Deployment

OpenFlags ships as a single, all-in-one Docker image. One container serves both the API and the Dashboard on the same port — no nginx, no reverse proxy configuration needed.

Quick start (Docker Hub)

docker run -d \
  --name openflags \
  -p 4000:4000 \
  -v openflags_data:/app/data \
  -e CORS_ORIGIN=https://flags.yourcompany.com \
  huextrat/openflags:latest

Open http://localhost:4000 — the first user to sign up becomes Platform Admin.

Docker Compose

Create a docker-compose.yml anywhere on your server:

services:
  openflags:
    image: huextrat/openflags:latest
    ports:
      - "4000:4000"
    volumes:
      - openflags_data:/app/data
    environment:
      PORT: 4000
      CORS_ORIGIN: https://flags.yourcompany.com
    restart: unless-stopped

volumes:
  openflags_data:

docker compose up -d

Environment variables

Build from source

If you prefer to build the image yourself:

git clone https://github.com/huextrat/openflags.git
cd openflags
docker build -f infra/docker/Dockerfile -t openflags .
docker run -d -p 4000:4000 -v openflags_data:/app/data openflags

Multi-container setup

The repository also includes separate Dockerfiles for running the server and dashboard independently behind nginx. This is useful for teams that want to scale or deploy each component separately:

docker compose up -d   # uses docker-compose.yml at repo root

This starts:

• Server on port 4000
• Dashboard + nginx on port 8080 (proxies /api/ → server)

Hosting the docs site

The documentation lives in apps/docs and is a standalone Next.js application. Deploy it to Vercel for the best experience:

1. Connect your GitHub repository to Vercel.
2. Set the root directory to apps/docs.
3. Vercel auto-detects Next.js + Turborepo — deploy takes ~1 minute.

Production checklist

• Set CORS_ORIGIN to your actual domain (e.g. https://flags.yourcompany.com)
• Mount a persistent volume for /app/data so your SQLite database survives restarts
• Place OpenFlags behind a reverse proxy (Caddy, Traefik, nginx) for SSL termination
• Use a custom domain with HTTPS for cookie security