Docker Compose
Run Automata on any machine with Docker using the published images. Unlike the local development stack, the web app runs in a container too, so nothing is built or installed on the host.
Start it
cp .env.selfhost.example .env
# fill in the generated secrets and your public URL
docker compose up -d
Open the app at NUXT_PUBLIC_APP_URL. The web service listens on WEB_PORT; put a TLS-terminating reverse proxy in front of it before exposing it to the internet.
Add connector profiles only when you need them:
docker compose --profile whatsapp up -d
docker compose --profile telegram up -d
A PostgreSQL-only deployment needs just the default services.
What it runs
| Service | Image | Started by |
|---|---|---|
| Postgres | Official Postgres image | Always |
| Web | ghcr.io/ju-li/automata-mcp-web:1 | Always |
| Redis and Evolution API | evoapicloud/evolution-api:v2.3.7 | whatsapp profile |
| Telegram bridge | ghcr.io/ju-li/automata-mcp-telegram-bridge:1 | telegram profile |
Every secret in .env.selfhost.example must be generated before first start. Mail is optional: with the SMTP host empty, connection alerts and invitation emails are not delivered, although an invitation link can still be copied by hand. See Connection alerts.
Updating
The images are pinned to the major tag :1, so a pull stays within compatible releases:
docker compose pull
docker compose up -d
The web service applies its own schema migrations at startup. Migrations only move forward, so take a Postgres backup before a major upgrade. See Releases for tags and versioning.
Protect pairings and data
docker compose down -v deletes volumes, including the Evolution instances volume that holds every WhatsApp pairing and the Postgres volume that holds every user, connection, and token. Use docker compose down for a routine stop.
Back up Postgres regularly and restrict access to the backups, because they hold every stored connection credential. Keep TELEGRAM_SESSION_ENCRYPTION_KEY somewhere other than the backup, and never rotate it casually: changing it unlinks every Telegram account.
The app database
The web app creates and migrates its own app schema in the bundled Postgres on first boot, so there is no separate admin account or migration step. It holds users, sessions, organizations, connections, invitations, and connector-token hashes.
Connection credentials in this schema are not encrypted at rest. Treat the database, its volume, and its backups as holding every connected account.
Coming from PocketBase
Earlier versions stored users and connections in PocketBase. Deploy commit 2e1872e first; it imports every user, password, connection, and token into Postgres on first boot. Once the import is done, remove the PocketBase service and its volume.