# Quick start

> Run InfraWard locally with Docker Compose and enrol your first server in about ten minutes.

This page gets a working InfraWard on `http://localhost:8080` with the default settings: PostgreSQL, Redis and OpenBao all run in containers next to InfraWard. Use it to evaluate the product. For a server that other people will reach, follow [Install with Docker Compose](/docs/installation.md) instead.

> **Before you start**
>
> You need Docker Engine with the Compose plugin (`docker compose version` should print v2 or later), `git`, `openssl`, about 5 GB of free disk and an authenticator app on your phone (Google Authenticator, Aegis, 1Password or similar). Administrators must set up two-factor authentication on their first sign-in.

1. Get the deployment files.

   ```bash
   git clone --depth 1 https://github.com/InfraWard/infraward.git
   cd infraward/deploy/example
   cp .env.example .env
   ```

2. Edit `.env` and set the two values that have no default.

   ```ini title=".env"
   ADMIN_PASSWORD=choose-a-password-of-12-or-more-characters
   POSTGRES_PASSWORD=another-long-random-password
   ```

   `ADMIN_EMAIL` defaults to `admin@example.com`. Change it if you prefer to sign in with your own address.

3. Prepare data directories, keys and OpenBao.

   ```bash
   ./init.sh
   ```

   The script takes about half a minute. It ends with `OpenBao listo (...)` and `Siguiente paso: docker compose up -d`.

4. Start the stack.

   ```bash
   docker compose up -d
   ```

   The first start pulls the images and runs the database migrations. When `docker compose ps` shows `api` as `healthy`, open [http://localhost:8080](http://localhost:8080).

5. Sign in with `ADMIN_EMAIL` and `ADMIN_PASSWORD`, scan the QR code with your authenticator app, enter the 6-digit code and store the ten recovery codes somewhere safe. The [initial setup](/docs/initial-setup.md) page shows each screen.

6. Add a server. For this local test, enrol the Linux machine that runs Docker: the enrolment command downloads its script from `localhost` (see the note below). Go to **Inventario → Añadir servidor** (Inventory → Add server), enter that machine's LAN IP address (not `127.0.0.1`: the address must reach its SSH server from inside a container) and select **Generar comando de alta** (Generate enrolment command). Run the command it shows on the same machine:

   ```bash
   curl -fsSL --max-time 120 http://localhost:8080/api/enroll/<token> | sudo bash
   ```

   The page moves through **Conectando** (Connecting) and **Escaneando** (Scanning) on its own. A few minutes later the server, its packages and its vulnerabilities appear in the inventory.

> **localhost only**
>
> The enrolment command downloads the script from `INFRAWARD_PUBLIC_URL`, which defaults to `http://localhost:8080`. That only works when you run the command on the same machine as InfraWard. To enrol other machines, set `INFRAWARD_PUBLIC_URL` to an address they can reach and put InfraWard behind HTTPS, as described in [HTTPS and reverse proxy](/docs/reverse-proxy.md). Without HTTPS, browsers outside `localhost` reject the session cookie.

## Clean up

To stop the stack and keep its data, run `docker compose down`. To remove everything, including the inventory, keys and OpenBao data, run:

```bash
docker compose down
sudo rm -rf data secrets
```

## Next steps

- [Requirements](/docs/requirements.md) for a production server.
- [Adding servers](/docs/enrollment.md) explains the access modes and what the enrolment script changes on each host.
- [Concepts and architecture](/docs/architecture.md) describes the services you just started.

---

HTML page: https://infraward.net/docs/quickstart/