Getting started

Schleuse runs as a single container. The minimum dependency is a database — SQLite lives on a volume, PostgreSQL is a second container. JWT keys are auto-generated on first start and persisted, so you don't need to pre-create secrets.

The app image is published to the GitLab container registry at registry.gitlab.com/meowww_dev/schleuse:latest — you do not need the source tree to deploy.

Docker (recommended)

cp .env.example .env

Edit .env and fill in at least:

Variable	Example
NUXT_DATABASE_URL	postgresql://schleuse_user:schleuse_password@postgres:5432/schleuse or sqlite:/app/data/schleuse.db
NUXT_APP_URL	https://auth.example.com
NUXT_ISSUER	https://auth.example.com/oidc
NUXT_RP_ID	auth.example.com
NUXT_RP_NAME	My Product
NUXT_RP_ORIGIN	https://auth.example.com
NUXT_OIDC_CLIENTS_JSON	see OIDC configuration

Then:

docker compose pull
docker compose up -d

• App: http://localhost:5000
• Mailcatcher UI (dev): http://localhost:1080

On first start the container:

1. Auto-generates jwt-secret.txt and jwt-private-key.pem in /app/data/
2. Runs database migrations
3. Starts serving on port 3000 (published to 5000 by compose)

The first user to register is auto-promoted to admin. Toggle with NUXT_AUTO_ADMIN_FIRST_USER=false.

If you set NUXT_REQUIRE_TWO_FACTOR=true without SMTP, that first admin must enrol an authenticator app or a passkey on /setup-2fa right after their first login before the panel unlocks — there's no admin exemption. See Security → Mandatory two-factor.

Building from source

Contributors working from a git checkout can still swap docker compose up -d for docker compose up --build — the bundled docker-compose.yml keeps a local build: stanza so iterations on the Dockerfile don't require a pushed image.

Minimal self-hosted compose

If you already run PostgreSQL elsewhere, or you want SQLite, this is the whole stack (no source tree required — the image is pulled from the registry):

services:
  schleuse:
    image: registry.gitlab.com/meowww_dev/schleuse:latest
    ports:
      - "3000:3000"
    volumes:
      - app_data:/app/data   # auto-generated keys + SQLite DB (if used)
    environment:
      NODE_ENV: production
      NUXT_DATABASE_URL: sqlite:/app/data/schleuse.db
      NUXT_ISSUER: https://auth.example.com/oidc
      NUXT_APP_URL: https://auth.example.com
      NUXT_RP_ID: auth.example.com
      NUXT_RP_NAME: My Product
      NUXT_RP_ORIGIN: https://auth.example.com
      NUXT_OIDC_CLIENTS_JSON: >
        [{"clientId":"my-app",
          "redirectUris":["https://my-app.example.com/callback"],
          "grantTypes":["authorization_code","refresh_token"],
          "scopes":["openid","email","profile","offline_access"],
          "public":true}]

volumes:
  app_data:

Local development

pnpm install
docker compose up postgres mailcatcher -d
cp .env.example .env
pnpm dev

Migrations run automatically at startup via a Nitro plugin.

Next steps

• Wire your OIDC clients → OIDC provider
• Enable 2FA, customise the password policy → Configuration
• Set up SMTP, rebrand emails → Email templates
• Prep for production → Deployment