Governed database & API access,
built for engineers.

# Zero-config demo — open http://localhost:5173 and follow the setup wizard.
# Demo-only JWT / encryption keys are embedded in the file; generate your own
# for anything beyond evaluation (see docs/09-deployment.md).
services:
  postgres:
    image: postgres:18
    environment:
      POSTGRES_DB: accessflow
      POSTGRES_USER: accessflow
      POSTGRES_PASSWORD: accessflow

  redis:
    image: redis:8-alpine

  backend:
    image: ghcr.io/bablsoft/accessflow-backend:latest
    depends_on: [postgres, redis]
    environment:
      DB_URL: jdbc:postgresql://postgres:5432/accessflow
      REDIS_URL: redis://redis:6379
      ENCRYPTION_KEY: # 64-char hex, demo default embedded
      JWT_PRIVATE_KEY: # PKCS#8 PEM, demo default embedded
    ports: ["8080:8080"]

  frontend:
    image: ghcr.io/bablsoft/accessflow-frontend:latest
    depends_on: [backend]
    ports: ["5173:80"]

# helm repo add accessflow https://bablsoft.github.io/accessflow
# helm install accessflow accessflow/accessflow -n accessflow --create-namespace
# Encryption key, JWT key, and Postgres password are auto-generated on first install
# and preserved across upgrades — no Secrets need to be pre-created.
#
# Ready-made starting points for common shapes live under
#   charts/accessflow/examples/   (minimal, production, external-services, bootstrap, airgapped)

replicaCount:
  backend: 2
  frontend: 2

# Postgres + Redis ship as Bitnami subcharts — toggle off for managed services
postgresql:
  enabled: true
redis:
  enabled: true

# HPA + PDB are off by default — turn on for production
autoscaling:
  backend:
    enabled: false
    minReplicas: 2
    maxReplicas: 10

# Override only if you want to manage secrets externally
# (sealed-secrets, External Secrets, Vault, …):
# config:
#   encryptionKey: { existingSecret: my-secret, key: value }
#   jwtPrivateKey: { existingSecret: my-secret, key: jwt }

ingress:
  enabled: true
  className: nginx
  hosts:
    - host: accessflow.company.com
  # TLS is off by default — turn on and supply a Secret to terminate HTTPS
  tls:
    enabled: false

# clone
git clone https://github.com/bablsoft/accessflow.git
cd accessflow

# 1. infrastructure — Postgres 18 + Redis 8 + Mailcrab (dev-only compose)
docker compose -f backend/docker-compose-dev.yml up -d

# 2. backend — Java 25 · Spring Boot 4 · Maven
cd backend
./mvnw spring-boot:run

# 3. frontend — Node 24 · Vite 8 · React 19
cd ../frontend
npm install
npm run dev

# open http://localhost:5173 — the in-app setup wizard creates the first admin