Self-hosting

Deploy UnionUser (Keygate engine) and PostgreSQL with Docker Compose: environment, upgrades, backups and licensing.

Self-hosting requires a commercial license. The source is not public; you receive container images and deployment support.

Requirements

  • Linux host, starting at 2 vCPU / 2 GB RAM
  • Docker Engine 24+ with Docker Compose 2.24+
  • PostgreSQL 16+ (the bundled Compose service is fine)
  • A domain and an HTTPS certificate
  • Optional: S3-compatible storage for release artifacts

Minimal Compose

docker-compose.yml
services:
  keygate:
    image: <your-licensed-image>
    ports:
      - "9000:9000"
    env_file: .env
    environment:
      PORT: "9000"
      ENVIRONMENT: production
      BASE_URL: https://licenses.example.com
      DATABASE_URL: postgres://keygate:keygate@postgres:5432/keygate?sslmode=disable
      JWT_SECRET: ${JWT_SECRET:?set me}
      LICENSE_SIGNING_KEY: ${LICENSE_SIGNING_KEY:?set me}
      ADMIN_EMAILS: admin@example.com
    depends_on:
      postgres:
        condition: service_healthy
    restart: unless-stopped

  postgres:
    image: postgres:18-alpine
    environment:
      POSTGRES_USER: keygate
      POSTGRES_PASSWORD: keygate
      POSTGRES_DB: keygate
    volumes:
      - pgdata:/var/lib/postgresql
    restart: unless-stopped

volumes:
  pgdata:

Key environment variables

VariablePurpose
BASE_URLPublic origin used in emails and feed URLs
DATABASE_URLPostgreSQL connection string
JWT_SECRETSession signing secret, long and private
LICENSE_SIGNING_KEYEd25519 private key for licenses; rotating invalidates old tokens
ADMIN_EMAILSAdmin emails, comma-separated
SMTP_*OTP and notification email
STRIPE_*Payments and webhooks (optional)
REDIS_URLOptional rate limiting and cache

Upgrades and backups

  • Back up PostgreSQL and LICENSE_SIGNING_KEY before upgrades; losing the key breaks issued tokens.
  • Pin image tags by version; avoid a floating latest.
  • Test migrations on a copy before switching production.
  • Export license and audit data on a schedule and retain it as compliance requires.

License and attribution

AGPL v3 attribution The UI must keep “Powered by Keygate”. Self-hosting does not grant white-label or resale rights; those require a separate upstream commercial license.

For a self-hosted quote or a security review packet, contact sales@unionuser.com.