Documentation

services:
  securecontext:
    image: ghcr.io/secure-context/gateway:latest
    ports:
      - "${SC_HTTP_PORT:-8080}:8080"
    environment:
      SC_DATABASE_DSN: postgres://${POSTGRES_USER:-securecontext}:${POSTGRES_PASSWORD:-securecontext}@postgres:5432/${POSTGRES_DB:-securecontext}?sslmode=disable
      # Hot-cache backend: "badger" (default, in-memory only) or "redis".
      # To use Redis instead, set SC_DATABASE_CACHE_BACKEND=redis and provide
      # SC_DATABASE_CACHE_REDIS_URL, for example:
      # redis://default:your-password@redis:6379/0
      SC_DATABASE_CACHE_BACKEND: ${SC_DATABASE_CACHE_BACKEND:-badger}
      SC_DATABASE_CACHE_REDIS_URL: ${SC_DATABASE_CACHE_REDIS_URL:-}
      # AES-256 key for encrypting stored connection secrets at rest.
      # Generate one with: openssl rand -base64 32
      # If SC_SECRETS_KEY is not set, stored secrets are kept without encryption.
      SC_SECRETS_KEY: ${SC_SECRETS_KEY}
      # Setup password used only for non-localhost access before SSO is configured.
      # Change this before exposing the service on a network.
      SC_SETUP_PASSWORD: ${SC_SETUP_PASSWORD:-admin}
      SC_LOG_LEVEL: ${SC_LOG_LEVEL:-info}
    depends_on:
      postgres:
        condition: service_healthy
    restart: unless-stopped

  postgres:
    image: postgres:16-alpine
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-securecontext}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-securecontext}
      POSTGRES_DB: ${POSTGRES_DB:-securecontext}
    volumes:
      - postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-securecontext} -d ${POSTGRES_DB:-securecontext}"]
      interval: 5s
      timeout: 5s
      retries: 5
    restart: unless-stopped

volumes:
  postgres_data:

mkdir -p securecontext-install
cd securecontext-install

# save docker-compose.yaml here

# optional overrides
# export SC_SECRETS_KEY=<base64-encoded-32-byte-key>
# export SC_SETUP_PASSWORD=<change-me-before-remote-access>
# export POSTGRES_PASSWORD=<change-me>
# export SC_DATABASE_DSN=postgres://db-user:db-password@your-postgres-endpoint:5432/securecontext?sslmode=require
# export SC_DATABASE_CACHE_BACKEND=redis
# export SC_DATABASE_CACHE_REDIS_URL=redis://default:redis-password@your-redis-endpoint:6379/0

docker compose up -d
docker compose ps
docker compose logs securecontext --tail 100
curl http://localhost:8080/healthz

Admin UI
http://localhost:8080/admin/

Health check
http://localhost:8080/healthz

MCP metadata
http://localhost:8080/.well-known/mcp

MCP endpoint
http://localhost:8080/mcp

Local setup URL
http://localhost:8080/admin/setup

Remote setup URL
https://<your-host>/admin/setup

connectors:
  - type: bedrock
    name: "AI Models"
    config:
      region: "us-east-1"
      model_id: "anthropic.claude-v2"
      
      # IAM role to assume (recommended)
      assume_role_arn: "arn:aws:iam::123456789:role/SecureContextBedrock"
      
      # Or use instance profile / environment credentials
      # use_default_credentials: true

connectors:
  - type: amazon-q-business
    name: "Company Knowledge"
    config:
      application_id: "your-q-application-id"
      region: "us-east-1"
      
      # IAM role with Q Business permissions
      assume_role_arn: "arn:aws:iam::123456789:role/SecureContextQ"

connectors:
  - type: slack
    name: "Slack"
    config:
      # Bot OAuth token (xoxb-...)
      token: "${SLACK_BOT_TOKEN}"
      
      # Restrict to specific channels (optional)
      allowed_channels:
        - "engineering"
        - "incidents"
        - "product"
      
      # Enable search and posting
      capabilities:
        - search
        - read_messages
        - post_messages  # optional

connectors:
  - type: jira
    name: "Jira"
    config:
      base_url: "https://acme.atlassian.net"
      
      # API token authentication
      email: "${JIRA_EMAIL}"
      api_token: "${JIRA_API_TOKEN}"
      
      # Restrict to specific projects
      allowed_projects:
        - "PAYMENTS"
        - "PLATFORM"
        - "INFRA"
      
      capabilities:
        - search
        - read_issues
        - create_issues
        - update_issues

SC_DATABASE_DSN=postgres://db-user:db-password@<cloud-sql-or-postgres-host>:5432/securecontext?sslmode=disable
SC_SECRETS_KEY=<base64-encoded-32-byte-key>
SC_SETUP_PASSWORD=<change-me-before-remote-access>
SC_LOG_LEVEL=info

# Optional: switch the hot cache to Redis
SC_DATABASE_CACHE_BACKEND=redis
SC_DATABASE_CACHE_REDIS_URL=redis://default:redis-password@<redis-host>:6379/0

# Optional: remote admin and remote MCP auth
SC_OAUTH_ISSUER_URL=https://accounts.google.com
SC_OAUTH_CLIENT_ID=<google-oauth-client-id>
SC_OAUTH_CLIENT_SECRET=<google-oauth-client-secret>
SC_OAUTH_SCOPES=openid profile email

gcloud services enable \
  iam.googleapis.com \
  iamcredentials.googleapis.com \
  run.googleapis.com \
  artifactregistry.googleapis.com \
  serviceusage.googleapis.com \
  --project <PROJECT_ID>

gcloud run deploy securecontext-gateway \
  --image <securecontext-gateway-image> \
  --region us-central1 \
  --port 8080 \
  --allow-unauthenticated

At minimum, your Cloud Run service should provide:
- SC_DATABASE_DSN
- SC_SECRETS_KEY
- SC_SETUP_PASSWORD

Optional values:
- SC_DATABASE_CACHE_BACKEND=redis
- SC_DATABASE_CACHE_REDIS_URL
- SC_OAUTH_ISSUER_URL
- SC_OAUTH_CLIENT_ID
- SC_OAUTH_CLIENT_SECRET
- SC_OAUTH_SCOPES

SC_HTTP_PORT=8080
POSTGRES_USER=securecontext
POSTGRES_DB=securecontext
POSTGRES_PASSWORD=change-me
SC_SECRETS_KEY=<base64-encoded-32-byte-key>
SC_SETUP_PASSWORD=change-me-before-remote-access

# Replace the bundled Postgres service with RDS
SC_DATABASE_DSN=postgres://db-user:db-password@your-rds-endpoint:5432/securecontext?sslmode=require

# Optional: switch the hot cache to Redis or ElastiCache
SC_DATABASE_CACHE_BACKEND=redis
SC_DATABASE_CACHE_REDIS_URL=redis://default:redis-password@your-elasticache-endpoint:6379/0

# Optional: load the encryption key from a mounted file instead of a plain env var
SC_SECRETS_KEY_FILE=/run/secrets/securecontext-secrets-key

# Copy the docker-compose.yaml from the docs page into a local file first,
# then upload it to your host.
scp docker-compose.yaml ec2-user@<ec2-host>:/opt/securecontext/

Set these values before you start the stack:
- SC_SECRETS_KEY
- SC_SETUP_PASSWORD
- POSTGRES_PASSWORD

If you use RDS, also set:
- SC_DATABASE_DSN

If you use Redis, also set:
- SC_DATABASE_CACHE_BACKEND=redis
- SC_DATABASE_CACHE_REDIS_URL

docker compose up -d
docker compose ps
docker compose logs securecontext --tail 100

SC_DATABASE_DSN=postgres://db-user:db-password@<azure-postgres-host>:5432/securecontext?sslmode=require
SC_SECRETS_KEY=<base64-encoded-32-byte-key>
SC_SETUP_PASSWORD=<change-me-before-remote-access>
SC_LOG_LEVEL=info

# Optional: switch the hot cache to Redis
SC_DATABASE_CACHE_BACKEND=redis
SC_DATABASE_CACHE_REDIS_URL=redis://default:redis-password@<redis-host>:6379/0

# Optional: remote admin and remote MCP auth
SC_OAUTH_ISSUER_URL=https://login.microsoftonline.com/<tenant-id>/v2.0
SC_OAUTH_CLIENT_ID=<oauth-client-id>
SC_OAUTH_CLIENT_SECRET=<oauth-client-secret>
SC_OAUTH_SCOPES=openid profile email

az containerapp create \
  --name securecontext-gateway \
  --resource-group <RESOURCE_GROUP> \
  --environment <ENV_NAME> \
  --image <securecontext-gateway-image> \
  --target-port 8080 \
  --ingress external

Required values:
- SC_DATABASE_DSN
- SC_SECRETS_KEY
- SC_SETUP_PASSWORD

Optional values:
- SC_DATABASE_CACHE_BACKEND=redis
- SC_DATABASE_CACHE_REDIS_URL
- SC_OAUTH_ISSUER_URL
- SC_OAUTH_CLIENT_ID
- SC_OAUTH_CLIENT_SECRET
- SC_OAUTH_SCOPES

Use Azure Database for PostgreSQL for production-style deployments.

Leave Redis unset for a simpler deployment, or add Azure Cache for Redis and
switch to:
- SC_DATABASE_CACHE_BACKEND=redis
- SC_DATABASE_CACHE_REDIS_URL