Installation

opensecstack can be installed in three ways: via Docker Compose (recommended for local development and small deployments), via Kubernetes manifests or Helm (production), or built from source per platform.

Requirements

The minimum toolchain depends on your chosen install path. Docker Compose only requires Docker. Building from source requires the full toolchain.

Tool	Minimum version	Used by
Docker	25.0+	All install paths
Docker Compose	v2.24+ (plugin)	Docker Compose install path
Go	1.24+	APIGuard, CITADEL, IRFlow, ThreatFlow, OpenCSIRT, sinauth, SIN Community
Rust	1.76+	APIGuard (parser/analyser), ThreatFlow, SDK Rust crate
Python	3.12+	NIS2 Compass, IRFlow report module, SDK Python crate
Node.js	20 LTS (18 minimum)	APIGuard UI, NIS2 Compass UI, sinauth UI, website
PostgreSQL client	16+	Database inspection and migrations
kubectl	1.28+	Kubernetes install path
Helm	3.14+	Helm install path

Docker Compose

The recommended path for local development and Tier 1 single-host deployments. The compose file at deploy/docker-compose.yml brings up all currently-released platforms along with shared PostgreSQL 16 and Redis 7.

Bash

"cm"># Clone the monorepo
git clone https://github.com/opensecstack/opensecstack
cd opensecstack

"cm"># Copy the environment template and fill in secrets
cp deploy/.env.example deploy/.env
"cm"># Edit deploy/.env — at minimum set POSTGRES_PASSWORD, REDIS_PASSWORD,
"cm"># APIGUARD_JWT_SECRET, NIS2_JWT_SECRET, MEILI_MASTER_KEY,
"cm"># COMMUNITY_JWT_SECRET, COMMUNITY_PASSWORD_PEPPER,
"cm"># SIN_DB_PASSWORD, SINAUTH_DB_PASSWORD, SINAUTH_ISSUER, SINAUTH_SITE_URL

"cm"># Start all services
docker compose -f deploy/docker-compose.yml up -d

"cm"># Tail logs for a specific service
docker compose -f deploy/docker-compose.yml logs -f apiguard-api

"cm"># Stop and remove containers (data volumes are preserved)
docker compose -f deploy/docker-compose.yml down

Note: Use docker compose (Compose v2 plugin), not the legacy docker-compose v1 binary. Upgrade with sudo apt-get install docker-compose-plugin on Debian/Ubuntu or via Docker Desktop on macOS/Windows.

Kubernetes

Plain Kubernetes YAML manifests live in deploy/k8s/. A Helm chart is available at deploy/helm/opensecstack/ for parameterised production installs.

Plain manifests

Bash

"cm"># Prerequisites: kubectl configured, nginx Ingress controller installed

"cm"># 1. Create the namespace
kubectl apply -f deploy/k8s/namespace.yaml

"cm"># 2. Create secrets (never commit real secret values)
kubectl create secret generic opensecstack-db-secrets \
  --namespace opensecstack \
  --from-literal=POSTGRES_PASSWORD='<strong-password>' \
  --from-literal=NIS2_DB_PASSWORD='<strong-password>'

kubectl create secret generic opensecstack-app-secrets \
  --namespace opensecstack \
  --from-literal=APIGUARD_JWT_SECRET='<random-min-32-chars>' \
  --from-literal=NIS2_JWT_SECRET='<random-min-32-chars>' \
  --from-literal=REDIS_PASSWORD='<strong-password>'

"cm"># 3. Apply all manifests recursively
kubectl apply -f deploy/k8s/ -R -n opensecstack

"cm"># 4. Watch rollout progress
kubectl rollout status deployment/apiguard -n opensecstack
kubectl rollout status deployment/nis2compass -n opensecstack

"cm"># 5. Port-forward for local access (if no Ingress)
kubectl port-forward svc/apiguard-service 8080:8080 -n opensecstack
kubectl port-forward svc/nis2compass-service 8090:8090 -n opensecstack

The manifest directory structure mirrors the topology: postgres/, redis/, apiguard/, nis2compass/, with Ingress resources defaulting to apiguard.opensecstack.local and nis2compass.opensecstack.local — update the host: field before applying to production.

Helm chart

Bash

"cm"># Copy the values template for your environment
cp deploy/helm/opensecstack/values.prod.yaml.example deploy/helm/opensecstack/values.prod.yaml

"cm"># Edit values.prod.yaml — set image tags, replica counts, ingress hosts, secret refs

"cm"># Lint and dry-run
helm lint deploy/helm/opensecstack/ -f deploy/helm/opensecstack/values.prod.yaml
helm install opensecstack deploy/helm/opensecstack/ \
  --namespace opensecstack --create-namespace \
  --values deploy/helm/opensecstack/values.prod.yaml \
  --dry-run

"cm"># Install
helm install opensecstack deploy/helm/opensecstack/ \
  --namespace opensecstack --create-namespace \
  --values deploy/helm/opensecstack/values.prod.yaml

"cm"># Upgrade (rolling)
helm upgrade opensecstack deploy/helm/opensecstack/ \
  --namespace opensecstack \
  --values deploy/helm/opensecstack/values.prod.yaml

From source

Each platform ships a Makefile. The make dev target starts the platform with hot reload. Run these commands from the monorepo root.

Bash

"cm"># Go platforms (APIGuard, CITADEL, IRFlow, sinauth, SIN Community)
go version   "cm"># must be 1.24+

cd apiguard && go mod download && make dev   "cm"># :8080
cd citadel  && go mod download && make dev   "cm"># :8099
cd irflow   && go mod download && make dev   "cm"># :8083
cd sinauth  && go mod download && make dev   "cm"># :8100
cd community && go mod download && make dev  "cm"># :8089

"cm"># Rust components (APIGuard parser/analyser, ThreatFlow)
rustup toolchain install stable
rustup target add wasm32-wasip2   "cm"># CyberPath lab builds only
cargo build --release -p apiguard-parser -p apiguard-analyser

"cm"># Python platform (NIS2 Compass)
python --version   "cm"># must be 3.12+
cd nis2compass
python -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt
docker compose -f docker-compose.dev.yml up -d
alembic upgrade head
"cm"># API on :8090, UI: cd ui && npm ci && npm run dev (:3001)

"cm"># Node dashboards
node --version   "cm"># must be 18+ (20 LTS recommended)
cd apiguard/ui && npm ci && npm run dev    "cm"># :3000
cd sinauth/web && npm ci && npm run dev    "cm"># :5173

Warning: The Rust stable toolchain must be active (rustup show) before building APIGuard or ThreatFlow. On Linux, ensure build-essential (Debian/Ubuntu) or base-devel (Arch) is installed to avoid linker errors.

Next steps

Quick Start — bring up the full stack in under ten minutes with Docker Compose
Architecture overview — understand how the platforms fit together
Deployment — production topology, env/secrets, and Kubernetes networking
Identity (sinauth) — configure single sign-on for the ecosystem

← PreviousQuick Start Next →Local Development