# Vallorix — Self-Hosted

Run your own private, sovereign instance of Vallorix. Your evidence, controls, and
audit data never leave your infrastructure — deploy on your own cloud, on-prem, or
fully air-gapped.

This package is a Docker Compose stack: the Vallorix app + PostgreSQL + an internal
S3 object store (SeaweedFS) + a headless-Chrome renderer for PDFs/reports.

---

## Requirements

- Linux host with **Docker Engine + Compose v2** (or **Podman + podman-compose**)
- ~2 vCPU / 4 GB RAM to start (more for larger programs)
- `openssl` (for `generate-secrets.sh`)
- An **LLM endpoint** for the AI copilot — any OpenAI-compatible API. For a fully
  private model, run [Ollama](https://ollama.com) on the host:
  `ollama serve && ollama pull llama3`

## 1. Get the image

Two supported ways:

**a) Offline / air-gapped** — load the image tarball you were provided:
```bash
docker load -i vallorix-<version>.tar.gz
# then set VALLORIX_IMAGE=localhost/vallorix:latest in .env
```

**b) Registry** — once you have pull access:
```bash
docker pull ghcr.io/inferix/vallorix:latest
```

## 2. Generate secrets

```bash
./generate-secrets.sh
```
This writes `.env` (strong random secrets + your config) and
`secrets/oauth2_signing_key.pem`. Review `.env` and set at least:
- `VALLORIX_BASE_URL` — the public URL users will reach (put TLS in front)
- `VALLORIX_LLM_BASE_URL` / `VALLORIX_LLM_MODEL` — your AI endpoint
- `VALLORIX_IMAGE` — if you loaded the tarball, set `localhost/vallorix:latest`

## 3. Start

```bash
docker compose up -d        # or: podman compose up -d
docker compose logs -f vallorix
```
Open your `VALLORIX_BASE_URL` (default http://localhost:8090) and create the first
admin account.

## 4. Put TLS in front (production)

The app binds to `127.0.0.1:8090` by default. Terminate TLS with nginx/Caddy/Traefik
and proxy to it. Example nginx:
```nginx
server {
  listen 443 ssl;
  server_name compliance.yourcompany.com;
  # ssl_certificate ... ssl_certificate_key ...;
  location / { proxy_pass http://127.0.0.1:8090; proxy_set_header Host $host; proxy_set_header X-Forwarded-Proto https; }
}
```
Set `VALLORIX_BASE_URL=https://compliance.yourcompany.com` in `.env` and
`docker compose up -d` again.

## Secrets management (cloud)

Instead of literal values, any `PROBOD_*` value may reference a secret manager —
`aws://`, `awssm://` (Secrets Manager), or `awsps://` (Parameter Store). Point the
env at the reference and grant the host an IAM role. Useful for regulated cloud
deployments where secrets must live in a managed vault.

## Operations

- **Backups:** back up the `vallorix-postgres-data` and `vallorix-seaweedfs-data`
  volumes (Postgres holds your program; SeaweedFS holds uploaded evidence).
- **Upgrade:** `docker compose pull && docker compose up -d` (migrations run
  automatically on start). Pin a version tag in `.env` for controlled upgrades.
- **Email (optional):** set `VALLORIX_SMTP_ADDR` etc. in `.env` to enable invites and
  notifications. Left empty, the app runs without outbound mail.

## Support

Self-hosted is a licensed tier. For the image, a license, and priority support,
contact us at **https://vallorix.ai/#demo**.

---
© Vallorix, by Inferix. Private · Self-hosted · Sovereign.