Deployment Quickstart

Stand up a pilot AFT instance with Docker Compose — one container, one data volume, three required settings.

Bedrock AFT ships as a single all-in-one container image: nginx (TLS + CAC client-certificate verification), the application server, and PostgreSQL, supervised together. One persistent volume holds the database. This page gets a pilot instance running; production hardening (real TLS certificates, CAC trust chain) is noted at the end.

Prerequisites

Docker (or Podman) with Compose
The Bedrock AFT docker-compose.yml and .env.example from the source repository

1. Configure

Copy the environment template and set the three required values:

cp .env.example .env

Variable	Purpose
`POSTGRES_PASSWORD`	Password for the bundled PostgreSQL — Compose refuses to start without it
`AFT_PROXY_SHARED_SECRET`	Long random string shared between the internal nginx and the app server — the reverse-proxy trust boundary. Required
`AFT_ADMIN_BOOTSTRAP_PASSWORD`	Initial admin password, minimum 12 characters. Required on first boot
`AFT_ADMIN_BOOTSTRAP_EMAIL`	Initial admin login — optional, defaults to `admin@aft.gov`

# generate strong values quickly
openssl rand -base64 48   # proxy secret
openssl rand -base64 24   # passwords

2. Start

docker compose up -d --build

First boot initializes PostgreSQL, applies the schema, generates a self-signed TLS certificate if none is mounted, and creates the bootstrap admin with a forced password change at first login.

The bootstrap only fires once — if an admin account already exists, changing the bootstrap variables and redeploying does not reset the admin password. Use the normal password-reset path instead.

Browse to the instance over HTTPS and log in with the bootstrap admin credentials. After the forced password reset, use the admin area to create user accounts and grant roles (users can hold several roles and pick their active role at sign-in).

You can verify container health at any time — the image exposes a /healthz endpoint used by the built-in Docker health check.

Data and backups

Everything persistent lives in one named volume (aft_pgdata, mounted at /var/lib/postgresql/data). Back up that volume — or run standard pg_dump against the bundled PostgreSQL — and you have the whole system state: users, requests, signatures, audit history.

Going to production

Two things separate a pilot from a production deployment:

Real TLS certificates — replace the default certificate material in the nginx configuration with certificates for your hostname.
CAC authentication — load your certificate trust chain (e.g., DoD root and intermediate CAs) into the nginx client-verification configuration so CAC login works. Password login functions without this, so a pilot can run before PKI is wired up.

Never expose the app server directly. nginx and the application share a proxy secret precisely so that only traffic that passed TLS/CAC verification reaches the application — bypassing nginx bypasses that boundary.