Quick Start

Bring up the full opensecstack ecosystem with Docker Compose in under ten minutes, or run a single platform from source with make dev.

Prerequisites

Docker 25+ and Docker Compose v2.24+ (included with Docker Desktop)
8 GB RAM minimum — 16 GB recommended for the full stack
Ports 8080, 8089, 8090, 8091, 8099, 8100, 3000, 3001, 5432, 6379 free on your machine

Full stack (Docker Compose)

Clone the monorepo, copy the environment template, fill in the required secrets, then start all services with a single command.

Bash

"cm"># 1. Clone the monorepo
git clone https://github.com/opensecstack/opensecstack
cd opensecstack

"cm"># 2. Copy the environment template
cp deploy/.env.example deploy/.env

"cm"># 3. Open deploy/.env and set the required secrets, for example:
"cm">#    APIGUARD_JWT_SECRET=$(openssl rand -hex 32)
"cm">#    NIS2_JWT_SECRET=$(openssl rand -hex 32)
"cm">#    POSTGRES_PASSWORD=$(openssl rand -hex 16)
"cm">#    REDIS_PASSWORD=$(openssl rand -hex 16)
"cm">#    CITADEL_API_KEY=$(openssl rand -hex 32)
"cm">#    MEILI_MASTER_KEY=$(openssl rand -hex 32)
"cm">#    COMMUNITY_JWT_SECRET=$(openssl rand -hex 32)
"cm">#    COMMUNITY_PASSWORD_PEPPER=$(openssl rand -hex 32)
"cm">#    SIN_DB_PASSWORD=$(openssl rand -hex 16)
"cm">#    SINAUTH_DB_PASSWORD=$(openssl rand -hex 16)
"cm">#    SINAUTH_ISSUER=http://localhost:8100
"cm">#    SINAUTH_SITE_URL=http://localhost:5173

"cm"># 4. Start all services in the background
docker compose -f deploy/docker-compose.yml up -d

"cm"># 5. Check every service is healthy (allow ~60 s on first boot)
docker compose -f deploy/docker-compose.yml ps

Note: CITADEL is defined in its own compose file (.citadel/docker-compose.yml) and wired to the ecosystem via the APIGUARD_CITADEL_URL=http://citadel-api:8099 env var. Start it separately or merge the two files for full governance integration.

Service URLs

Once all containers are healthy the following endpoints are available:

Service	URL	Purpose
APIGuard API	`http://localhost:8080`	API security scanner
APIGuard UI	`http://localhost:3000`	Scanner dashboard
NIS2 Compass API	`http://localhost:8090`	NIS2 compliance engine
NIS2 Compass UI	`http://localhost:3001`	Compliance dashboard
ThreatFlow API	`http://localhost:8091`	Threat intelligence (STIX 2.1)
SIN Community API	`http://localhost:8089`	Developer knowledge hub
CITADEL API	`http://localhost:8099`	Governance engine (internal)
sinauth API	`http://localhost:8100`	OAuth 2.0 / OIDC identity provider
sinauth UI	`http://localhost:5173`	Login portal
PostgreSQL	`localhost:5432`	Shared database (internal)
Redis	`localhost:6379`	Queue and cache (internal)

Every platform also exposes /health on its API port. Run a quick smoke check:

Bash

curl http://localhost:8080/health   "cm"># APIGuard
curl http://localhost:8090/health   "cm"># NIS2 Compass
curl http://localhost:8091/health   "cm"># ThreatFlow
curl http://localhost:8089/health   "cm"># SIN Community
curl http://localhost:8099/health   "cm"># CITADEL
curl http://localhost:8100/health   "cm"># sinauth

Single platform (from source)

Each platform is self-contained. Use make dev from the platform directory to start it with hot reload, with its own PostgreSQL instance managed by the platform's dev compose file.

Bash

"cm"># APIGuard (Go + Rust + React)
cd apiguard
cp .env.example .env
make dev
"cm"># API: http://localhost:8080  UI: http://localhost:3000

"cm"># NIS2 Compass (Python + React)
cd nis2compass
cp .env.example .env
docker compose -f docker-compose.dev.yml up -d
alembic upgrade head
cd ui && npm ci && npm run dev
"cm"># API: http://localhost:8090  UI: http://localhost:3001

"cm"># CITADEL (Go)
cd citadel
make docker-up && make migrate-up && make run
"cm"># API: http://localhost:8099

"cm"># IRFlow (Go)
cd irflow
make compose-test-up && make migrate-up && make run
"cm"># API: http://localhost:8083

"cm"># ThreatFlow (Rust + Go)
cd threatflow
docker compose up -d
"cm"># API: http://localhost:8084

"cm"># SIN Community (Go + Meilisearch)
cd community
cp .env.example .env
docker compose up -d
"cm"># API: http://localhost:8089

Next steps

Now that the stack is running, explore further:

Installation — requirements, build-from-source, and Kubernetes setup
Architecture overview — how the platforms fit together
Deployment — Docker Compose vs Kubernetes, env/secrets, production topology
Identity (sinauth) — single sign-on and OIDC configuration
Governance (CITADEL) — MARSHAL engine and WORM audit chain

← PreviousIntroduction Next →Installation