Controller installation & HTTPS

Review licensing

Free for personal, noncommercial use and for nonprofits and local governments running their own systems. Commercial use and other organizational use require a separate paid license before deployment. Read the licensing terms.

Before you begin

• A Linux controller with Docker Engine, Docker Compose v2 and Git.
• SSH reachability from the controller to managed targets.
• HTTP(S) access to the package repositories used by those targets.
• A DNS name for the controller and a persistent location for its volumes.

Clone and configure

git clone https://github.com/StealthCat/MrPatchy.git
cd MrPatchy
cp .env.example .env

Edit .env before the first start. Set ADMIN_PASSWORD to a unique password of at least 12 characters, set DOMAIN to your hostname and PUBLIC_URL to its full browser-facing HTTPS URL.

Container safeguards

The production Compose services use read-only root filesystems, explicit writable volumes and a private temporary filesystem. Service-specific capabilities, memory and process limits bound each container. Image digests, hash-locked Python dependencies and dependency scanning help verify the build inputs.

Start the services

docker compose up -d --build
docker compose ps

Open https://YOUR_DOMAIN and sign in as admin using your initial ADMIN_PASSWORD. Password hashes are stored in the database; later .env edits do not reset accounts.

Trust the initial certificate

The initial certificate uses Caddy’s local CA. Copy its public root certificate and install it into the trust store of your administrator device before signing in.

docker compose cp caddy:/data/caddy/pki/authorities/local/root.crt ./mrpatchy-local-ca.crt

Network and certificate profiles

Use BIND_IP, HTTP_PORT and HTTPS_PORT to control published listeners. Settings → HTTPS & certificates provides separate Internal and External profiles with uploaded certificates, Caddy’s built-in CA, Let’s Encrypt or custom ACME. Custom ACME supports CA bundles, account email and EAB.