Self-hosting (Docker)

Prefer your own environment? Rollout runs as a Docker container behind Caddy, with the same code as the hosted version. Administration can stay entirely internal; only booking links and the client portal need to be reachable from outside.

One or two addresses

Step by step

1. Database

   Supabase Cloud (EU) or self-hosted. Migrations and the first administrator:

   Terminal

   Copy

   $ DATABASE_URL='postgresql://postgres:<password>@<db-host>:5432/postgres' ./deploy/migrate.sh

   Klaar: 17 nieuwe migratie(s).

   $ psql "$DATABASE_URL" -c "update platform_settings set bootstrap_admin_email = 'you@yourmsp.com';"

   UPDATE 1
2. Configuration and secrets

   Terminal

   Copy

   $ cp deploy/.env.example deploy/.env

   $ install -m 600 rollout-graph.key deploy/secrets/graph-cert-key.pem

   $ openssl rand -hex 32 > deploy/secrets/updater-secret

   $ node scripts/gateway-secret.mjs

   Fill in deploy/.env (ROLLOUT_DOMAIN, APP_URL, Supabase, Graph, ROLLOUT_GATEWAY_SECRET). The Graph certificate is a Docker secret: it never appears in an environment variable, an image or a log.

3. Two addresses (optional)

   .envCopy

   CADDYFILE=Caddyfile.split
   PUBLIC_DOMAIN=booking.yourmsp.com
   PUBLIC_URL=https://booking.yourmsp.com
   ROLLOUT_DOMAIN=rollout.internal.yourmsp.com
   ADMIN_TLS=internal
   ADMIN_ALLOWED_RANGES=10.0.0.0/8 192.168.0.0/16
   

   In Entra, add https://booking.yourmsp.com/toestemming as a redirect URI of Rollout – Readiness.

4. Build and start

   Terminal

   Copy

   $ docker compose -f deploy/compose.yaml --env-file deploy/.env up -d --build

   $ docker compose -f deploy/compose.yaml ps

   rollout running (healthy)

   caddy running

   $ curl -fsS https://rollout.internal.yourmsp.com/api/ready

   {"ready":true,"checks":{"database":"ok","graph":"ok","gateway":"not-enforced","license":"valid"}}

   Then put the hash of the server gateway in the database.

Outbound traffic

Nothing else: no telemetry, no license server. Behind a proxy: HTTPS_PROXY, NO_PROXY and, with TLS inspection, NODE_EXTRA_CA_CERTS pointing to your own root CA. Never turn off certificate validation.

How the container is hardened

• Read-only file system, no Linux capabilities (cap_drop: ALL), no privilege escalation, doesn't run as root.
• No ports to the outside: only Caddy talks to the app.
• Base image pinned to a fixed version (digest), so the same build gives the same result.
• The optional updater container only installs versions from the list we sign, and rolls back by itself if a new version doesn't start healthy.