DocsBook a demo

Platform

Platform overviewArchitectureWorkflow orchestrationGitOps configurationGovernance and AAAAI and MCPKnowledge and contextRuntime and executionEvidence and monitoring

Use cases

All use casesProduction incidentRelease preparationHotfix to productionSecurity scan triage
Why NopsAIIntegrationsSecurity

Resources

All resourcesAI agent governanceMCP governanceMCP securitySelf-hosted platforms
PricingGitHub

Company

How a run worksAboutContactBook a demo

Requirements

What must be true on the host before the stack will start, and the values you have to generate first.

How-toNew userAdministrator

Key points

  • Everything is a container. The control plane, UI, PostgreSQL, and the runner all run on one Compose bridge network named nopsai-net — see Architecture and networking.
  • Seven values must exist before the first start: POSTGRES_PASSWORD, DATABASE_URL, NOPSAI_MASTER_KEY, JWT_SIGNING_KEY, SERVICE_JWT_SIGNING_KEY, AAA_SHARED_INTERNAL_TOKEN, and NOPSAI_BOOTSTRAP_ADMIN_PASSWORD. Compose exits with set <NAME> when one is missing.
  • JWT_SIGNING_KEY and SERVICE_JWT_SIGNING_KEY must be different values, so a user token can never be replayed as a service token.
  • Published ports bind to 127.0.0.1 through NOPSAI_BIND_ADDRESS: 80 for the UI, 8080 for the API, 8081 for git-bot, 9091 for the dispatcher, and 5432 for PostgreSQL.
  • The bootstrap administrator is NOPSAI_BOOTSTRAP_ADMIN_EMAIL, default [email protected], and must rotate its password at first login unless NOPSAI_BOOTSTRAP_ADMIN_MUST_CHANGE_PASSWORD is set to false.
  • Image tags come from NOPSAI_VERSION (default dev) and NOPSAI_IMAGE_REGISTRY (default ghcr.io/nopsai). Either build them from a checkout or make that registry reachable.

Before you start

Container runtime
Docker Engine with the Compose v2 plugindocker compose version
Daemon access
The current user can talk to the Docker daemon without sudodocker ps
Free ports
80, 8080, 8081, 9091, and 5432 unused on the loopback interfacelsof -nP -iTCP:80,8080,8081,9091,5432 -sTCP:LISTEN
Value generation
A source of high-entropy values for the seven bootstrap secretsopenssl rand -hex 32
Images
A repository checkout to build from, or network access to the configured image registry

Steps

  1. 01

    Confirm the runtime

    Compose v2 is required; the v1 docker-compose binary is not supported by this file.

    Check Docker and Composebash
    docker compose version
docker ps
    Expected result
    • Compose reports a v2 version and docker ps answers without a permission error.
  2. 02

    Confirm the ports are free

    The stack publishes five ports. A port already in use is the most common reason a first start half-succeeds.

    List conflicting listenersbash
    lsof -nP -iTCP:80,8080,8081,9091,5432 -sTCP:LISTEN
    Verify
    • Nothing is listed. Anything reported must be stopped or the published port changed before starting.
  3. 03

    Decide how the stack is reached

    By default every published port binds to 127.0.0.1, so the install is reachable only from the workstation running it. Set NOPSAI_BIND_ADDRESS only when you consciously want the stack on the network.

    Important
    • Binding to a non-loopback address publishes the API, git-bot, dispatcher, and PostgreSQL ports. Work through the production hardening checklist before doing that.
  4. 04

    Generate the seven values

    Generate them fresh rather than copying from another environment. The database URL has to carry the same password you generated for PostgreSQL.

    Generate bootstrap valuesbash
    POSTGRES_PASSWORD=$(openssl rand -hex 16)
cat <<EOF
POSTGRES_PASSWORD=$POSTGRES_PASSWORD
DATABASE_URL=postgres://nopsai:$POSTGRES_PASSWORD@db:5432/nopsai?sslmode=disable
NOPSAI_MASTER_KEY=$(openssl rand -hex 32)
JWT_SIGNING_KEY=$(openssl rand -hex 32)
SERVICE_JWT_SIGNING_KEY=$(openssl rand -hex 32)
AAA_SHARED_INTERNAL_TOKEN=$(openssl rand -hex 32)
NOPSAI_BOOTSTRAP_ADMIN_PASSWORD=$(openssl rand -hex 12)
EOF
    Result

    Seven lines, each with a distinct value, ready to be written to .env in the next page.

    Verify
    • Confirm JWT_SIGNING_KEY and SERVICE_JWT_SIGNING_KEY are not the same string.

How it works

The Compose stack is built for evaluation and development. A shared or production install uses a release bundle or the Helm chart, and the same seven values still have to exist — they just come from a secret store instead of a local .env.

Nothing here is wasted on a later move: the values, the pipelines, and the configuration you create locally can be exported into a configuration repository and applied to another install.

The Docker runner you install later mounts /var/run/docker.sock, which lets it create containers on its host. Choose a host you are willing to treat as an execution boundary.

Limits

Current behavior
  • The repository does not publish minimum CPU, memory, or disk figures for the Compose stack. Size the host for the workloads your pipelines will run, not for the control plane alone.

Implementation evidence

  • docker-compose.yaml

    Required variables, published ports, bind address, and network name.

  • version.txt

    The single release series every image tag, chart version and compatibility range follows.