE_URL=postgres://visionpush:visionpush_dev_secret@postgres:5432/visionpush

# NATS
NATS_URL=nats://nats:4222

# Blob storage — filesystem (default)
STORAGE_BACKEND=filesystem
STORAGE_PUBLIC_URL=http://localhost:8090/media
STORAGE_DATA_DIR=./data/blobs

# Blob storage — S3 / Cloudflare R2 (production)
# STORAGE_BACKEND=s3
# S3_BUCKET=your-bucket
# S3_REGION=auto
# S3_ENDPOINT=https://account.r2.cloudflarestorage.com
# AWS_ACCESS_KEY_ID=...
# AWS_SECRET_ACCESS_KEY=...

# SMTP (optional — password reset + team invites)
# SMTP_HOST=smtp.resend.com
# SMTP_PORT=587
# SMTP_USER=resend
# SMTP_PASSWORD=...
# SMTP_FROM=VisionPush <noreply@yourdomain.com>

# Public URL used in invite/reset emails
# APP_URL=https://app.yourdomain.com

Persistent data

Shell — destroy all data
docker compose -f infra/docker/docker-compose.yml down -v

Backup and restore

Automated backups (WAL-G)

The backup service runs WAL-G daily at 02:00 UTC and pushes base backups to the configured S3 bucket. WAL segments are continuously archived — point-in-time recovery is possible down to ~1 minute.

Configure a real S3 bucket in .env:

.env — production S3
WALG_S3_PREFIX=s3://your-real-bucket/visionpush/
AWS_ACCESS_KEY_ID=real-key
AWS_SECRET_ACCESS_KEY=real-secret
AWS_REGION=eu-central-1
# Remove AWS_ENDPOINT and AWS_S3_FORCE_PATH_STYLE for real AWS S3

Restore

Shell
# Latest backup
bash infra/docker/scripts/restore.sh LATEST

# Point-in-time recovery
bash infra/docker/scripts/restore.sh "2026-05-19T03:00:00Z"

# Named backup
bash infra/docker/scripts/restore.sh base_000000010000000000000002

Production checklist

• Change default PostgreSQL password (POSTGRES_PASSWORD + DATABASE_URL)
• Set strong JWT_SECRET and CREDENTIAL_ENCRYPTION_KEY
• Configure a real S3/R2 bucket for WAL-G backups (MinIO is local-only)
• Set STORAGE_BACKEND=s3 and configure S3 vars
• Configure SMTP for password reset and team invite emails
• Place a reverse proxy (Caddy, Nginx, Traefik) in front for TLS
• Change the default admin password (admin@example.com / changeme)

Caddy reverse proxy example

Caddyfile
api.yourdomain.com {
    reverse_proxy localhost:8090
}

app.yourdomain.com {
    reverse_proxy localhost:4200
}

Day-to-day operations

Shell
# Stop
docker compose -f infra/docker/docker-compose.yml down

# Pull new images and restart
docker compose -f infra/docker/docker-compose.yml pull
docker compose -f infra/docker/docker-compose.yml up -d

# Tail logs
docker compose -f infra/docker/docker-compose.yml logs -f visionpush-api
docker compose -f infra/docker/docker-compose.yml logs -f visionpush-worker

Docker Compose vs. Kubernetes