ever-co/ever-gauzy

Super Quick Start

https://app.gauzy.co.

Note: it's currently in Alpha version/testing mode, please use it cautiously!

Run with Docker Compose

• Clone repo.
• Make sure you have the latest Docker Compose installed locally. Important: you need a minimum v2.20.

Demo

• Run docker-compose -f docker-compose.demo.yml up, if you want to run the platform in basic configuration (e.g. for Demo / explore functionality / quick run) using our prebuilt Docker images. Check .env.demo.compose file for different settings (optionally), e.g. DB type. (Note: Docker Compose will use latest images pre-build automatically from head of master branch using GitHub CI/CD.)
• Open http://localhost:4200 in your browser.
• Login with email admin@ever.co and password: admin for Super Admin user.
• Login with email employee@ever.co and password: 12345678 for Employee user.
• Enjoy!

Note: those credentials exist only because this stack runs with DEMO=true. They are NOT available in a production deployment — see below.

Production

• Edit .env.compose: you must set JWT_SECRET, JWT_REFRESH_TOKEN_SECRET, JWT_VERIFICATION_TOKEN_SECRET and EXPRESS_SESSION_SECRET to strong, unique values (e.g. openssl rand -hex 64). The API refuses to start on the shipped blank/default secrets — shared defaults let anyone forge authentication tokens and sessions. Adjust any other settings (e.g. DB type) there too.
• You must also set DEMO_SUPER_ADMIN_PASSWORD, DEMO_ADMIN_PASSWORD and DEMO_EMPLOYEE_PASSWORD (and optionally the matching *_EMAIL variables). The first boot against an empty database seeds a Super Admin, an Admin and an Employee from those variables, and their shipped defaults are documented right here in this README — so the API refuses to seed while they are unset or left at the defaults.
• Set TRUST_PROXY to the number of proxy hops in front of the API (1 behind a single nginx/ingress) or to your trusted proxy CIDRs, so the login rate limiter counts against the real client address. Set THROTTLE_TRUST_CF_CONNECTING_IP=true only if every request reaches the API through Cloudflare. If Ever Teams runs against this API, set EVER_TEAMS_CLIENT_IP_SECRET to the same strong value (at least 32 characters) on both, so the per-address limits on sign-in, invites and password reset count each browser instead of the Ever Teams server; signed-in requests are limited per user.
• Set REDIS_ENABLED=true (with REDIS_URL, or REDIS_HOST/REDIS_PORT) when you run more than one API replica: rate-limit buckets are otherwise per-process, so the effective limit is multiplied by the replica count.
• Failed sign-ins are also counted per account: once AUTH_MAX_FAILED_ATTEMPTS (default 10) consecutive failures for one account have come from at least two different client addresses, that account answers HTTP 429 (with Retry-After) for AUTH_LOCKOUT_SECONDS (default 900). Failures from a single address never block an account. Because anyone who knows an email address can submit wrong passwords for it, an attacker with several addresses can still block that account for a while; set AUTH_MAX_FAILED_ATTEMPTS=0 to switch the per-account control off and rely on the per-address rate limit alone.
• Run docker-compose up -d, if you want to run the platform in minimal production configuration using our prebuilt Docker images. (Note: Docker Compose will use latest images pre-build automatically from head of master branch using GitHub CI/CD.)

Note: we recommend using Kubernetes for production workloads instead of Docker Compose!

Self-hosting with Caddy (automatic HTTPS)

docker-compose.caddy.yml runs Gauzy (prebuilt API and web app images, PostgreSQL) behind Caddy, which obtains and renews HTTPS certificates by itself:

• cp .env.caddy.sample .env.caddy and fill in every empty value in .env.caddy: the database password and the four secrets above (e.g. from openssl rand -hex 64), and the three DEMO_*_PASSWORD values (e.g. from openssl rand -hex 24: the sign-in form takes at most 50 characters). Docker Compose refuses to start while one is missing. .env.caddy is git-ignored.
• Set GAUZY_DOMAIN to your domain (its DNS must point at the server, with ports 80 and 443 open) to get a Let's Encrypt / ZeroSSL certificate, or keep localhost to try it locally with Caddy's own certificate authority (your browser warns until you trust it).
• Run docker compose -f docker-compose.caddy.yml --env-file .env.caddy up -d and open https://<GAUZY_DOMAIN>.

Caddy is the only container published on the host. It serves everything from one origin: /api, /graphql (including subscriptions), /public (uploaded files) and /swg (Swagger UI, with the OpenAPI document at /swg-json and /swg-yaml) go to t

…