Docker Compose

System Requirements

Your system should meet the following minimum requirements:

• Memory: 1GB of RAM
• CPU: 1 Core

Install Docker

Docker is a containerization platform that allows you to quickly build, test, and deploy applications as portable, self-sufficient containers that can virtually run everywhere.

https://github.com/docker/docker-install

curl -fsSL https://get.docker.com -o get-docker.sh
sudo sh get-docker.sh

Docker Compose

Services

• Postgres: Database. Change POSTGRES_PASSWORD for security.
• ZeroTier: Zerotier Docker service.
• ZTNET: Main app, depends on both postgres and zerotier.

Setup

IMPORTANT

Change the NEXTAUTH_URL environment variable to the canonical URL or IP of your site. Example:

• If your server's IP address is 192.168.1.100, set NEXTAUTH_URL to http://192.168.1.100:3000.
• If you have a domain name, use it in place of the IP address.
• If you are using the HTTPS reverse proxy (Caddy) section below, NEXTAUTH_URL must use https:// (e.g. https://<YOUR-PUBLIC-HOST-NAME>, no port), matching the scheme your browser actually connects with. A scheme mismatch (http:// vs https://) will cause Better Auth to reject login requests with an Invalid origin error.

IMPORTANT

NEXTAUTH_SECRET must be a unique random value for your install. It signs logins and tokens, so a value copied from an example would let others forge them. Create it once in a .env file next to docker-compose.yml. Docker Compose reads that file automatically and refuses to start without it.

echo "NEXTAUTH_SECRET=$(openssl rand -hex 32)" >> .env

Create a docker-compose.yml file and populate it as follows:

services:
  postgres:
    image: postgres:15.2-alpine
    container_name: postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: ztnet
    volumes:
      - postgres-data:/var/lib/postgresql/data
    networks:
      - app-network

  zerotier:
    image: zyclonite/zerotier:1.14.2
    hostname: zerotier
    container_name: zerotier
    restart: unless-stopped
    volumes:
      - zerotier:/var/lib/zerotier-one
    cap_add:
      - NET_ADMIN
      - SYS_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    networks:
      - app-network
    ports:
      - "9993:9993/udp"
    environment:
      - ZT_OVERRIDE_LOCAL_CONF=true
      - ZT_ALLOW_MANAGEMENT_FROM=172.31.255.0/29

  ztnet:
    image: sinamics/ztnet:latest
    container_name: ztnet
    working_dir: /app
    volumes:
      - zerotier:/var/lib/zerotier-one
    restart: unless-stopped
    ports:
      - 3000:3000
    # - 127.0.0.1:3000:3000  <--- Use / Uncomment this line to restrict access to localhost only
    environment:
      POSTGRES_HOST: postgres
      POSTGRES_PORT: 5432
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: postgres
      POSTGRES_DB: ztnet
      NEXTAUTH_URL: "http://localhost:3000" # !! Important !! Set the NEXTAUTH_URL environment variable to the canonical URL or IP of your site with port 3000
      # !! Important !! NEXTAUTH_SECRET must be a unique random value. Create it once in a .env file next to this file:
      #   echo "NEXTAUTH_SECRET=$(openssl rand -hex 32)" >> .env
      # Updating an existing install? Keep the secret you already use, see https://ztnet.network/installation/docker-compose
      NEXTAUTH_SECRET: "${NEXTAUTH_SECRET:?Set NEXTAUTH_SECRET in a .env file next to docker-compose.yml, see https://ztnet.network/installation/docker-compose}"
      NEXTAUTH_URL_INTERNAL: "http://ztnet:3000" # Internal NextAuth URL for 'ztnet' container on port 3000. Do not change unless modifying container name.
    networks:
      - app-network
    links:
      - postgres
    depends_on:
      - postgres
      - zerotier

  ############################################################################
  #                                                                          #
  # Uncomment the section below to enable HTTPS reverse proxy with Caddy.    #
  #                                                                          #
  # Steps:                                                                   #
  # 1. Replace <YOUR-PUBLIC-HOST-NAME> with your actual public domain name.  #
  # 2. Uncomment the caddy_data volume definition in the volumes section.    #
  #                                                                          #
  ############################################################################

  # https-proxy:
  #   image: caddy:latest
  #   container_name: ztnet-https-proxy
  #   restart: unless-stopped
  #   depends_on:
  #     - ztnet
  #   command: caddy reverse-proxy --from <YOUR-PUBLIC-HOST-NAME> --to ztnet:3000
  #   volumes:
  #     - caddy_data:/data
  #   networks:
  #     - app-network
  #   links:
  #     - ztnet
  #   ports:
  #     - "80:80"
  #     - "443:443"

volumes:
  zerotier:
  postgres-data:
  # caddy_data:

networks:
  app-network:
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: 172.31.255.0/29

Instead of copy the docker-compose.yml file, you can also download it directly from the repository:

wget -O docker-compose.yml https://raw.githubusercontent.com/sinamics/ztnet/main/docker-compose.yml

To change the NEXTAUTH_URL in docker-compose.yml, you can use this command that will set the default server ip:

sed -i "s|http://localhost:3000|http://$(hostname -I | cut -d' ' -f1):3000|" docker-compose.yml

Before the first start, create the .env file with your NEXTAUTH_SECRET as described in Setup.

To launch ZTNET, execute the following command in your docker-compose.yml directory:

docker compose up -d

This action pulls necessary images, initializes the containers, and activates the services. Visit http://localhost:3000 to access the ZTNET web interface.

⚠️ NOTE

The first registered user automatically gains admin privileges. As an administrator, you possess unique capabilities not available to regular users. This includes the ability to view all registered accounts on the controller.

Please note that while admins have visibility over registered accounts, they cannot interact with or modify other users' networks directly. Each network's configuration and data remain exclusive to the respective user account, maintaining privacy and security for all users.

Updating ZTNET application

To update ZTNET, pull the latest image and restart the container.

If you are updating from a earlier version, make sure you set the NEXTAUTH_URL environment variable to the canonical URL or IP of your site. See Note above for more information about Installation Setup

docker compose pull
docker compose up -d

Keep your existing NEXTAUTH_SECRET when updating. Changing it signs every user out and invalidates two factor authentication and API tokens. If you replace your docker-compose.yml with the current version and your install used the old example value, add NEXTAUTH_SECRET=random_secret to .env so it keeps working. Moving to a unique secret is still recommended once you can accept users signing in again and setting up two factor authentication and API tokens again.

Application Logs

To view the ZTNET server logs:

docker compose logs -f ztnet

Ztnet Environment Variables

See Environment Variables for more information.