# Dokploy

> Deploy AI Gateway on Dokploy with Docker Compose.

URL: https://boelabs.com/en/docs/ai-gateway/deploy-dokploy
Language: English

[Dokploy](https://dokploy.com) deploys the repository's `docker/compose.yaml` as a **Compose**
application.

1. **Create → Compose**, and point it at this repository (or paste the `docker/compose.yaml`).
2. Set the secrets in the application's environment settings:
	- `MASTER_KEY` — `openssl rand -base64 48`
	- `ENCRYPTION_KEYRING` — e.g. `{"primary":"<openssl rand -hex 32>"}`
	- `ACTIVE_ENCRYPTION_KEY_ID` — `primary`
3. Deploy. The bundled Postgres/Redis and the `migrate` job run inside the application's network.
4. In **Domains**, add only long-running HTTP services:
   - **gateway**, container port `4000`
   - **dashboard** (optional), container port `3001` — its **own** host, e.g. `dash.example.com`

The dashboard is an independent deployment on its own hostname — a plain app at the root of its
domain, with no path prefix for Dokploy to preserve. It needs one setting, `GATEWAY_URL`, which
inside the application's network is the gateway's service name.

See [Operator dashboard → Serving it](https://boelabs.com/docs/ai-gateway/dashboard#serving-it) for both settings and the two
curl commands that tell you which side is misconfigured.

Do not create a domain for `migrate`, Postgres, or Redis. Dokploy injects the Traefik routing labels
for the selected service and applies domain changes on redeployment. The base Compose file publishes
no raw host ports.

Postgres/Redis are reached over the private network in plaintext — no TLS, no
[Bun TLS issue](https://boelabs.com/docs/ai-gateway/troubleshooting).

As with Coolify, if you use Dokploy's **standalone** database services they present self-signed
certificates, which Bun's TLS may reject. The simplest setup is to **disable SSL on both the Postgres
and Redis services** and connect over the internal network with `postgres://…` and `redis://…` (no
`sslmode`, not `rediss://`), or use a [managed provider](https://boelabs.com/docs/ai-gateway/setup#managed-database-and-redis). Never
expose the database publicly in plaintext — see the [security note](https://boelabs.com/docs/ai-gateway/troubleshooting#security-note).