Quick start

This page gets a working InfraWard on http://localhost:8080 with the default settings: PostgreSQL, Redis and OpenBao all run in containers next to InfraWard. Use it to evaluate the product. For a server that other people will reach, follow Install with Docker Compose instead.

Before you start

You need Docker Engine with the Compose plugin (docker compose version should print v2 or later), git, openssl, about 5 GB of free disk and an authenticator app on your phone (Google Authenticator, Aegis, 1Password or similar). Administrators must set up two-factor authentication on their first sign-in.

1. Get the deployment files.

   git clone --depth 1 https://github.com/InfraWard/infraward.git
   cd infraward/deploy/example
   cp .env.example .env

2. Edit .env and set the two values that have no default.

   .env

   ADMIN_PASSWORD=choose-a-password-of-12-or-more-characters
   POSTGRES_PASSWORD=another-long-random-password

   ADMIN_EMAIL defaults to [email protected]. Change it if you prefer to sign in with your own address.

3. Prepare data directories, keys and OpenBao.

   ./init.sh

   The script takes about half a minute. It ends with OpenBao listo (...) and Siguiente paso: docker compose up -d.

4. Start the stack.

   docker compose up -d

   The first start pulls the images and runs the database migrations. When docker compose ps shows api as healthy, open http://localhost:8080.

5. Sign in with ADMIN_EMAIL and ADMIN_PASSWORD, scan the QR code with your authenticator app, enter the 6-digit code and store the ten recovery codes somewhere safe. The initial setup page shows each screen.

6. Add a server. For this local test, enrol the Linux machine that runs Docker: the enrolment command downloads its script from localhost (see the note below). Go to Inventario → Añadir servidor (Inventory → Add server), enter that machine’s LAN IP address (not 127.0.0.1: the address must reach its SSH server from inside a container) and select Generar comando de alta (Generate enrolment command). Run the command it shows on the same machine:

   curl -fsSL --max-time 120 http://localhost:8080/api/enroll/<token> | sudo bash

   The page moves through Conectando (Connecting) and Escaneando (Scanning) on its own. A few minutes later the server, its packages and its vulnerabilities appear in the inventory.

localhost only

The enrolment command downloads the script from INFRAWARD_PUBLIC_URL, which defaults to http://localhost:8080. That only works when you run the command on the same machine as InfraWard. To enrol other machines, set INFRAWARD_PUBLIC_URL to an address they can reach and put InfraWard behind HTTPS, as described in HTTPS and reverse proxy. Without HTTPS, browsers outside localhost reject the session cookie.

Clean up

To stop the stack and keep its data, run docker compose down. To remove everything, including the inventory, keys and OpenBao data, run:

docker compose down
sudo rm -rf data secrets

Next steps

• Requirements for a production server.
• Adding servers explains the access modes and what the enrolment script changes on each host.
• Concepts and architecture describes the services you just started.