Installing the server

A production installation consists of three containers and a reverse proxy:

1. Application — the AuthPlus bundle image, listening on its internal port and bound to the loopback interface.
2. Database — PostgreSQL 18 with PostGIS, on a persistent volume. Not exposed outside the container network.
3. Object storage — an S3-compatible service on a persistent volume. Its data API stays internal; only the management console is proxied, if at all.
4. Reverse proxy — terminates TLS, redirects plain HTTP, and forwards the client’s real address so that verification locations are recorded correctly.

Configuration is entirely by environment variables. Database migrations run automatically at startup, and the first superadministrator account is created then from the credentials you supply.

Warning · Generate every secret before going live

The sample configuration ships with placeholder values for the signing keys, the token secret and the initial superadministrator password. All of them must be replaced with freshly generated random values. In particular, the key used to mint authenticity codes must be secret and backed up: anyone holding it could produce codes that verify, and losing it makes existing codes impossible to reissue.

Note · Health check

The service exposes a health endpoint that also reports database connectivity, suitable for a load balancer or monitoring probe. It answers with a degraded status rather than failing silently when the database is unreachable.