Self-host with docker compose

A production self-host. One compose file, six services, one TLS terminator in front.

The goal

A self-hosted Platos at your own domain (e.g. platos.example.com), backed by Postgres + Redis + ClickHouse + MinIO, with TLS termination via Caddy and the agent + webapp behind it.

Steps

Provision the host.

Minimum: 4 vCPU, 8 GB RAM, 50 GB disk. Linux with Docker and Docker Compose v2 installed.

Clone and configure.

git clone https://github.com/platos-labs/platos.git /opt/platos
cd /opt/platos
cp .env.example .env

Set required vars:

ENCRYPTION_KEY=$(openssl rand -hex 16)
PLATOS_MESSAGE_ENCRYPTION_KEY=$(openssl rand -hex 16)
POSTGRES_PASSWORD=...        # any strong password
MINIO_ROOT_USER=platos
MINIO_ROOT_PASSWORD=...      # any strong password
PUBLIC_HOST=platos.example.com

Bring up the stack.
```
docker compose -f docker-compose.platos.yml up -d --build
```
The webapp runs Postgres migrations at boot. ClickHouse migrations land via a one-shot goose container; if you customised the schema, run them manually.
Add Caddy in front.
```
platos.example.com {
  reverse_proxy webapp:3030
}

agent.platos.example.com {
  reverse_proxy agent:3100
}
```
Bind only the agent and webapp ports externally; keep Postgres/Redis/ClickHouse/MinIO private.
Set up backups.

Configure a nightly cron for pg_dump, clickhouse-backup, and mc mirror to your S3-compatible storage. See Backup and restore.

Verify

docker compose ps shows every service healthy.
https://platos.example.com loads the login page over TLS.
https://platos.example.com/healthz returns 200.
The agent service health: curl https://agent.platos.example.com/health returns { "ok": true }.

Next steps

Add a provider key to make the model picker actionable.
Quickstart for the post-install agent flow.
Fix an ENCRYPTION_KEY length error if boot fails on the env validator.
Backup and restore for the durability story.