Installation & Deployment

apPosture ships as a self-hosted stack - your code, findings and models never leave your infrastructure. It runs entirely offline / air-gapped if needed.

What runs

Service	Role
backend	API + scan engine + migrations
frontend	Next.js UI
postgres	system of record (findings, posture, models, audit)
redis	queue broker + cross-process state
apposture-scanner	OWASP ZAP daemon (DAST)
ollama	local LLM (AI analysis)
oast-collector	out-of-band blind-vuln callback sink
watchdog	external health monitor → alerts

The database image is stock and never rebuilt; all customer data lives in named volumes that survive every update.

Production install

cp .env.prod.example .env          # set REGISTRY, APP_VERSION and EVERY secret
docker login <REGISTRY>            # if the registry is private
docker compose -f docker-compose.prod.yml up -d
# one-time: pull the LLM model into the ollama volume
docker exec apposture-ollama-1 ollama pull deepseek-coder-v2:16b

Secrets are required (${VAR:?}), so the stack fails fast if .env is incomplete instead of using dev defaults.

TLS & domains

Terminate TLS on the host nginx (Let's Encrypt) and proxy:

• / → frontend :3000
• /api + /health → backend :8000
• /docs → the documentation portal

Only 80/443 are exposed publicly; service ports bind to 127.0.0.1.

Scaling (optional)

Enable the distributed queue so scans and CI runs execute on workers (survive restarts, scale horizontally):

USE_CELERY=true docker compose -f docker-compose.prod.yml --profile queue up -d

Updating

#  edit APP_VERSION in .env, then:
./release/update.sh                 # pull → backup → migration-canary → deploy → health-gate

The update runs a migration canary (tests migrations on a throwaway copy first) and health-gates the result - see Backup & DR.

Air-gapped

All engines work without internet using a curated CVE / threat-intel cache. The local LLM means AI analysis needs no external API. Ideal for finance, government and critical-infrastructure environments with data-residency requirements.

Next: Quick Start to run your first scan.