Install VectorFlow

VectorFlow ships its own docker-compose.yml. It runs VectorFlow, the sign-in service, PostgreSQL, Redis and a gateway on one host. The sign-in page, page titles and navigation are VectorFlow’s.

Before you start

You need a Linux host with:

• Docker Engine and Docker Compose 2.20 or later
• openssl, to generate the secrets
• a DNS name pointing at the host, if you want a public certificate

Requirements has the sizing details.

Note

The repositories and images are private for now, so cloning and pulling need a GitHub token and docker login ghcr.io. While the repositories are private shows how to get one.

Install

git clone https://github.com/veltrosecurity/vectorflow && cd vectorflow
cp .env.example .env

Fill in .env. Every secret starts empty, and the comment above it is the command that makes one (openssl rand -hex 32). Run it and paste the output in. Put your email in VELTRO_BOOTSTRAP_ADMIN_EMAIL.

PUBLIC_BASE_URL is the address people type into the browser: scheme, host, and a port only if it isn’t the default. No path, no trailing slash. It has to match exactly, so behind your own proxy it’s the proxy’s https address. Miss a value and docker compose up stops and tells you which one.

docker compose up -d

Only the gateway publishes a port, 8080 by default. GATEWAY_PORT in .env changes it; keep it in step with PUBLIC_BASE_URL. The gateway serves plain HTTP, so TLS is your reverse proxy’s job: point it at the gateway and serve PUBLIC_BASE_URL over https. TLS and your reverse proxy lists the headers to forward and has Caddy and nginx examples.

Agents enrol through the same public address, so make sure they can reach PUBLIC_BASE_URL from wherever they run.

Sign in and give yourself access

On first start, identity creates your admin and logs a one-time sign-in link, good for 24 hours:

docker compose logs identity | grep /invite/

Open it, set a password, then go to PUBLIC_BASE_URL/vectorflow.

Home lists failing pipelines and offline nodes under a pipeline health strip, and until you’ve created an environment, enrolled an agent and deployed a pipeline, it walks you through those steps.

Your first admin already has the admin role in VectorFlow. Other administrators don’t, so grant a role to everyone who needs VectorFlow in Settings > Users. Until someone has a grant, VectorFlow refuses their requests. Sign-in and access covers SSO and tokens.

Next

Build your first pipeline. It walks through enrolling an agent, which a pipeline needs before it can run.

Keep it running

docker compose ps              # containers and health checks
docker compose logs vectorflow # VectorFlow's own logs

With VF_VERSION unset you run the release docker-compose.yml pins, so git pull && docker compose pull && docker compose up -d upgrades. Set VF_VERSION in .env to run a different release.

To run VectorFlow alongside the other products, use Install two or more products instead.