Requirements

Vaultigen runs on an ordinary Linux server that you control. It does not need an external key service or a connection to its vendor. Choose one of two installation routes; the requirements differ only on the host.

Docker Compose installation (recommended)

• A 64-bit x86 (AMD64) Linux host, virtual machine or bare metal. One small VM is enough for most organizations. ARM64 is not supported yet.
• Docker Engine with the Docker Compose plugin (2.24.4 or later if you use the reverse-proxy override).
• A hostname with a DNS record for the server, and inbound ports 80 and 443 for automatic HTTPS, or an existing reverse proxy that terminates HTTPS.
• Disk space for the database, attachments and backup sets. A backup needs room for a temporary snapshot and the finished set at the same time; local deletion of old sets is off unless you enable it.
• Outbound access to Docker Hub (images), the certificate authority used by automatic HTTPS (Let’s Encrypt or ZeroSSL), and your mail server.
• An accurate clock (systemd-timesyncd, chrony or another NTP client).
• sudo on the host, to copy the key folder and backups that belong to the container users.

The image contains PHP 8.5, every required extension, the web server and the database tools. The Compose stack always uses its bundled PostgreSQL 18. You do not install PHP, Composer, Node.js, a web server or a database on the host.

Manual installation

Server

• A Linux host (virtual machine or bare metal) that you control. One small VM is enough for most organizations.
• A web server such as nginx, Apache or Caddy, terminating HTTPS. Vaultigen is not meant to be served over plain HTTP in production.
• A process supervisor (systemd, supervisord or equivalent) for the queue worker and the scheduler.
• An accurate clock. Run systemd-timesyncd, chrony or another NTP client: one-time codes, grant expiry and audit timestamps depend on it.

PHP

• PHP 8.5 with the extensions Laravel needs, plus:
  • sodium (required; there is no fallback cipher),
  • gd with JPEG, PNG, GIF and WebP support, to resize uploaded vault images,
  • pdo_pgsql, pdo_mysql or pdo_sqlite for your database.
• Composer 2.
• upload_max_filesize and post_max_size of at least 25 MB (the default attachment limit).

Build tools

• Node.js 22.12 or newer with npm, to build the front-end assets during installation and upgrades. Node.js is not needed at runtime.

Database

Engine	Recommendation
PostgreSQL	Recommended for production. Best concurrency and the cleanest operational story.
MySQL 8.4+ / MariaDB 11.4+	Fully supported. Use InnoDB.
SQLite	Supported for small installations with one application instance and one queue worker. Keep the file on a local disk, never on a network filesystem.

Backups use the database’s own snapshot tools, so install them on the server: pg_dump and psql for PostgreSQL, mysqldump/mariadb-dump and the mysql client for MySQL/MariaDB. SQLite needs nothing extra.

Mail

Vaultigen sends invitations, email sign-in codes and security notifications. Configure any SMTP server or a Laravel-supported mail transport. Without working mail, invitations cannot be delivered and security notifications stay pending.

Network

• Inbound: HTTPS from your users (with Docker Compose also HTTP on port 80 for certificate issuance and the redirect).
• Outbound: your mail server. The Docker route also needs Docker Hub and the certificate authority, as listed above. Vaultigen never contacts its vendor.
• Optional: the site icons feature fetches the icon of a login’s website directly from that site. You can turn it off under Settings if your egress policy forbids it.

Browsers

Any current version of Firefox, Chrome, Edge or Safari. The password generator uses the browser’s Web Crypto API.