Installation

Clone and enter

Compose files live at the public product repo root.

git clone https://github.com/epure-sh/epure.git
cd epure

Ports live in one file. Copy only if 8080 is taken:

cp .env.example .env

Change EPURE_PORT and EPURE_PUBLIC_URL together. Recreate epure after any .env change.

Start

docker compose up

Compose pulls ghcr.io/epure-sh/epure:latest. Pin a tag with EPURE_IMAGE in .env.

Laptop compose allows the documented example DB passwords only while EPURE_PUBLIC_URL is localhost. Point that URL at a real hostname and boot refuses to start until you switch to the production overlay.

Health

curl -sS http://localhost:8080/health

{"status":"ok"}

Dashboard: http://localhost:8080.

Create access

Register at /login, or for local smoke only (never production):

./scripts/seed-dev.sh

Login: dev@epure.local / devpassword

Then Quickstart: copy the DSN and capture an exception.

Copy the production env file

cp .env.production.example .env

Replace every CHANGE_ME. Generate passwords with openssl rand -hex 24. Set:

Leave EPURE_DEV_SEED unset. Overlay forces EPURE_SESSION_SECURE=1 and refuses example passwords (epure, epure_ingest, epure_app, CHANGE_ME).

DNS and TLS

Point the hostname at the box. Put Caddy (or nginx) in front of 127.0.0.1:8080 (or your EPURE_PORT). Forward Host, X-Forwarded-For, X-Forwarded-Proto. Allow POST and OPTIONS on /api/{project_id}/envelope/ and /api/{project_id}/store/.

Caddy (ports 80 and 443 open):

errors.example.com {
  reverse_proxy 127.0.0.1:8080
}

nginx:

server {
  listen 443 ssl;
  server_name errors.example.com;
  # ssl_certificate …;
  location / {
    proxy_pass http://127.0.0.1:8080;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }
}

Start the proxy before you expect browser login to work. Session cookies are Secure-only.

Start the overlay

docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d

Postgres is not published on the host. Migrations run on boot, then the process sets ingest/app role passwords from .env. They are not the strings in old SQL files.

Health on HTTPS

curl -sS https://errors.example.com/health

{"status":"ok"}

On the box, curl -sS http://127.0.0.1:8080/health also works. The dashboard URL is EPURE_PUBLIC_URL.

Register

Open https://errors.example.com/login. The first email/password register becomes owner of a new workspace. Do not run ./scripts/seed-dev.sh here.

Then Quickstart with your public DSN host.