Advanced installation

servasec can be deployed with Docker Compose or Helm.

Docker Compose

Available since v0.0.2

Prerequisites

• Docker and Docker Compose (v2+)
• 2 CPU cores, 4 GB RAM (minimum)

The quickest path is the install script, which downloads the deploy files and pulls the container images from registry.gitlab.com.

Community edition (published images)

git clone https://github.com/servasec/servasec.git
cd servasec
cp .env.example .env
# update .env as needed
make community

Uses docker-compose.prod.yml and pulls the backend, frontend and caddy images from registry.gitlab.com.

Community edition (build from source)

make community-build

Uses docker-compose.build.yml as an override to build the images locally with multi-stage Docker builds instead of pulling them.

Pro edition

git clone https://github.com/servasec/servasec.git
cd servasec
cp .env.example .env
# set SSC_LICENSE_KEY in .env
make pro

The pro backend is a private image: authenticate to the registry first with docker login registry.gitlab.com.

Compose files

File	Purpose
docker-compose.dev.yml	Local development with hot-reload
docker-compose.prod.yml	Production deployment (pulls images from registry.gitlab.com)
docker-compose.build.yml	Build override (local builds from source)

Volumes

Volume	Mount	Purpose
caddy_data	/data	TLS certificates
postgres_data	/var/lib/postgresql/data	Database persistence

Helm

Added in v2.1.0

For Kubernetes deployments, servasec provides a Helm chart.

Prerequisites

• Kubernetes cluster 1.25+
• Helm 3.10+
• Ingress controller (Traefik or your own)

Add the repository

helm repo add servasec https://servasec.github.io/helm-charts
helm repo update

Install

helm install servasec servasec/servasec \
  --namespace servasec --create-namespace \
  --set domain.name="servasec.example.com" \
  --set secrets.postgresPassword="<secure-password>" \
  --set secrets.jwtSecret="<64-char-random>"

Configuration reference

The chart supports the following options:

Parameter	Default	Description
domain.name	servasec.local	Deployment domain
domain.publicUrl	https://servasec.local	Public-facing URL
image.backend.repository	registry.gitlab.com/servasec/servasec/backend	Backend image
image.frontend.repository	registry.gitlab.com/servasec/servasec/frontend	Frontend image
ingress.type	traefik	Ingress type (traefik or k8s Ingress)
postgresql.internal	true	Use bundled PostgreSQL
postgresql.externalUrl	""	External DB connection string
replicaCount	1	Backend replicas
autoscaling.enabled	false	Enable HPA
networkPolicy.enabled	false	Enable network policies

See the full values reference for all options.

Pro edition

Create a values-pro.yaml override file:

image:
    backend:
    repository: registry.gitlab.com/servasec/servasec-pro/backend
    tag: ""

secrets:
  licenseKey: "ssc_xxxxx"

Then install with:

helm install servasec servasec/servasec \
  --namespace servasec --create-namespace \
  --values values-pro.yaml \
  --set domain.name="servasec.example.com" \
  --set secrets.postgresPassword="<secure-password>" \
  --set secrets.jwtSecret="<64-char-random>"

Upgrading

helm repo update
helm upgrade servasec servasec/servasec --namespace servasec

Uninstalling

helm uninstall servasec --namespace servasec

Environment variables

Variable	Default	Description
SSC_PUBLIC_DOMAIN	servasec.local	Deployment domain
POSTGRES_PASSWORD	(required)	PostgreSQL password
JWT_SECRET	(auto-generated)	JWT signing secret
CSRF_SECRET	(auto-generated)	CSRF protection secret
SSC_LICENSE_KEY	-	Pro license key (optional)

See the full configuration reference for all environment variables.