Quickstart: self-host InfraAudit with Docker Compose

This guide gets InfraAudit running on your own machine using Docker Compose. You’ll end up with a working InfraAudit backend on http://localhost:8080, a frontend on http://localhost:5173, one connected AWS account, and one completed drift scan. Budget 15 to 30 minutes — most of it is the Supabase setup.

Before you start

Supabase project (required)

InfraAudit’s auth layer is backed by Supabase. The backend will not start without valid Supabase credentials. This is the most common place new self-hosters get stuck, so do this first.

Create a Supabase account

Go to supabase.com and create a free account.

Create a project

Create a new project. Any region works; the smallest tier is sufficient for development.

Copy your API credentials

Go to Project Settings → API and copy three values:

Project URL (e.g. https://xxxxxxxxxxxxxx.supabase.co) → SUPABASE_URL
anon public key → SUPABASE_ANON_KEY
service_role secret → SUPABASE_SERVICE_ROLE_KEY

Copy your JWT secret

Go to Project Settings → API → JWT Settings and copy the JWT Secret → SUPABASE_JWT_SECRET.

Keep these four values handy. You’ll paste them into .env shortly.

System requirements

Docker 24+ and Docker Compose v2
4 GB free RAM (8 GB if you enable the Prometheus/Grafana monitoring profile)
10 GB free disk

Gemini API key (optional)

If you want AI-generated recommendations rather than the rule-based fallback, grab a Gemini API key from ai.google.dev. The key is not required to start the stack.

Install and configure

Clone the repository

git clone https://github.com/pratik-mahalle/infraudit-go.git
cd infraudit-go

Create your .env file

cp .env.example .env

Open .env and fill in at minimum the following values:

# Supabase (required)
SUPABASE_URL=https://xxxxxxxxxxxxxx.supabase.co
SUPABASE_JWT_SECRET=your-jwt-secret-here
SUPABASE_ANON_KEY=eyJhbGciOi...
SUPABASE_SERVICE_ROLE_KEY=eyJhbGciOi...

# Server
SERVER_PORT=8080
FRONTEND_URL=http://localhost:5173
ENVIRONMENT=development

# Database (Docker Compose provisions this automatically)
DB_DRIVER=postgres
DB_HOST=postgres
DB_PORT=5432
DB_NAME=infraudit
DB_USER=infraudit
DB_PASSWORD=infraudit123
DB_SSLMODE=disable

# Encryption key for cloud credentials at rest
ENCRYPTION_KEY=change-me-32-byte-random-string-here

# Optional: Gemini AI recommendations
GEMINI_API_KEY=

# Optional: Slack notifications
SLACK_WEBHOOK_URL=
SLACK_CHANNEL=#alerts

Change ENCRYPTION_KEY before storing any real cloud credentials. Generate a secure value with openssl rand -hex 32. Also change DB_PASSWORD — the default is publicly known and must never reach production.

Start the stack

docker compose up -d

This starts four containers:

Service	Port	Purpose
`api`	8080	InfraAudit Go backend
`postgres`	5432	Primary database
`redis`	6379	Cache
`frontend`	5173	React web UI

Watch the logs until the API reports it’s ready:

docker compose logs -f api

If the API exits immediately with a Supabase error, double-check SUPABASE_URL and SUPABASE_JWT_SECRET. The process refuses to start without them.

Verify the health endpoints

curl http://localhost:8080/healthz
# {"status":"ok"}

curl http://localhost:8080/readyz
# {"status":"ready","database":"ok","redis":"ok"}

If database reports error, the Postgres container is still warming up. Wait 10 seconds and try again.

Open the UI

Go to http://localhost:5173 in your browser.

Create your account

Click Sign up and register with any email and password. Supabase stores the credentials; InfraAudit resolves the Supabase user on first login.

Land on the dashboard

You land on the dashboard. It’s empty because no providers are connected yet.

Connect your first cloud account

Web UI
CLI
API

Click Cloud Providers in the sidebar.
Click Connect AWS.
Paste your AWS access key ID, secret access key, and choose a region (e.g. us-east-1).
Click Connect. InfraAudit encrypts the credentials using your ENCRYPTION_KEY and kicks off an initial resource sync.

Install the CLI first — see Quickstart: CLI — then:

infraudit config init
# Enter server URL: http://localhost:8080

infraudit auth login

infraudit provider connect aws

curl -X POST http://localhost:8080/api/v1/providers/aws/connect \
  -H "Authorization: Bearer $INFRAUDIT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "AWS Production",
    "accessKeyId": "AKIA...",
    "secretAccessKey": "...",
    "region": "us-east-1"
  }'

The Bearer token is the Supabase access_token from signing in.

Run your first scan

Once the initial resource sync finishes (typically under a minute for a small account), trigger a drift scan:

CLI
API
Web UI

infraudit drift detect
infraudit drift list --severity critical
infraudit drift summary

curl -X POST http://localhost:8080/api/v1/drifts/detect \
  -H "Authorization: Bearer $INFRAUDIT_TOKEN"

Troubleshooting

The API container exits with 'SUPABASE_JWT_SECRET is required'

You skipped the Supabase setup or used the wrong variable name. Check .env against .env.example and make sure SUPABASE_JWT_SECRET is set.

I can log in on the frontend but API calls return 401

The frontend proxies through FRONTEND_URL but the API validates tokens against SUPABASE_URL. Make sure both point to the same Supabase project.

docker compose up says port 8080 is already in use

Another service is bound to that port. Change SERVER_PORT in .env and update the port mapping in docker-compose.yml to match.

Drift detection runs but never finds anything

Drift compares against baselines, and a fresh install has none yet. The first sync captures baselines automatically. Make a manual change to a resource in your cloud account and scan again to see drift appear.

What to do next

Enable vulnerability scans — run infraudit vuln scan or enable the scheduled job
Set up Slack alerts — add SLACK_WEBHOOK_URL to .env, restart the API, and configure notification preferences
Enable a compliance framework — run infraudit compliance enable cis-aws and then infraudit compliance assess
Review cost data — billing syncs daily by default; force an immediate sync with infraudit cost sync

Get Started

Platform

Integrations

Concepts

Self-Hosting

Resources

Quickstart: self-host InfraAudit with Docker Compose

Before you start

Supabase project (required)

System requirements

Gemini API key (optional)

Install and configure

Connect your first cloud account

Run your first scan

Troubleshooting

What to do next

​Before you start

​Supabase project (required)

​System requirements

​Gemini API key (optional)

​Install and configure

​First login

​Connect your first cloud account

​Run your first scan

​Troubleshooting

​What to do next

Before you start

Supabase project (required)

System requirements

Gemini API key (optional)

Install and configure

First login

Connect your first cloud account

Run your first scan

Troubleshooting

What to do next