Amnezia VPN Manager.

name: amnezia-vpn-manager

services:
  web:
    image: registry.kadnikoff.ru/amnezia-vpn-manager:1.1.4@sha256:d670db9e1ae3f17ab1deb9594a04e635a3506679cd2aef9ede51ea0f77bf8a10
    restart: unless-stopped
    ports:
      - "127.0.0.1:5097:8080"
    environment:
      ASPNETCORE_ENVIRONMENT: Production
      ASPNETCORE_FORWARDEDHEADERS_ENABLED: "true"
      Inventory__DatabasePath: /app/data/inventory.db
      Inventory__KeyRingPath: /app/keys
      Inventory__SeedDemoData: "false"
      Auth__Username: ${AVM_AUTH_USERNAME:-admin}
      Auth__Password: ${AVM_AUTH_PASSWORD:?Set your own AVM_AUTH_PASSWORD in .env}
      Auth__FirstName: ${AVM_AUTH_FIRST_NAME:-System}
      Auth__LastName: ${AVM_AUTH_LAST_NAME:-Administrator}
      Monitoring__TimeZone: ${AVM_TIME_ZONE:-Europe/Saratov}
    volumes:
      - inventory_data:/app/data
      - keyring_data:/app/keys
    read_only: true
    tmpfs:
      - /tmp:size=64m,mode=1777
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    mem_limit: 512m
    pids_limit: 256
    healthcheck:
      test:
        - CMD
        - bash
        - -ec
        - >-
          exec 3<>/dev/tcp/127.0.0.1/8080;
          printf 'GET /Account/Login HTTP/1.0\r\nHost: localhost\r\n\r\n' >&3;
          read -r line <&3;
          [[ "$$line" == *" 200 "* ]]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s

volumes:
  inventory_data:
  keyring_data:

# Copy to .env and set your own long random password before starting.
AVM_AUTH_USERNAME=admin
AVM_AUTH_PASSWORD=
AVM_AUTH_FIRST_NAME=System
AVM_AUTH_LAST_NAME=Administrator
AVM_TIME_ZONE=Europe/Saratov

# Amnezia VPN Manager 1.1.4

Install and run Amnezia VPN Manager with Docker on Linux amd64.

## Installation

You need Docker Engine and Docker Compose.

Save `compose.yaml` and `.env.example` from this page in a separate folder,
or extract the Docker Compose bundle into it. Run the following commands
from that folder.

Copy `.env.example` to `.env`:

```bash
cp .env.example .env
```

Open `.env` and set your own long, random `AVM_AUTH_PASSWORD`.
The application will not start with an empty password.
You can also change the username in `AVM_AUTH_USERNAME`.

Start the application and check its status:

```bash
docker compose up -d
docker compose ps
```

## Open the application

Open <http://127.0.0.1:5097> and sign in with the credentials from `.env`.

If you installed the application on a VPS, run this on your computer:

```bash
ssh -N -L 5097:127.0.0.1:5097 USER@SERVER
```

Replace `USER` and `SERVER` with your server's username and address.
Keep the SSH tunnel running and open <http://127.0.0.1:5097>
in your computer's browser.

For permanent access through a domain, configure an HTTPS reverse proxy.
By default, the application is accessible only on the computer running it.

## Keep your data

Application data is stored in the `inventory_data` volume; encryption keys
are stored in `keyring_data`. Keep both volumes when upgrading or backing up.
The `docker compose down` command preserves them. The `-v` flag deletes data.

After installation, add your servers, SSH keys, VPN profiles and users
in the application.