plugwerk/plugwerk-server repository overview

services:
  postgres:
    image: postgres:18-alpine
    environment:
      POSTGRES_DB: plugwerk
      POSTGRES_USER: plugwerk
      POSTGRES_PASSWORD: REPLACE_ME_STRONG_PASSWORD
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U plugwerk"]
      interval: 5s
      retries: 5

  plugwerk-server:
    image: plugwerk/plugwerk-server:latest
    ports:
      - "8080:8080"
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      PLUGWERK_DB_URL: jdbc:postgresql://postgres:5432/plugwerk
      PLUGWERK_DB_USERNAME: plugwerk
      PLUGWERK_DB_PASSWORD: REPLACE_ME_STRONG_PASSWORD
      # Short placeholder — fails @Size(min=32) and aborts startup until replaced.
      PLUGWERK_AUTH_JWT_SECRET: "REPLACE_ME_SEE_README"
      # Short placeholder — fails @Size(min=16) and aborts startup until replaced.
      PLUGWERK_AUTH_ENCRYPTION_KEY: "REPLACE_ME"
    volumes:
      - plugwerk-artifacts:/var/plugwerk/artifacts

volumes:
  postgres-data:
  plugwerk-artifacts:

# 1) Edit docker-compose.yml and replace each REPLACE_ME_* literal with the
#    value you want to pin (the database password is a plain string; the two
#    server secrets are easier to export and substitute, see below).
# 2) Export real secrets into your shell:
export PLUGWERK_AUTH_JWT_SECRET="$(openssl rand -base64 32)"
export PLUGWERK_AUTH_ENCRYPTION_KEY="$(openssl rand -base64 32)"
# 3) Substitute them in-place (or paste the values into the compose file).
# 4) Launch:
docker compose up -d

# Container stderr (forwarded by `docker compose logs`):
docker compose logs --no-log-prefix plugwerk-server | grep -A 6 "Initial Superadmin Password"

# Or the 0600 file inside the container:
docker compose exec plugwerk-server cat /tmp/plugwerk-admin-password.txt

curl http://localhost:8080/actuator/health
# → {"status":"UP"}

docker run -d \
  -e PLUGWERK_AUTH_ACTUATOR_SCRAPE_USERNAME=prometheus \
  -e PLUGWERK_AUTH_ACTUATOR_SCRAPE_PASSWORD="$(openssl rand -base64 32)" \
  # ... other PLUGWERK_* env vars ...
  plugwerk/plugwerk-server:latest

scrape_configs:
  - job_name: plugwerk
    metrics_path: /actuator/prometheus
    scheme: https
    basic_auth:
      username: prometheus
      password_file: /etc/prometheus/plugwerk-scrape-password
    static_configs:
      - targets: ['plugwerk.example.com']