Deploy

Every deployment needs the same four things: the image ghcr.io/mapletechlabs/maple, a persistent volume at /data, the two secrets, and exactly one instance. For a plain docker run, see the quick start.

Docker Compose

Put the two secrets in a .env file next to compose.yaml:

# .env
MAPLE_LOCAL_INGEST_KEY=<ingest key>
MAPLE_LOCAL_ACCESS_TOKEN=<access token>

# compose.yaml
services:
    maple:
        image: ghcr.io/mapletechlabs/maple:latest
        ports:
            - "4318:4318"
        environment:
            MAPLE_LOCAL_INGEST_KEY: ${MAPLE_LOCAL_INGEST_KEY}
            MAPLE_LOCAL_ACCESS_TOKEN: ${MAPLE_LOCAL_ACCESS_TOKEN}
        volumes:
            - maple-data:/data
        stop_grace_period: 30s
        restart: unless-stopped

volumes:
    maple-data:

Then run docker compose up -d. On a machine reachable from the internet, change the port to "127.0.0.1:4318:4318" and put a reverse proxy in front. Where the docs show docker exec maple ..., use docker compose exec maple ... instead.

On a platform

Create a service from the image ghcr.io/mapletechlabs/maple:latest and give it:

• a persistent volume mounted at /data;
• the two secrets as environment variables;
• an HTTP health check on /health, which needs no credentials;
• exactly one instance. The store is a local database, so a second replica would not share it.

The server listens on $PORT when the platform sets one, and on 4318 otherwise. Platforms that terminate TLS for you work as is: the session cookie is marked Secure when the request arrives over HTTPS, and the dashboard works on whatever hostname the platform assigns.

Behind a reverse proxy

Put anything reachable from the internet behind TLS. On your own server, run a reverse proxy in front of port 4318. With Caddy, which gets a certificate for you, the whole config is:

maple.example.com {
	reverse_proxy localhost:4318
}

Any other proxy works too if it forwards the Host header unchanged and sets X-Forwarded-Proto. Then publish the container on loopback only (-p 127.0.0.1:4318:4318) so it is reachable only through the proxy.