# Install with Docker Compose

For a self-managed VPS or dedicated server, an automated install script sets up Sentinel as a Docker Compose stack in one command. It's a good fit for a budget-conscious, production-ready single-server deployment — infrastructure costs as low as a few euros a month — without needing Kubernetes or a managed cloud platform.

## Prerequisites

- A VPS or dedicated server
- Ubuntu Server 24.04

## Step 1 — Create a server and SSH in

Provision a server running Ubuntu Server 24.04, then SSH into it.

## Step 2 — Run the install script

```bash
bash <(curl -s https://raw.githubusercontent.com/altcha-org/sentinel-install-scripts/main/install-ubuntu-24-04.sh)
```

The script installs Docker, sets up a Docker Compose stack pulling the Sentinel image from one of the [container registries](/docs/sentinel/install/#container-registries), and places everything under `/home/altcha/altcha/`.

## Step 3 — Start Sentinel

Management scripts are installed to `/home/altcha/altcha/`:

- `./start.sh` — start Sentinel
- `./stop.sh` — stop Sentinel
- `./status.sh` — check status and recent logs
- `./update.sh` — update to the latest version
- `./logs.sh` — view live logs

## Step 4 — Set up a reverse proxy

For production, put Sentinel behind a reverse proxy so it's served over HTTPS rather than exposed directly. See [Reverse Proxy](/docs/sentinel/operations/reverse-proxy/).

## Step 5 — Access the application

Once running:

- Web interface: `http://localhost:8080` (or your domain, once proxied)
- API: `/v1`
- API documentation: `/v1/docs`
- Health check: `/.live`

Sign in with the default credentials `root` / `root` and change the password immediately.

## Production configuration

A single stack works out of the box on its own local database — good for evaluation, but production deployments should run multiple instances for redundancy, which needs four variables set identically on every one. Add them under the `altcha_sentinel` service's `environment:` block in `docker-compose.yml`, then restart the stack (`./stop.sh && ./start.sh`):

```yaml
services:
altcha_sentinel:
environment:
  - SECRET_SEED=<a long random string, identical on every node>
  - LICENSE_KEY=<license key>
  - POSTGRES_URL=postgresql://user:password@your-db-host:5432/altcha_sentinel
  - REDIS_URL=redis://default@your-redis-host:6379
```

See [Clustering](/docs/sentinel/operations/clustering/#minimum-production-configuration) for what each variable does, and [ENV Variables](/docs/sentinel/operations/env-variables/) for the full reference.

## Updating Sentinel

Run `./update.sh`, or bump the image tag in `docker-compose.yml` directly and restart the stack:

```yaml
services:
altcha_sentinel:
image: ghcr.io/altcha-org/sentinel:{TAG}
```

See [Releases](/docs/sentinel/releases/) for available versions.

## Security recommendations

For an internet-facing deployment, also consider:

- **Host header restriction** — configure your reverse proxy to only forward requests with the expected `Host` header, rather than exposing Sentinel to any hostname pointed at the server.
- **IP address restriction** — restrict access to the admin interface to known/trusted IP ranges where possible.

## Next steps

- **[Configure](/docs/sentinel/configure/)** — set up your first Security Group and API Key.
- **[Reverse Proxy](/docs/sentinel/operations/reverse-proxy/)** — HTTPS termination options.
- **[Monitoring & Logging](/docs/sentinel/operations/monitoring-logging/)** — track Sentinel's health once it's live.