Installation

Clone and enter

Compose files live at the public product repo root.

git clone https://github.com/epure-sh/epure.git
cd epure

No .env required. docker compose up is enough for localhost:8080.

If 8080 is taken: cp .env.example .env, set EPURE_PORT, recreate epure (public URL follows on localhost). Or ./configure --quick. Recreate epure after any .env change.

Start

docker compose up

Pin production with EPURE_IMAGE=ghcr.io/epure-sh/epure:v0.1.7.

Laptop compose allows the documented example DB passwords only while EPURE_PUBLIC_URL is localhost. Point that URL at a real hostname and boot refuses to start until you switch to the production overlay.

Health

curl -sS http://localhost:8080/health

{"status":"ok"}

Dashboard: http://localhost:8080.

Create access

Register at /login. New workspaces get Acme Web + Acme API with sample errors (preview banner). Setup runs only when you create an additional project.

For high-volume local UX fixtures with fixed DSN UUIDs (never production):

./scripts/seed.sh --email you@example.com --password 'choose-a-password'
# or: ./scripts/seed.sh --link-user you@example.com

Passwords are never written into seed SQL.

Then Quickstart: copy the DSN and capture an exception.

Production env file

./configure --prod

Or cp deploy/env.production.example .env and replace every CHANGE_ME (openssl rand -hex 24). Set:

Leave EPURE_DEV_SEED unset. Overlay forces EPURE_SESSION_SECURE=1 and refuses example passwords (epure, epure_ingest, epure_app, CHANGE_ME).

DNS and TLS

Point a DNS name at the box. A raw IP will not get a browser-trusted certificate, and sign-in on http://IP:8080 will not stick.

The production overlay can start Caddy for you. ./configure --prod writes EPURE_SITE_ADDRESS. The next step's command uses --profile tls, which publishes ports 80 and 443 and reverse-proxies to Epure. Open the HTTPS URL. If you open port 8080 over HTTP, the login page explains why the session cookie was dropped.

If you already run nginx, Caddy, or Traefik, skip --profile tls. Forward Host, X-Forwarded-For, and X-Forwarded-Proto to 127.0.0.1:8080 (or your EPURE_PORT). Allow POST and OPTIONS on /api/{project_id}/envelope/ and /api/{project_id}/store/.

Caddy on the host (ports 80 and 443 open), if you are not using --profile tls:

errors.example.com {
  reverse_proxy 127.0.0.1:8080
}

nginx:

server {
  listen 443 ssl;
  server_name errors.example.com;
  # ssl_certificate …;
  location / {
    proxy_pass http://127.0.0.1:8080;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }
}

Session cookies are Secure-only. Start TLS before you expect browser login to work.

Start the overlay

docker compose -f docker-compose.yml -f deploy/docker-compose.prod.yml --profile tls up -d

--profile tls is required unless you already terminate HTTPS yourself. Without it, nothing listens on 443, and the login form on port 8080 cannot keep you signed in.

Postgres is not published on the host. Migrations run on boot, then the process sets ingest/app role passwords from .env. They are not the strings in old SQL files.

Health on HTTPS

curl -sS https://errors.example.com/health

{"status":"ok"}

On the box, curl -sS http://127.0.0.1:8080/health also works. The dashboard URL is EPURE_PUBLIC_URL.

Register

Open https://errors.example.com/login. If that host does not load, fix DNS and Caddy before you try a password. The first email/password register becomes owner of a new workspace. Do not run ./scripts/seed.sh here.

After that account exists, set EPURE_REGISTRATION=false and recreate epure. Sign-in stays available. The public URL cannot open another workspace. Invitation links still work. Configuration.

After that account exists, set EPURE_REGISTRATION=false and recreate epure. Sign-in stays available. The public URL cannot open another workspace. Invitation links still work. Configuration.

Then Quickstart with your public DSN host.