# Install locally

> Run the Douklar stack on one Linux host with Docker, then sign in to the console.

> **Note.** The Douklar source repository is not public yet. This page
> describes the install for those who have a copy.

## What you need

- A **Linux x86_64** host with **Docker** and Docker Compose. This is the
  verified platform; others are not measured.
- A **Chromium**-based browser at desktop width. The console is not built for
  phones.
- For ECR moves from the CLI: the AWS CLI and exactly **ORAS v1.3.4** on
  `PATH`. Any other ORAS version is refused.

## Install and start

From the repository root:

```bash
./install.sh local
```

This one command:

1. Checks that Docker is reachable.
2. Creates `.env` from the example when it is missing, and generates the
   secrets it needs (including the app encryption key).
3. Builds and starts the stack: PostgreSQL, the bundled ZITADEL identity
   provider, the backend and the sync worker.
4. Creates the sign-in client, then prints the console address and the local
   sign-in details.

Open `http://127.0.0.1:5566` when it finishes.

Re-running `./install.sh local` skips healthy services and reuses the
existing sign-in client.

### Other ways to install

- `./install.sh ui` opens a graphical installer with **Express** or **Custom**
  setup that installs and verifies end to end.
- `./install.sh wizard` walks through guided profiles.

## What lives where

All persistent state is in Docker named volumes: the database, sessions and
encrypted credentials, sync output and reports. `docker compose down` removes
containers and keeps your data. `docker compose down -v` deletes everything.

> **Keep the ZITADEL master key.** It locks the identity provider's data. Back
> it up together with the database volume.

## Beyond one machine

The same stack runs against an external PostgreSQL (generic, Amazon RDS or
Supabase on the session pooler, port 5432) and an external ZITADEL or Amazon
Cognito. Remote and production modes require explicit allowed hosts, CORS,
HSTS, an app encryption key and TLS database connections.

Never expose an instance running without sign-in (`AUTH_MODE=none`) to a
network. That mode is for a single local user only. The app refuses to
start with it unless `APP_ENV=local`.

## Roles

Douklar has three fixed roles, mapped from your identity provider's groups:

| Role | Can |
|---|---|
| `admin` | Everything, including configuration and credentials |
| `operator` | Run syncs, S3 Batch and image checks; browse; read documents |
| `viewer` | See the overview and the S3 and ECR inventories |

The highest mapped role wins.

Source: https://douklar.app/docs/douklar/install (Douklar docs, last checked 2026-10-23)