Docker Compose

Easily install Cryptlex on any machine using Docker Compose.

Before installation

To get started with your Cryptlex On-premise installation, you’ll need the following things prepared in advance:

  • If this is your first time installing Cryptlex On-premise, you’ll need to contact us to schedule a guided installation. We’ll get you set up with a license key, and walk you through the installation process.

  • A server meeting the minimum system requirements.


Cryptlex On-premise uses Docker Compose to perform and manage installations. To install Cryptlex On-premise we first need to install and configure Docker Compose.

Install Docker Compose

Please refer to following installation guide:

Using Docker Compose

All of the Cryptlex Docker images are available on Docker Hub. If you’re looking for a complete configuration to get up and running quickly, use our Docker Compose example and follow the steps below.

Step 1: Create custom A or CNAME records

You will need to create three A or CNAME records for the server machine where you will be deploying Cryptlex. For this tutorial we will choose the following three sub-domains: for the Web API Server for the Web Dashboard for the Release Server

Now to create the records:

  • Go to your DNS provider’s website (e.g. GoDaddy or Cloudflare).

  • Create A or CNAME records for the above custom domains.

  • Point all of them to the same IP address or hostname of your server.

Step 2: Clone the cryptlex-on-premise repository

Next, you need to login into your Linux server machine and clone the cryptlex-on-premise repository inside any folder and execute the following commands:

git clone
cd cryptlex-on-premise
chmod 0600 acme.json

The acme.json will store the SSL certificates, which will be generated for the above three sub-domains.

Step 3: Update the Postgres version

In the docker-compose.yml file change the value of services.database.image property to the current stable version of Postgres. For example, if the latest version is 14.5 then set the value to postgres:14.5-alpine. Once the version is set, it cannot be updated later without migrating the database to a newer major version.

Step 4: Update the environment variables

The cryptlex-on-premise folder contains the following four files with environment variables that need to be updated with the correct values.

Update .env file

The .env file contains the following environment variables which you may need to update:

Environment Variables



Name of the database.


Username of the database user.


The password of the database user.


Email required for SSL certificate notifications.


The domain of the web API server. In this case:


The domain of the web dashboard. In this case:


The domain of the release server. In this case:


Access key for the file store.


The secret key for the file store.


This is needed in case you want to enable Google SSO.


Traefik is the reverse proxy. You can set the basic auth credentials for the Traefik dashboard.

Update webapi.env file

The webapi.env file contains the following environment variables which you must update:

Environment Variables



Use any random string, this is used to encrypt the private keys stored in the database.


The license key which you get after you purchase the license for the Cryptlex On-Premise server.

Other than the above three you need to set environment variables for the email provider (Mailgun, SendGrid, or SMTP), and additionally you can configure other monitoring and error reporting services.

Update dashboard.env file

The dashboard.env file contains the following environment variables which you may need to update:

Environment Variables



This shows up in the browser title.


Your company website.


Logo to be displayed. It must have a transparent background.


Favicon URL.


Google analytics key.

Update release-server.env file

The release-server.env file contains the following environment variables which you may need to update:

Environment Variables



Name of the bucket (folder) where you want to store all your files.


This is required in case you are using the AWS S3 file store, otherwise, leave the default value as such.


This should only be set to true in case you are using AWS S3.

Step 5: Run Docker Compose

Execute the following commands to start the server:

# ensure you have access to Cryptlex Docker images
# start the Cryptlex services
docker-compose up -d
# execute the following command to check the logs for any error
docker-compose logs -t -f

The Traefik reverse proxy server configured in the docker-compose.yml file will automatically generate SSL certificates for the above-mentioned domains and store them in acme.json. Additionally, it will automatically route the traffic to the respective containers.

Step 6: Signup for the Cryptlex account

Next, you need to open the dashboard in the browser and create your Cryptlex account, which can be done at the following URL:

Only one Cryptlex account can be created in the on-premise version.

Docker Compose file details

In the docker-compose.yml file you will find the database, filestore, cache, geoip, web-api, dashboard, release-server, and reverseproxy services. Read below to better understand how each service is configured.

Database service

It contains the Postgres database server, which is used to store all the Cryptlex data.

Cache service

It uses Redis for storing the cache data. If no Redis database is provided it defaults to memory.

Filestore service

It uses Minio, which is an Amazon S3 compatible object storage server, for storing release files. In case you don't want to use Cryptlex release management API, this service can be commented out in the docker-compose.yml file.

GeoIP service

This service is used to get location information from the IP address of the user.

Web API service

It is the core service that runs the Cryptlex web API server.

Dashboard service

It hosts the Cryptlex web dashboard. It is a single page progressive web application.

Release server service

It handles the upload and download of releases you create in Cryptlex. In case you don't want to use Cryptlex release management API, this service can be commented out in the docker-compose.yml file.

Reverse proxy service

It uses Traefik reverse proxy server to route the traffic and automatically generates and renews the SSL certificates for the WEB_API_DOMAIN , RELEASE_SERVER_DOMAIN andDASHBOARD_DOMAIN.

Traefik admin dashboard

Traefik provides a dashboard that can be used to monitor the health and status of the Cryptlex on-Premise instance. You can access the Traefik dashboard at the following URL:

You will need to put in the credentials set in the .env file to access the dashboard.

Checking logs

Docker compose writes the stdout and stderr logs of each container in a JSON file located in /var/lib/docker/containers/[container-id]/[container-id]-json.log.

To prevent logs from taking up the whole disk space, 20MB limit has been applied to all the containers in the docker-compose.yml file. You can change that as per your requirements.

To view the logs in realtime you can execute the following command:

docker-compose logs -t -f


First login to your Linux server machine where Cryptlex is deployed and go to the directory where the cryptlex-on-premise repository was initially cloned. Then execute the following commands:

# get the latest changes
git pull
# execute the update script
# execute the following command to check the logs for any error
docker-compose logs -t -f

Note: The average downtime during the update is less than 1 minute.

Last updated