Skip to main content

Install TOW

TOW ships as a small deployment kit: one Compose file, a guided installer, and the operations scripts. The application itself comes as prebuilt images from Docker Hub, so you never compile anything.

Requirements​

  • A Linux host with Docker Engine and the Compose plugin (Compose 2.24 or newer). 4 GB RAM recommended.
  • For production: a domain name and an SMTP relay for outgoing email (invites, verification, password recovery).
  • For backups (strongly recommended): age (apt install age) and systemd.

Install​

git clone https://github.com/theonlyworkspace/tow-deployment.git
cd tow-deployment
./install.sh

The installer asks how the deployment will be used and takes care of the rest:

  • Production or local evaluation. Evaluation brings TOW up on http://localhost:8080 with no further questions. Production asks for your domain and who terminates TLS.
  • Sign-in. Built-in email/password accounts, or the bundled authentik identity provider for SSO, MFA, and LDAP/SAML/OIDC.
  • Email and AI keys. Configure SMTP now or later; OpenAI and Exa keys are optional and can stay blank.
  • Backups. The installer offers to set up daily encrypted backups; say yes before real users arrive.
  • Account deletion. Production installs can continue straight into permanent account deletion setup (scripts/setup-erasure.sh) once backups exist.

Every secret is generated for you and written to .env (file mode 600). Runtime settings land in config/tow.yaml. Both files are yours: re-running ./install.sh never overwrites a value you have set, it only fills in keys a newer release introduced. Use ./install.sh --reconfigure to change your answers later.

First sign-in​

  • Built-in auth: open your TOW URL and register; the first account becomes the server administrator and first organisation owner.
  • authentik: sign in with the bootstrap admin (email you provided, password in AUTHENTIK_BOOTSTRAP_PASSWORD in .env). The first successful OIDC login becomes the server administrator.

Then work through the go-live checklist before opening the deployment to users.

Unattended installs​

Every question has a flag, so configuration management can run the installer non-interactively:

./install.sh --non-interactive --domain https://tow.example.com \
  --auth builtin --smtp-host smtp.example.com --with-backups

See ./install.sh --help for the full list.

Prefer to assemble the files by hand?​

Everything the installer writes is documented: .env.example explains every secret and config/tow.example.yaml every runtime setting, both in the deploy kit. Copy them to .env and config/tow.yaml, fill the empty values, and run docker compose up -d --wait. The runtime configuration page explains how the two files relate.

Next steps​