Skip to content
Calvery Vault

Self-host dengan Docker Compose

Paling cepat + paling direkomendasikan untuk small-to-medium team. Stack:

  • Postgres 16 (Docker)
  • CVSM API (Docker, Go binary)
  • Nginx (reverse proxy + TLS)

Prerequisites

  • VPS Linux (Ubuntu 22.04+ / Debian 12+ rekomendasi), 1 vCPU + 1 GB RAM cukup untuk < 50 user
  • Domain kamu sendiri (misal vault.company.com)
  • Docker + Docker Compose terinstall
  • Port 80, 443 terbuka

Step 1. Clone distribution repo

Terminal window
cd /opt
git clone https://github.com/RenzyArmstrong/Calvery-Vault.git cvsm
cd cvsm

Step 2. Generate secrets

Terminal window
cat > .env <<EOF
POSTGRES_USER=cvsm
POSTGRES_PASSWORD=$(openssl rand -hex 16)
POSTGRES_DB=cvsm
DATABASE_URL=postgres://cvsm:REPLACE_ME@postgres:5432/cvsm


JWT_SECRET=$(openssl rand -hex 32)
ENCRYPTION_KEY=$(openssl rand -hex 32)


APP_URL=https://vault.company.com
ALLOWED_ORIGINS=https://vault.company.com


# Optional SMTP untuk email verification + password reset
SMTP_HOST=smtp.resend.com
SMTP_PORT=587
SMTP_USER=resend
SMTP_PASSWORD=re_xxxxxxxxxxxx
SMTP_FROM=CVSM <[email protected]>
EOF


# Replace REPLACE_ME di DATABASE_URL dengan POSTGRES_PASSWORD
POSTGRES_PASS=$(grep POSTGRES_PASSWORD .env | cut -d= -f2)
sed -i "s|REPLACE_ME|$POSTGRES_PASS|" .env


chmod 600 .env  # protect dari user lain

Step 3. Start stack

Terminal window
docker compose up -d

Cek status:

Terminal window
docker compose ps
docker compose logs api --tail 50

Expected: cvsm-api listening di 127.0.0.1:8080.

Step 4. Run migrations

Terminal window
# Apply semua migration berurutan (semua idempotent dengan IF NOT EXISTS)
for f in migrations/*.sql; do
  echo "Applying $f"
  docker compose exec -T postgres psql -U cvsm -d cvsm < $f
done

Step 5. Nginx + TLS

Install:

Terminal window
apt install -y nginx certbot python3-certbot-nginx

Config:

/etc/nginx/sites-available/cvsm
server {
    listen 80;
    server_name vault.company.com;
    location /.well-known/acme-challenge/ { root /var/www/certbot; }
    location / { return 301 https://$host$request_uri; }
}


server {
    listen 443 ssl http2;
    server_name vault.company.com;


    ssl_certificate /etc/letsencrypt/live/vault.company.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/vault.company.com/privkey.pem;


    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Enable + TLS:

Terminal window
ln -s /etc/nginx/sites-available/cvsm /etc/nginx/sites-enabled/cvsm
nginx -t && systemctl reload nginx
certbot --nginx -d vault.company.com

Step 6. Buat admin user pertama

Buka https://vault.company.com → register. User pertama otomatis jadi system admin.

Step 7. Pointing SDK ke self-host

const calvery = new Calvery({
  token: process.env.CVSM_TOKEN!,
  team: 'internal',
  baseUrl: 'https://vault.company.com',
})

Update

Pull image baru + restart:

Terminal window
cd /opt/cvsm
git pull
docker compose pull
docker compose up -d

Run migration baru kalau ada (cek CHANGELOG.md):

Terminal window
docker compose exec -T postgres psql -U cvsm -d cvsm < migrations/011_new.sql

Backup

Database

Daily cron: /etc/cron.daily/cvsm-backup
#!/bin/bash
set -e
BACKUP_DIR=/var/backups/cvsm
mkdir -p $BACKUP_DIR
docker compose -f /opt/cvsm/docker-compose.yml exec -T postgres \
    pg_dump -U cvsm cvsm | gzip > $BACKUP_DIR/cvsm-$(date +%F).sql.gz


# Retention: keep 30 hari
find $BACKUP_DIR -name "cvsm-*.sql.gz" -mtime +30 -delete

Jangan lupa chmod +x dan test manual dulu.

Encryption key

Critical: backup ENCRYPTION_KEY dari .env ke:

  • Password manager (1Password / Bitwarden) — untuk akses cepat
  • Paper copy di safe — disaster recovery (kalau password manager compromised)
  • Second sysadmin (kalau team lebih dari 1)

Tanpa ENCRYPTION_KEY, database backup tidak berguna.

Monitoring (minimal)

Terminal window
# Health check
curl -f https://vault.company.com/health || echo "DOWN"


# Disk usage
df -h /var/lib/docker/volumes/


# Log errors
docker compose logs api --since 1h | grep -i error

Recommend: pasang Uptime Kuma untuk visual dashboard.

Scaling

Single-VPS Docker Compose cukup untuk:

  • ~100 active users
  • ~10k secrets
  • ~1k req/min

Beyond itu, pindah ke Kubernetes — lihat Self-host K8s.