Advanced installation

servasec can be deployed with Docker Compose, Podman Quadlet, or Helm.

Docker Compose

Available since v0.0.2

Prerequisites

• Docker and Docker Compose (v2+)
• Git
• 2 CPU cores, 4 GB RAM (minimum)

Community edition

git clone https://github.com/servasec/servasec.git
cd servasec
cp .env.example .env
# update .env as needed
make community

Uses docker-compose.prod.yml with multi-stage Docker builds.

Pro edition

git clone https://github.com/servasec/servasec.git
cd servasec
cp .env.example .env
# set SSC_LICENSE_KEY in .env
make pro

Compose files

File	Purpose
docker-compose.dev.yml	Local development with hot-reload
docker-compose.prod.yml	Production deployment

Volumes

Volume	Mount	Purpose
caddy_data	/data	TLS certificates
postgres_data	/var/lib/postgresql/data	Database persistence

Podman Quadlet

Added in v0.3.0

For systemd-integrated container management without a Docker daemon.

Prerequisites

• Podman 4+
• systemd

Install

git clone https://github.com/servasec/servasec.git
cd servasec
make podman-install

Copies Quadlet files to /etc/containers/systemd/ and enables the services.

Start

make podman-up

Services

Quadlet defines:

• servasec-backend.container
• servasec-frontend.container
• servasec-postgres.container
• servasec-caddy.container

Plus volumes: caddy_data, postgres_data

Management

# View logs
make podman-logs

# Stop all
make podman-down

# Rebuild and restart
make podman-up

Helm

Added in v2.1.0

For Kubernetes deployments, servasec provides a Helm chart.

Prerequisites

• Kubernetes cluster 1.25+
• Helm 3.10+
• Ingress controller (Traefik or your own)

Add the repository

helm repo add servasec https://servasec.github.io/helm-charts
helm repo update

Install

helm install servasec servasec/servasec \
  --namespace servasec --create-namespace \
  --set domain.name="servasec.example.com" \
  --set secrets.postgresPassword="<secure-password>" \
  --set secrets.jwtSecret="<64-char-random>"

Configuration reference

The chart supports the following options:

Parameter	Default	Description
domain.name	servasec.local	Deployment domain
domain.publicUrl	https://servasec.local	Public-facing URL
image.backend.repository	ghcr.io/servasec/servasec/backend	Backend image
image.frontend.repository	ghcr.io/servasec/servasec/frontend	Frontend image
ingress.type	traefik	Ingress type (traefik or k8s Ingress)
postgresql.internal	true	Use bundled PostgreSQL
postgresql.externalUrl	""	External DB connection string
replicaCount	1	Backend replicas
autoscaling.enabled	false	Enable HPA
networkPolicy.enabled	false	Enable network policies

See the full values reference for all options.

Pro edition

Create a values-pro.yaml override file:

image:
  backend:
    repository: ghcr.io/servasec/servasec/backend-pro
    tag: ""

secrets:
  licenseKey: "ssc_xxxxx"

Then install with:

helm install servasec servasec/servasec \
  --namespace servasec --create-namespace \
  --values values-pro.yaml \
  --set domain.name="servasec.example.com" \
  --set secrets.postgresPassword="<secure-password>" \
  --set secrets.jwtSecret="<64-char-random>"

Upgrading

helm repo update
helm upgrade servasec servasec/servasec --namespace servasec

Uninstalling

helm uninstall servasec --namespace servasec

Environment variables

Variable	Default	Description
SSC_PUBLIC_DOMAIN	servasec.local	Deployment domain
POSTGRES_PASSWORD	(required)	PostgreSQL password
JWT_SECRET	(auto-generated)	JWT signing secret
CSRF_SECRET	(auto-generated)	CSRF protection secret
SSC_LICENSE_KEY	-	Pro license key (optional)

See the full configuration reference for all environment variables.