Install locally

Note. The Douklar source repository is not public yet. This page describes the install for those who have a copy.

What you need

• A Linux x86_64 host with Docker and Docker Compose. This is the verified platform; others are not measured.
• A Chromium-based browser at desktop width. The console is not built for phones.
• For ECR moves from the CLI: the AWS CLI and exactly ORAS v1.3.4 on PATH. Any other ORAS version is refused.

Install and start

From the repository root:

./install.sh local

This one command:

1. Checks that Docker is reachable.
2. Creates .env from the example when it is missing, and generates the secrets it needs (including the app encryption key).
3. Builds and starts the stack: PostgreSQL, the bundled ZITADEL identity provider, the backend and the sync worker.
4. Creates the sign-in client, then prints the console address and the local sign-in details.

Open http://127.0.0.1:5566 when it finishes.

Re-running ./install.sh local skips healthy services and reuses the existing sign-in client.

Other ways to install

• ./install.sh ui opens a graphical installer with Express or Custom setup that installs and verifies end to end.
• ./install.sh wizard walks through guided profiles.

What lives where

All persistent state is in Docker named volumes: the database, sessions and encrypted credentials, sync output and reports. docker compose down removes containers and keeps your data. docker compose down -v deletes everything.

Keep the ZITADEL master key. It locks the identity provider's data. Back it up together with the database volume.

Beyond one machine

The same stack runs against an external PostgreSQL (generic, Amazon RDS or Supabase on the session pooler, port 5432) and an external ZITADEL or Amazon Cognito. Remote and production modes require explicit allowed hosts, CORS, HSTS, an app encryption key and TLS database connections.

Never expose an instance running without sign-in (AUTH_MODE=none) to a network. That mode is for a single local user only. The app refuses to start with it unless APP_ENV=local.

Roles

Douklar has three fixed roles, mapped from your identity provider's groups:

The highest mapped role wins.