> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/getting-started/deployment-guide/deploying-with-docker-compose.md).

# Deploying with Docker compose

Docker Compose brings the whole platform up on a single machine from one configuration file. It is the quickest way to get a working SECUREpass, and the right choice for development, evaluation and staging.

For production, see *WAR-based deployment* — that is the path the prerequisites documents describe and the one that scales across nodes.

## What the stack contains

The compose configuration supplied with the deployment package brings up the SECUREpass services and the reverse proxy in front of them.

| Container      | Service                              | Internal port   | Reached at         |
| -------------- | ------------------------------------ | --------------- | ------------------ |
| `sp-nginx`     | Reverse proxy                        | 80 → host 8080  | `/`                |
| `sp-spauth`    | Authentication engine and login page | 8080            | `/AuthPage`        |
| `sp-admin`     | Admin console                        | 8082            | `/SecurepassAdmin` |
| `sp-ss`        | Self-Service Portal                  | 8083            | `/Securepass`      |
| `sp-otp`       | OTP generation and validation        | 8084            | `/OTP`             |
| `sp-tm`        | Tenant Manager                       | 8085            | `/SPTManager`      |
| `sp-jdbc`      | Database connectivity                | 8086            | `/SPJDBC`          |
| `sp-scheduler` | Scheduled jobs                       | 8088            | `/SPScheduler`     |
| `sp-radius`    | RADIUS and TACACS+                   | 1812 / 1813 UDP | —                  |
| `sp-ssh`       | SSH gateway for privileged sessions  | 8881            | —                  |

Everything except `sp-radius` and `sp-ssh` sits behind the proxy and is reached through it. Those two are addressed directly, so their ports have to be open to the networks that use them — network devices and VPN concentrators for RADIUS, privileged users for SSH.

The database is not part of the stack. Provision PostgreSQL separately and point the services at it.

## Before you start the stack

Set the environment variables and secrets first — at minimum the **database connection string** and the **encryption key material**.

{% hint style="warning" %}
Do not start the stack with placeholder values and correct them afterwards. Several services read key material only at startup, so a service that came up with a placeholder keeps using it until it is restarted — and the data it wrote in the meantime was protected with the wrong key.
{% endhint %}

Have ready before you begin:

* The PostgreSQL host, database, user and password, with the schema created and seeded
* The encryption and BYOK key material
* The hostnames the platform will answer on, and their TLS certificates
* Time synchronised on the host — OTP, TOTP and certificate validation all depend on it

## Bringing it up

{% stepper %}
{% step %}

### Start the stack

From the directory holding the compose file, start the stack in the background with your usual Compose command — conventionally:

```bash
docker compose up -d
```

{% endstep %}

{% step %}

### Watch the containers

```bash
docker compose ps
```

Services start in dependency order and take a little time to become healthy. A container that is up is not necessarily ready.
{% endstep %}
{% endstepper %}

## Verify before moving on

Check each service's health endpoint before configuring anything. A stack that starts without errors can still have a service that cannot reach the database, and that failure surfaces much later — usually as a login that does not work.

Confirm in this order:

{% stepper %}
{% step %}

### Every container is running

Confirm every container is running, not restarting. A container in a restart loop is almost always a configuration or database-connectivity problem — read its logs with `docker compose logs <container>`.
{% endstep %}

{% step %}

### The proxy answers

Reaching `/` should get you to SECUREpass rather than a proxy error.
{% endstep %}

{% step %}

### The login page loads

Confirm the login page loads at `/AuthPage`.
{% endstep %}

{% step %}

### The admin console loads

Confirm the admin console loads at `/SecurepassAdmin`, and you can sign in with the bootstrap credentials.
{% endstep %}
{% endstepper %}

Once all four hold, continue with *Database setup* and *Properties and key configuration*, then the *Initial configuration checklist*.

{% hint style="info" %}
Container deployment is described in the master documentation but is not covered by the current prerequisites documents, which describe the Tomcat and WAR path. Confirm container support and the supported image versions with eMudhra before planning a container deployment you intend to keep.
{% endhint %}