# Docker on a Linux VPS

> Run the Compose stack on any Linux host with Docker.

URL: https://boelabs.com/en/docs/ai-gateway/deploy-docker-linux
Language: English

Any Linux host with Docker and the Compose plugin can run the full stack directly.

## Bring up the stack

```bash
git clone https://github.com/boelabs/ai-gateway.git && cd ai-gateway

MASTER_KEY=$(openssl rand -base64 48) \
ENCRYPTION_KEY_HEX=$(openssl rand -hex 32) \
docker compose -f docker/compose.yaml -f docker/compose.local.yaml up -d
```

This starts Postgres, Redis, the one-off migration job, the gateway (`127.0.0.1:4000`) and the
dashboard (`127.0.0.1:3001`). The gateway talks to Postgres/Redis over the internal Compose network in
plaintext, so there is no TLS and no [Bun TLS issue](https://boelabs.com/docs/ai-gateway/troubleshooting).

## Production notes

- **Reverse proxy.** Put the gateway behind Caddy, nginx, or Traefik for TLS termination at the
  **public** edge. The local override binds services to loopback, so they are reachable by a proxy on
  the host without listening on every interface. If you enable the dashboard, give it a hostname of
  its own and set the two variables that point each side at the other, as described in
  [Operator dashboard → Serving it](https://boelabs.com/docs/ai-gateway/dashboard#serving-it).
- **Secrets.** Set `MASTER_KEY`, `ENCRYPTION_KEYRING`, and `ACTIVE_ENCRYPTION_KEY_ID`; the production
  Compose base leaves them empty and the gateway refuses to start without them. See [Setup → Secrets](https://boelabs.com/docs/ai-gateway/setup#secrets).
- **Migrations.** The `migrate` service runs them automatically on `docker compose up`. For a manual
  run: `docker compose run --rm migrate`.
- **Backups.** Persist the `pgdata` and `redisdata` named volumes.

To point at an external managed database instead of the bundled one, set `DATABASE_URL`/`REDIS_URL`
and prefer a [public-CA managed provider](https://boelabs.com/docs/ai-gateway/setup#managed-database-and-redis).