Before you start

You need:

• Docker with Compose v2
• A hostname pointing at the machine
• TLS in front of it for anything other than a local trial

Shellius runs PostgreSQL, Redis, guacd (the RDP gateway), the API, the portal, and an Nginx reverse proxy. Budget roughly 2 GB of RAM to start.

1. Get the source

git clone https://github.com/YavLabs/shellius.git
cd shellius
cp .env.prod.example .env.prod

2. Generate the secrets

Shellius will not start with placeholder secrets. Generate real ones:

openssl rand -hex 32   # JWT_SECRET
openssl rand -hex 32   # JWT_REFRESH_SECRET
openssl rand -hex 32   # SERVER_ENCRYPTION_KEY
openssl rand -hex 32   # AGENT_SHARED_SECRET
openssl rand -hex 16   # METRICS_TOKEN

Set them in .env.prod, along with:

Variable	What it is
POSTGRES_PASSWORD	Database password
SERVER_ENCRYPTION_KEY	Encrypts the CA private key and stored credentials
AGENT_SHARED_SECRET	Used by hosts calling the certificate verification endpoint
TRAEFIK_HOST	The hostname Shellius is served at
FRONTEND_URL, CORS_ORIGIN	The public URL of the portal
SEED_ADMIN_EMAIL, SEED_ADMIN_PASSWORD	Your first super admin

DANGER

SERVER_ENCRYPTION_KEY encrypts your certificate authority's private key. If you lose it, you lose the CA, and every bootstrapped host has to be re-bootstrapped against a new one. Back it up somewhere other than the server.

The full variable reference is in docs/DEPLOYMENT.md.

3. Start it

docker compose -f docker-compose.prod.yml --env-file .env.prod up -d

Migrations and an idempotent seed run automatically on the API's first boot, so there is no separate migration step. Watch until everything reports healthy:

docker compose -f docker-compose.prod.yml ps

If a service is not becoming healthy, check its logs:

docker compose -f docker-compose.prod.yml logs backend --tail=100

Other ways to deploy

• All-in-one image — docker-compose.allinone.yml puts the portal, API, and Nginx in a single container. Useful for a small deployment or a trial.
• Coolify — docker-compose.coolify.yml is ready to import.
• Traefik — docker-compose.prod.yml already carries Traefik labels; set TRAEFIK_HOST and attach it to your Traefik network.

Next

Sign in and change the seeded password.