Installation
Install the VAC control plane — interactive or unattended — and every option you can pass it.
VAC installs from a single shell script that pulls the prebuilt compose stack, generates secrets, and brings the three control-plane containers up. The same command upgrades an existing install in place.
Requirements
- A Linux host (x86-64 or arm64). Debian 12 / Ubuntu 22.04+ are the tested targets.
- Docker Engine with the Compose v2 plugin. If Docker is missing, the installer offers to install it via
get.docker.com. - Root or
sudo. The installer writes to/opt/vac,/usr/local/bin, and (optionally) installs a systemd timer. - Ports 80 and 443 reachable from the internet if you want HTTPS via a domain. The dashboard's own port (9393) only needs to be reachable from where you administer the box.
Install
curl -sSL get.vac.vojir.io | sudo shIn a terminal, the installer runs an interactive wizard (domain, managed services, container shell, security agent, sudo-free access) and prints a summary before touching the host. Piped without a terminal, it runs unattended with safe defaults — ideal for cloud-init or provisioning scripts.
When it finishes it prints the dashboard URL and a one-time setup link for creating your first operator account.
Unattended / pinned installs
Pre-set any knob with an environment variable and the installer skips the matching prompt.
That's what keeps curl | sh fully non-interactive for automation:
VAC_VERSION=v0.5.0 VAC_DOMAIN=example.com VAC_MANAGED_SERVICES=true sh install.sh --yesInstaller flags
| Flag | Effect |
|---|---|
--yes, -y | Accept all defaults; never prompt (even in a terminal). |
--grant | Add the invoking sudo user to the docker group so they can run vac without sudo. This is the default. |
--no-grant | Keep VAC root-only; don't touch group membership. |
-h, --help | Show help and exit. |
Configuration via environment variables
Set these before running the installer to override defaults (and skip their wizard questions).
They're persisted to /opt/vac/.env.
| Variable | Default | Purpose |
|---|---|---|
VAC_VERSION | latest | Image tag to pull. On a fresh install the installer pins the real version it resolved. |
VAC_DOMAIN | (empty) | Base domain. When set, the dashboard moves to https://vac.<domain> and each app gets a {app}.<domain> subdomain. Empty keeps everything on http://<host>:9393. |
VAC_INSTALL_DIR | /opt/vac | Where the compose file, .env, and uninstall script live. |
VAC_HOST_PORT | 9393 | Host port for the dashboard. (vac-proxy still binds 80/443 for app ingress.) |
VAC_REGISTRY | ghcr.io/vojir-mikulas | OCI registry the images are pulled from. |
VAC_MANAGED_SERVICES | false | Enable backups, managed databases, and the add-on catalog. Off means zero footprint for those features. |
VAC_ENABLE_SHELL | false | Allow a root-capable interactive shell into app containers from the dashboard. |
VAC_SECURITY_AGENT | false | Install a read-only host agent that snapshots fail2ban/firewall posture for the dashboard. |
VAC_GRANT_ACCESS | 1 | When invoked via sudo, grant that user docker-group access. Same as --grant / --no-grant. |
These are the install-time essentials. The full set of runtime tunables — log retention, health-check timeouts, crash-loop thresholds, notification URLs, metrics token — lives in .env. See the annotated .env.example in the repository for every option and its default.
What gets installed
/opt/vac/—compose.prod.yaml, the generated.env(mode0600), anduninstall.sh.- The compose stack — three containers:
vac-db(Postgres 16),vac-api(the Go control plane + deploy worker), andvac-proxy(Caddy). See Architecture. /usr/local/bin/vac— a small host-ops wrapper arounddocker compose. See CLI commands.- Generated secrets —
VAC_MASTER_KEY(32 bytes hex) andVAC_DB_PASSWORD, written once to.envand preserved across upgrades. - (Optional) a
vac-security-agentsystemd timer ifVAC_SECURITY_AGENTis on.
VAC_MASTER_KEY encrypts every secret VAC stores — env vars, deploy keys, TOTP secrets, webhook URLs. If you lose it, those values are unrecoverable. Keep a copy of /opt/vac/.env somewhere safe and separate. See Disaster recovery.
Accessing the dashboard
- With a domain:
https://vac.<domain>once DNS resolves and Caddy issues the cert.http://<host>:9393keeps working as a recovery fallback. - Without a domain:
http://<host>:9393. The UI shows a banner reminding you the connection isn't encrypted.
You can set or change the domain later without reinstalling — see vac set-domain.
Upgrading and uninstalling
Re-running the installer upgrades images in place and preserves your secrets and config. For
the day-to-day path and what's preserved, see Updates & upgrades.
To remove VAC, use vac uninstall (tiered, safe by default) — covered in CLI commands.