Docker Compose

Every install runs the core profile. Each product adds one profile, and the gateway serves all of them from one address behind one sign-in. No profile runs a product with a login of its own.

Profiles

Profile	Runs
core	The gateway (veltro-nginx), the sign-in service, the PostgreSQL and Redis every product keeps its data in, and their start-up jobs. Always selected
vectorflow	VectorFlow at /vectorflow
sigmatic	Sigmatic at /sigmatic/ with its workers. Select opensearch with it
warden	Warden at /warden/ with its worker
opensearch	Bundled OpenSearch for Sigmatic
agent	VectorFlow agent. Needs vectorflow
demo	MISP mock, CrowdSec LAPI mock and a cscli ssh host for the demo seed. Not part of a normal up
backup	Scheduled backup sidecar
monitoring	Prometheus, Grafana, Alertmanager, node-exporter, cAdvisor
tls	Caddy front door for the gateway (--tls internal / custom)

Choosing products

VELTRO_PRODUCTS in .env names the installed products as a comma-separated subset of vectorflow,sigmatic,warden. Unset means all three and an empty value means core only. veltro up --products sigmatic,warden (or make up PRODUCTS=sigmatic,warden) overrides it for one command.

The CLI turns the selection into profiles: core, then each selected product, plus opensearch when Sigmatic is selected:

veltro up --products sigmatic,warden --dry-run
# OPENSEARCH_SEED_URL=https://opensearch:9200 VELTRO_PRODUCTS=sigmatic,warden docker compose \
#   --env-file versions.env --env-file .env \
#   --profile core --profile sigmatic --profile warden --profile opensearch up -d --wait

Raw compose

Every compose call needs both env files. versions.env pins module image tags (there is no :latest fallback) and .env holds secrets, PUBLIC_BASE_URL and VELTRO_PRODUCTS. Pass the profiles that match VELTRO_PRODUCTS, because identity and the products read that value to decide which peers exist:

docker compose --env-file versions.env --env-file .env \
  --profile core --profile sigmatic --profile warden --profile opensearch up -d

Raw compose works from a fresh install too. Products fetch identity’s public signing keys from its JWKS, so nothing has to start identity first. With Sigmatic selected, the CLI sets OPENSEARCH_SEED_URL so Sigmatic seeds its connection to the bundled OpenSearch; in raw compose, set it in .env.

Sigmatic’s install page covers its private ingest listener (Install Sigmatic).

Upgrading from full or a standalone profile

Earlier releases had a full profile and product-only vectorflow, sigmatic and warden profiles, each with the product’s own login. A veltro.toml that says profile = "full" now reads as all three products. A standalone profile is refused, because its users exist only inside the product; move them into the sign-in service first (Moving from a standalone install).

The retired standalone services leave orphan containers behind: veltro-vectorflow-standalone, veltro-chad-frontend-standalone and veltro-warden-frontend-standalone. Remove them with veltro up --remove-orphans (or make up ARGS=--remove-orphans).

VectorFlow agents that pointed at a product port such as http://host:3000 need VF_URL set to the install’s address plus /vectorflow, for example https://vectorflow.example.com/vectorflow. The bundled vf-agent already defaults to http://vectorflow:3000/vectorflow.

The monitoring profile is covered in Monitoring.