Database password is hardcoded in installation script!

[plaffitt]

To Reproduce

$ curl -s https://dokploy.com/install.sh | grep amukds4wi9001583845717ad2
    --env POSTGRES_PASSWORD=amukds4wi9001583845717ad2 \

Current vs. Expected behavior

I would expect the password to be randomly generated or at least say something about it in https://docs.dokploy.com/docs/core/installation

Provide environment information

N/A

Which area(s) are affected? (Select all that apply)

Installation

Additional context

No response

[dennisimoo]

@Siumauricio

Is this a security threat?

[plaffitt]

No, it is just the database password, not very important.

[theoludwig]

Since I try to as much as possible to always read a script before executing it, I stumbled upon this and was surprised ah ah.
Then looked on GitHub, if someone indeed already reported it, and yep here it is.

But does that mean, that basically every Dokploy installation uses the same database password?

It's still not very good, should someone send a PR to fix this (by randomly generating the password)?
And is this password used/referenced somewhere else, if so where? Or this line in the script is enough to update this:

website/apps/website/public/install.sh

Line 154 in d0c5bf9

--env POSTGRES_PASSWORD=amukds4wi9001583845717ad2 \

Not really related, but I see that it still uses PostgreSQL v16. Is it safe to use a newer version, e.g: v18? I believe that newer installation should try to use up to date softwares.

[theoludwig]

And is this password used/referenced somewhere else, if so where?

Indeed, here is the default connection string:

https://github.com/Dokploy/dokploy/blob/1ce153371a8915d59586f27fde04b9c7da133e5a/apps/dokploy/server/db/index.ts#L9-L11

And here:

https://github.com/Dokploy/dokploy/blob/1ce153371a8915d59586f27fde04b9c7da133e5a/packages/server/src/setup/postgres-setup.ts#L15

So before starting dokploy, we need to define the DATABASE_URL with the defined password.

---

I updated the install script with the following enhancements:

• Use the POSTGRES_PASSWORD env variable if provided before running the script or generate one with POSTGRES_PASSWORD=$(openssl rand -base64 32 | tr -d '=') (I remove the = from base 64 to avoid issues with url encoding and it doesn't make the password more or less secure)
• Use the latest versions (as of 2025-11-05) of redis (v8.2.2), postgres (v18.0) and traefik (v3.5.4)
• Use image digests instead of tags for better reproductibility and avoid supply chain attacks, more information:
  • https://docs.docker.com/dhi/core-concepts/digests/
  • https://github.com/goldbergyoni/nodebestpractices/blob/master/sections/docker/image-tags.md
  • https://emmer.dev/blog/what-is-a-docker-digest/

#!/usr/bin/env bash

# Usage: ./install-dokploy.sh
# Install Dokploy: https://dokploy.com
# Edited from: https://github.com/Dokploy/website/blob/d0c5bf91abbcee8b29f0ff2c2301e6c294465e48/apps/website/public/install.sh

# Function to detect if running in Proxmox LXC container
is_proxmox_lxc() {
  # Check for LXC in environment
  if [ -n "$container" ] && [ "$container" = "lxc" ]; then
    return 0  # LXC container
  fi

  # Check for LXC in /proc/1/environ
  if grep -q "container=lxc" /proc/1/environ 2>/dev/null; then
    return 0  # LXC container
  fi

  return 1  # Not LXC
}

# Function to URL encode a string
url_encode() {
  local input="$1"
  local encoded=""
  local i
  local char_code

  for (( i=0; i<${#input}; i++ )); do
    char_code=$(printf '%d' "'${input:$i:1}")
    # Encode characters that are not unreserved (A-Z, a-z, 0-9, -, _, ., ~)
    # and also encode '%' which is used for encoding
    if (( char_code >= 48 && char_code <= 57 )) || \
       (( char_code >= 65 && char_code <= 90 )) || \
       (( char_code >= 97 && char_code <= 122 )) || \
       (( char_code == 45 )) || \
       (( char_code == 46 )) || \
       (( char_code == 95 )) || \
       (( char_code == 126 )); then
      encoded+="${input:$i:1}"
    else
      encoded+="$(printf '%%%02X' "$char_code")"
    fi
  done
  echo "$encoded"
}

install_dokploy() {
  if [ "$(id -u)" != "0" ]; then
    echo "This script must be run as root" >&2
    exit 1
  fi

  # check if is Mac OS
  if [ "$(uname)" = "Darwin" ]; then
    echo "This script must be run on Linux" >&2
    exit 1
  fi

  # check if is running inside a container
  if [ -f /.dockerenv ]; then
    echo "This script must be run on Linux" >&2
    exit 1
  fi

  # check if something is running on port 80
  if ss -tulnp | grep ':80 ' >/dev/null; then
    echo "Error: something is already running on port 80" >&2
    exit 1
  fi

  # check if something is running on port 443
  if ss -tulnp | grep ':443 ' >/dev/null; then
    echo "Error: something is already running on port 443" >&2
    exit 1
  fi

  command_exists() {
    command -v "$@" > /dev/null 2>&1
  }

  if command_exists docker; then
    echo "Docker already installed"
  else
    curl -sSL https://get.docker.com | sh
  fi

  # Check if running in Proxmox LXC container and set endpoint mode
  endpoint_mode=""
  if is_proxmox_lxc; then
    echo "⚠️ WARNING: Detected Proxmox LXC container environment!"
    echo "Adding --endpoint-mode dnsrr to Docker service for LXC compatibility."
    echo "This may affect service discovery but is required for LXC containers."
    echo ""
    endpoint_mode="--endpoint-mode dnsrr"
    echo "Waiting for 5 seconds before continuing..."
    sleep 5
  fi


  docker swarm leave --force 2>/dev/null

  get_ip() {
    local ip=""

    # Try IPv4 first
    # First attempt: ifconfig.io
    ip=$(curl -4s --connect-timeout 5 https://ifconfig.io 2>/dev/null)

    # Second attempt: icanhazip.com
    if [ -z "$ip" ]; then
      ip=$(curl -4s --connect-timeout 5 https://icanhazip.com 2>/dev/null)
    fi

    # Third attempt: ipecho.net
    if [ -z "$ip" ]; then
      ip=$(curl -4s --connect-timeout 5 https://ipecho.net/plain 2>/dev/null)
    fi

    # If no IPv4, try IPv6
    if [ -z "$ip" ]; then
      # Try IPv6 with ifconfig.io
      ip=$(curl -6s --connect-timeout 5 https://ifconfig.io 2>/dev/null)

      # Try IPv6 with icanhazip.com
      if [ -z "$ip" ]; then
        ip=$(curl -6s --connect-timeout 5 https://icanhazip.com 2>/dev/null)
      fi

      # Try IPv6 with ipecho.net
      if [ -z "$ip" ]; then
        ip=$(curl -6s --connect-timeout 5 https://ipecho.net/plain 2>/dev/null)
      fi
    fi

    if [ -z "$ip" ]; then
      echo "Error: Could not determine server IP address automatically (neither IPv4 nor IPv6)." >&2
      echo "Please set the ADVERTISE_ADDR environment variable manually." >&2
      echo "Example: export ADVERTISE_ADDR=<your-server-ip>" >&2
      exit 1
    fi

    echo "$ip"
  }

  get_private_ip() {
    ip addr show | grep -E "inet (192\.168\.|10\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[0-1]\.)" | head -n1 | awk '{print $2}' | cut -d/ -f1
  }

  advertise_addr="${ADVERTISE_ADDR:-$(get_private_ip)}"

  if [ -z "$advertise_addr" ]; then
    echo "ERROR: We couldn't find a private IP address."
    echo "Please set the ADVERTISE_ADDR environment variable manually."
    echo "Example: export ADVERTISE_ADDR=192.168.1.100"
    exit 1
  fi
  echo "Using advertise address: $advertise_addr"

  docker swarm init --advertise-addr "$advertise_addr"

  if [ $? -ne 0 ]; then
    echo "Error: Failed to initialize Docker Swarm" >&2
    exit 1
  fi

  echo "Swarm initialized"

  docker network rm -f dokploy-network 2>/dev/null
  docker network create --driver overlay --attachable dokploy-network

  echo "Network created"

  mkdir -p /etc/dokploy

  chmod 777 /etc/dokploy

  # Handle PostgreSQL password: use provided env var or generate one
  if [ -z "${POSTGRES_PASSWORD}" ]; then
    echo "POSTGRES_PASSWORD environment variable not set. Generating a random password..."
    POSTGRES_PASSWORD=$(openssl rand -base64 32 | tr -d '=')
    echo "Generated PostgreSQL password: ${POSTGRES_PASSWORD}"
    echo "Please keep this password secure. It is required for database access."
    echo ""
    echo "Waiting for 5 seconds before continuing..."
    sleep 5
  else
    echo "Using provided POSTGRES_PASSWORD environment variable."
    echo "Ensure your POSTGRES_PASSWORD is strong and secure."
  fi

  # URL encode the password for DATABASE_URL
  ENCODED_POSTGRES_PASSWORD=$(url_encode "$POSTGRES_PASSWORD")

  docker service create \
  --name dokploy-postgres \
  --constraint 'node.role==manager' \
  --network dokploy-network \
  --env POSTGRES_USER=dokploy \
  --env POSTGRES_DB=dokploy \
  --env POSTGRES_PASSWORD="${POSTGRES_PASSWORD}" \
  --mount type=volume,source=dokploy-postgres-database,target=/var/lib/postgresql \
  postgres:18.0@sha256:1ffc019dae94eca6b09a49ca67d37398951346de3c3d0cfe23d8d4ca33da83fb

  # Construct DATABASE_URL using the URL-encoded password
  DATABASE_URL="postgres://dokploy:${ENCODED_POSTGRES_PASSWORD}@dokploy-postgres:5432/dokploy"

  docker service create \
  --name dokploy-redis \
  --constraint 'node.role==manager' \
  --network dokploy-network \
  --mount type=volume,source=redis-data-volume,target=/data \
  redis:8.2.2@sha256:4521b581dbddea6e7d81f8fe95ede93f5648aaa66a9dacd581611bf6fe7527bd

  # Installation
  docker service create \
    --name dokploy \
    --replicas 1 \
    --network dokploy-network \
    --mount type=bind,source=/var/run/docker.sock,target=/var/run/docker.sock \
    --mount type=bind,source=/etc/dokploy,target=/etc/dokploy \
    --mount type=volume,source=dokploy-docker-config,target=/root/.docker \
    --publish published=3000,target=3000,mode=host \
    --update-parallelism 1 \
    --update-order stop-first \
    --constraint 'node.role == manager' \
    $endpoint_mode \
    -e ADVERTISE_ADDR="$advertise_addr" \
    -e DATABASE_URL="$DATABASE_URL" \
    -e PORT=3000 \
    dokploy/dokploy:v0.25.6@sha256:61f59f7355d853ddda65fcf9346c3d05faee171223d9899325bfce257dc0c044

  sleep 4

  docker run -d \
    --name dokploy-traefik \
    --restart unless-stopped \
    -v /etc/dokploy/traefik/traefik.yml:/etc/traefik/traefik.yml \
    -v /etc/dokploy/traefik/dynamic:/etc/dokploy/traefik/dynamic \
    -v /var/run/docker.sock:/var/run/docker.sock \
    -p 80:80/tcp \
    -p 443:443/tcp \
    -p 443:443/udp \
    traefik:v3.5.4@sha256:4df0a50fcf71b454c0d7ad17675776dc8d37359deae3291895bdaa008c1b9972

  docker network connect dokploy-network dokploy-traefik


  # Optional: Use docker service create instead of docker run
  #   docker service create \
  #     --name dokploy-traefik \
  #     --constraint 'node.role==manager' \
  #     --network dokploy-network \
  #     --mount type=bind,source=/etc/dokploy/traefik/traefik.yml,target=/etc/traefik/traefik.yml \
  #     --mount type=bind,source=/etc/dokploy/traefik/dynamic,target=/etc/dokploy/traefik/dynamic \
  #     --mount type=bind,source=/var/run/docker.sock,target=/var/run/docker.sock \
  #     --publish mode=host,published=443,target=443 \
  #     --publish mode=host,published=80,target=80 \
  #     --publish mode=host,published=443,target=443,protocol=udp \
  #     traefik:v3.5.0

  GREEN="\033[0;32m"
  YELLOW="\033[1;33m"
  BLUE="\033[0;34m"
  NC="\033[0m" # No Color

  format_ip_for_url() {
    local ip="$1"
    if echo "$ip" | grep -q ':'; then
      # IPv6
      echo "[${ip}]"
    else
      # IPv4
      echo "${ip}"
    fi
  }

  public_ip="${ADVERTISE_ADDR:-$(get_ip)}"
  formatted_addr=$(format_ip_for_url "$public_ip")
  echo ""
  printf "${GREEN}Congratulations, Dokploy is installed!${NC}\n"
  printf "${BLUE}Wait 15 seconds for the server to start${NC}\n"
  printf "${YELLOW}Please go to http://${formatted_addr}:3000${NC}\n\n"
}

update_dokploy() {
  echo "Updating Dokploy..."

  # Pull the latest image
  docker pull dokploy/dokploy:latest

  # Update the service
  docker service update --image dokploy/dokploy:latest dokploy

  echo "Dokploy has been updated to the latest version."
}

# Main script execution
if [ "$1" = "update" ]; then
  update_dokploy
else
  install_dokploy
fi