Skip to content
Msty SailMsty SailDocs

Install with Docker Compose

Sail ships as one Docker image. A Compose file runs it with Postgres and, if you like, Caddy for HTTPS.

Before you start

Section titled “Before you start”

You need the following. Requirements has the details, including sizing.

  • A Linux server with Docker Engine and the Compose plugin.
  • A domain name for Sail, such as sail.example.com, pointing at the server.
  • Ports 80 and 443 open to the people who’ll use Sail, if you use the bundled Caddy.
  • An OpenID Connect identity provider, such as Microsoft Entra ID, Okta, Google Workspace or Keycloak. You’ll register Sail as an app there.
  • Msty Nexus, reachable from the server. See Pair Sail with Nexus.
  • The Sail release bundle and image tag from Msty.

1. Unpack the bundle

Section titled “1. Unpack the bundle”

Put the bundle on the server, for example in /opt/msty-sail. It holds:

  • compose.yaml: Sail, Postgres and the optional Caddy.
  • Caddyfile: HTTPS in front of Sail.
  • .env.example: every setting, with notes.
  • compose.identity.yaml and compose.nexus.yaml: for scripted installs.
  • backup.sh and restore.sh.
cd /opt/msty-sail

2. Fill in the settings

Section titled “2. Fill in the settings”

Copy the example file:

cp .env.example .env

Then set these in .env:

SettingWhat to put
SAIL_IMAGEThe image from your release notes. Pin the minor version, such as :1.2. Never use latest.
SAIL_PUBLIC_URLThe address people will use, such as https://sail.example.com.
SAIL_DOMAINThe same domain without https://, for Caddy.
SAIL_DATABASE_PASSWORDA long random password. Use hex only, as below.

Generate the database password:

openssl rand -hex 32

3. Create the secret key

Section titled “3. Create the secret key”

Sail encrypts stored secrets with this key.

mkdir -p secrets && chmod 700 secrets
openssl rand -base64 32 > secrets/secret-key && chmod 644 secrets/secret-key

4. Start Sail

Section titled “4. Start Sail”

With the bundled Caddy, which gets an HTTPS certificate on its own:

docker compose --profile tls up -d

Or, behind your own HTTPS proxy:

docker compose up -d

Sail then listens on 127.0.0.1:8484. Point your proxy there, and turn off response buffering, because replies stream.

Check that everything is up:

docker compose ps

Wait until sail shows healthy. The first start takes a little longer while Sail sets up its database.

Section titled “5. Open the setup link”

On first start, Sail prints a one-time setup link to its log:

docker compose logs sail | grep setup_url

Open the link in your browser. It starts the setup wizard.

6. Finish setup in the browser

Section titled “6. Finish setup in the browser”

The wizard has five steps. First setup explains each one, and what to set up next.

  1. Sign-in provider. Click Copy redirect URI and add it to a new app in your identity provider. Then fill in the Issuer URL, Client ID and Client secret the provider gives you.
    • Allowed email domains and Required group decide who can sign in. Use either or both. With neither, only owners can sign in.
    • Click Save and continue. Sail checks the provider before it moves on.
  2. Owner account. Click Sign in to become the owner. Whoever signs in here manages Sail for everyone.
  3. Nexus. Enter your Nexus address and approve Sail in Nexus. Pair Sail with Nexus walks through it.
  4. Default assistant. Pick the model everyone starts with. Under Utility model, pick a small, fast model. It writes chat titles, saves memories and summarizes long chats.
  5. Done. Copy Sail’s address and share it with your company.

Click Start chatting. Sail is ready.

Optional settings

Section titled “Optional settings”

All of these go in .env. Restart with docker compose up -d after a change.

  • Interactive pages. Assistants can make HTML pages, like dashboards. They run on a separate address, for safety. Set SAIL_SANDBOX_URL, such as https://sail-pages.example.net, ideally on another domain. With the bundled Caddy, also set SAIL_SANDBOX_DOMAIN. Without it, pages show as source code.
  • Private networks. If Nexus or your identity provider is on a private network, list its host in SAIL_OUTBOUND_ALLOW, such as nexus.internal or 10.0.0.0/8.
  • Real client addresses. If a proxy sits in front of Sail, list its network in SAIL_TRUSTED_PROXIES, so the audit log records people’s real IP addresses.
  • Your own certificate. Put cert.pem and key.pem in ./tls, and add tls /tls/cert.pem /tls/key.pem to each site in the Caddyfile.

Scripted installs

Section titled “Scripted installs”

To skip the wizard’s provider and Nexus steps, set them before the first start.

  1. In .env, set SAIL_OIDC_ISSUER, SAIL_OIDC_CLIENT_ID, and SAIL_OIDC_ALLOWED_DOMAINS or SAIL_OIDC_REQUIRED_GROUP. For Nexus, set SAIL_NEXUS_URL.

  2. Put the secrets in files, never in .env:

    printf %s '<client secret>' > secrets/oidc-client-secret
    printf %s '<Nexus access token>' > secrets/nexus-token

  3. Start with the extra Compose files:

    docker compose -f compose.yaml -f compose.identity.yaml -f compose.nexus.yaml up -d

Settings that come from the environment show as read-only in the wizard and in Admin.

Next steps

Section titled “Next steps”