Deploy On-Premises (Docker)

Docker Compose is the recommended approach for on-premises deployments. It bundles the Waypoint Server and Postgres into a single stack with a named volume for persistence.

Prerequisites

• Docker and Docker Compose installed on your server
• A domain or internal hostname your developers can reach
• Image pull credentials from LaserOwl (provided on pilot onboarding)

Step 1 — Authenticate with the registry

echo <your-token> | docker login ghcr.io -u <username> --password-stdin

Step 2 — Create your .env file

cp .env.example .env

Edit .env:

POSTGRES_PASSWORD=        # openssl rand -hex 16
WAYPOINT_JWT_SECRET=      # openssl rand -hex 32
WAYPOINT_RESET_TOKEN=     # openssl rand -hex 24

DATABASE_URL is auto-constructed from POSTGRES_PASSWORD in the Docker Compose setup — leave it as-is.

Step 3 — Start the stack

docker compose up -d

Verify it's running and grab the bootstrap admin key:

docker compose ps
docker compose logs waypoint-server | grep "wp_"

Step 4 — Reverse proxy (recommended)

Put Nginx or Caddy in front of the server for TLS termination. Example Caddy config:

waypoint.yourcompany.com {
  reverse_proxy localhost:3000
}

Step 5 — Connect your team

Follow the Team Setup guide from Step 2 onwards.

Backups

docker compose exec postgres pg_dump -U waypoint waypoint > backup-$(date +%Y%m%d).sql

Schedule as a cron job and store backups off the server.

Upgrading

docker pull ghcr.io/laserowl-io/waypoint-server:latest
docker compose up -d

Schema changes are applied automatically on boot — no manual migrations needed.