Self-Hosted Deployment

echo $AIRA_REGISTRY_TOKEN | docker login ghcr.io -u aira-proof --password-stdin

mkdir -p /opt/aira
cd /opt/aira

services:
  api:
    image: ghcr.io/aira-proof/backend:latest
    command: uvicorn app.main:app --host 0.0.0.0 --port 8000 --workers 4
    restart: unless-stopped
    env_file: .env
    environment:
      - DATABASE_URL=postgresql+asyncpg://aira:${DB_PASS}@db:5432/aira
      - REDIS_URL=redis://redis:6379/0
      - ENVIRONMENT=production
      - DEPLOYMENT_MODE=selfhosted
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "python", "-c", "import httpx; httpx.get('http://localhost:8000/health').raise_for_status()"]
      interval: 15s
      timeout: 10s
      retries: 3
      start_period: 10s
    ports:
      - "8000:8000"

  migrate:
    image: ghcr.io/aira-proof/backend:latest
    command: alembic upgrade head
    env_file: .env
    environment:
      - DATABASE_URL=postgresql+asyncpg://aira:${DB_PASS}@db:5432/aira
    depends_on:
      db:
        condition: service_healthy
    restart: "no"

  frontend:
    image: ghcr.io/aira-proof/frontend:latest
    restart: unless-stopped
    environment:
      - NEXT_PUBLIC_API_URL=${API_URL:-http://localhost:8000}
      - AUTH_SECRET=${AUTH_SECRET}
      - AUTH_TRUST_HOST=true
    ports:
      - "3000:3000"
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:3000/"]
      interval: 15s
      timeout: 5s
      retries: 3

  docs:
    image: ghcr.io/aira-proof/docs:latest
    restart: unless-stopped
    ports:
      - "3001:3000"

  db:
    image: postgres:16-alpine
    restart: unless-stopped
    volumes:
      - pgdata:/var/lib/postgresql/data
    environment:
      - POSTGRES_PASSWORD=${DB_PASS}
      - POSTGRES_DB=aira
      - POSTGRES_USER=aira
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U aira"]
      interval: 10s
      timeout: 5s
      retries: 5

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    command: redis-server --appendonly yes --maxmemory 256mb --maxmemory-policy allkeys-lru
    volumes:
      - redisdata:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

volumes:
  pgdata:
  redisdata:

# Database (choose a strong password)
DB_PASS=your-strong-database-password

# Security — generate with: openssl rand -hex 32
SECRET_KEY=your-64-char-random-secret
AUTH_SECRET=your-random-auth-secret

# Signing key — generate with:
# python3 -c "from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey; print(Ed25519PrivateKey.generate().private_bytes_raw().hex())"
SIGNING_PRIVATE_KEY_HEX=

# License key (required for self-hosted — contact customers@softure-ug.de)
AIRA_LICENSE_KEY=your-license-key

# AI Provider Keys — at least 2 required for multi-model consensus
OPENAI_API_KEY=sk-...
ANTHROPIC_API_KEY=sk-ant-...
GOOGLE_API_KEY=AIza...

# Frontend URL (your domain — used for email verification links and CORS)
FRONTEND_URL=https://app.yourdomain.com

# API URL (your API domain)
API_URL=https://api.yourdomain.com

# CORS — add your frontend domain
CORS_ALLOWED_ORIGINS=https://app.yourdomain.com

# Optional: Email (for user verification, password reset)
RESEND_API_KEY=
EMAIL_FROM=Aira <noreply@yourdomain.com>

# Optional: OAuth (for social login — omit for email/password only)
AUTH_GOOGLE_ID=
AUTH_GOOGLE_SECRET=
AUTH_GITHUB_ID=
AUTH_GITHUB_SECRET=

cd /opt/aira

# Start infrastructure
docker compose up -d db redis

# Wait for database to be ready
sleep 5

# Run database migrations
docker compose run --rm migrate

# Start all services
docker compose up -d

# API health
curl http://localhost:8000/health
# Expected: {"status":"healthy","checks":{"database":"ok"}}

# Frontend (should redirect to login)
curl -o /dev/null -w "%{http_code}" http://localhost:3000/dashboard/cases/new
# Expected: 307

# Docs
curl -o /dev/null -w "%{http_code}" http://localhost:3001/
# Expected: 200

{$API_DOMAIN:api.localhost} {
    reverse_proxy aira-api:8000
    encode gzip

    header {
        Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
        Referrer-Policy "strict-origin-when-cross-origin"
    }
}

{$FRONTEND_DOMAIN:app.localhost} {
    reverse_proxy aira-frontend:3000
    encode gzip
}

{$DOCS_DOMAIN:docs.localhost} {
    reverse_proxy aira-docs:3000
    encode gzip
}

cd /opt/aira

# Pull latest images
docker compose pull

# Run any new migrations
docker compose run --rm migrate

# Restart services
docker compose up -d

docker logs aira-api-1 --tail 30

# Check current migration version
docker compose exec db psql -U aira -c "SELECT version_num FROM alembic_version;"

# Re-run migrations
docker compose run --rm migrate

docker pull ghcr.io/aira-proof/backend:latest