Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
99 commits
Select commit Hold shift + click to select a range
2f7a103
add vagrant to test script
davidbeig Oct 16, 2025
f0d9789
add compose files
davidbeig Oct 16, 2025
8940ca0
add initial scripts
davidbeig Oct 16, 2025
fc2ca20
generate SECRET_KEY_BASE
davidbeig Oct 16, 2025
51f9238
add memory to Vagrant
davidbeig Oct 21, 2025
38fc814
add traefik domain and fix default decidim_image
davidbeig Oct 21, 2025
32e3f9b
add pull_policy always to worker
davidbeig Oct 21, 2025
e9d262e
add storage to handle volume in app if not bucket
davidbeig Oct 21, 2025
5181c5f
change how to handle repository path
davidbeig Oct 21, 2025
fe067ac
add migration execution on app entrypoint
davidbeig Oct 21, 2025
1e9a000
fix up script to handle local database and local storage
davidbeig Oct 21, 2025
e0b7bd5
change local database to generate user, password and database name
davidbeig Oct 21, 2025
ca858ad
add script to generate gemfiles
davidbeig Oct 23, 2025
f2955bd
add alpine versions for cache and db
davidbeig Oct 23, 2025
32009ec
generate vapid keys
davidbeig Oct 29, 2025
97c3ffb
make docker script exit after installing
davidbeig Oct 29, 2025
acc8327
pull decidim image when deciding version
davidbeig Oct 29, 2025
4035540
git clone repository to repository path
davidbeig Oct 29, 2025
e550ea6
fix on decidim version script
davidbeig Oct 29, 2025
be2ca79
change docker installation process
davidbeig Oct 29, 2025
174af9e
fix on variable assignment
davidbeig Oct 29, 2025
434d6ba
fix use of variable
davidbeig Oct 29, 2025
4917f61
add volumes for Gemfile.wrapper and Gemfile.local
davidbeig Oct 30, 2025
a47284b
read from /dev/tty
davidbeig Nov 13, 2025
c0168d1
check before deleting .env file
davidbeig Nov 24, 2025
1773cf8
ask before openning ports
davidbeig Nov 24, 2025
03553cd
fix parameters passed to docker compose
davidbeig Nov 24, 2025
dc42a99
don't exit on open_ports script
davidbeig Nov 24, 2025
5c15d5d
fix volumes on app.yml
davidbeig Nov 24, 2025
fa87b32
change bash errors
davidbeig Nov 24, 2025
4cad4c7
update traefik version
davidbeig Nov 24, 2025
4c2ca22
fix use of sidekiq_entrypoint
davidbeig Nov 24, 2025
7921196
fix on entrypoints paths
davidbeig Nov 24, 2025
6cc99b8
make scripts executable
davidbeig Nov 24, 2025
add55e3
make entrypoints execute bundle install
davidbeig Nov 24, 2025
2feb6f7
remove sudo from entrypoints
davidbeig Nov 24, 2025
a30dcb5
change database env variables
davidbeig Nov 24, 2025
9ddd38f
change password generated base
davidbeig Nov 24, 2025
0adb8ed
update composes
davidbeig Nov 24, 2025
a144c41
fix commands
davidbeig Nov 24, 2025
1408e79
fix reference passed to exec
davidbeig Nov 24, 2025
87796f2
remove network mode
davidbeig Nov 24, 2025
59c7f59
move scripts and add action to build release zip
davidbeig Nov 26, 2025
74c7c9c
move scripts to install folder
davidbeig Nov 26, 2025
907f171
add log debug to traefik
davidbeig Nov 27, 2025
fb9d9fa
exit if not a correct distribution
davidbeig Nov 27, 2025
b1e12ff
add container name
davidbeig Nov 27, 2025
94a9f10
add keys for s3-compatible buckets
davidbeig Nov 27, 2025
5c206ee
script to create system admin
davidbeig Nov 27, 2025
4fdfe3e
add redis_url env
davidbeig Nov 27, 2025
661dacb
remove env for system admin
davidbeig Nov 27, 2025
783c6fd
unify composes
davidbeig Nov 27, 2025
cc10b73
some fixes
davidbeig Nov 27, 2025
c480654
add certificates and make worker wait for app first
davidbeig Nov 28, 2025
fd55517
fixes on aws variables
davidbeig Nov 28, 2025
6cd940b
remove wait for healthy
davidbeig Dec 3, 2025
df615ea
add interactivity to some missing commands
davidbeig Dec 3, 2025
5d3a4f7
update README
davidbeig Dec 9, 2025
a7d459c
clean up a bit
davidbeig Dec 9, 2025
2100eb9
add sidekiq config
davidbeig Dec 11, 2025
f828cdb
add some readme documentation
davidbeig Dec 11, 2025
9a4fc1d
shell linting
davidbeig Dec 11, 2025
553c013
remove vagrantfile
davidbeig Dec 16, 2025
a65ab0b
improve messages to choose decidim version
davidbeig Dec 16, 2025
5ec5764
add more context to vapid and export vars
davidbeig Dec 16, 2025
712467f
change check of decidim running to create system admin
davidbeig Dec 16, 2025
6750e1c
Improve messages and flow of docker installation
davidbeig Dec 16, 2025
dccb70b
change messages of up.sh
davidbeig Dec 16, 2025
26ebc1f
add new messages and bash fixes
davidbeig Dec 16, 2025
e581b92
refactor and add maps envs
davidbeig Dec 16, 2025
b23a5ad
remove env var
davidbeig Dec 16, 2025
5344a7b
shellcheck fixes
davidbeig Dec 16, 2025
d83e3c9
shellcheck 1091
davidbeig Dec 16, 2025
3931590
disable sc1091
davidbeig Dec 16, 2025
96ac72f
fixes on certs and health_check
davidbeig Dec 18, 2025
7aa5159
update release zip url
davidbeig Dec 18, 2025
5fa1536
improve and fix zip download
davidbeig Dec 18, 2025
75b462c
force overrite of extracted files
davidbeig Dec 22, 2025
94513a0
add minor improvements
davidbeig Dec 22, 2025
4a665e0
remove pull_policy
davidbeig Dec 22, 2025
9e7b7b8
open ports by default
davidbeig Dec 22, 2025
4e8a722
remove option to change decidim version, only install latest
davidbeig Dec 22, 2025
fc3ed3a
automatically create system password
davidbeig Dec 22, 2025
02ac09f
fix generate system
davidbeig Jan 7, 2026
b951095
fix typos
davidbeig Jan 22, 2026
3a84f5b
Update install/scripts/entrypoint.sh
davidbeig Jan 22, 2026
2bce55a
Update install/install.sh
davidbeig Jan 22, 2026
fc9dd76
Update install/up.sh
davidbeig Jan 22, 2026
8cf9f5a
Update install/install.sh
davidbeig Jan 22, 2026
b9e5941
Update install/up.sh
davidbeig Jan 22, 2026
f698509
Update install/install.sh
davidbeig Jan 22, 2026
c18e59e
Update install/dependencies/build_env.sh
davidbeig Jan 22, 2026
47b2a83
Update install/dependencies/os_version.sh
davidbeig Jan 22, 2026
36720e7
Update install/dependencies/generate_vapid_keys.sh
davidbeig Jan 22, 2026
1107d92
Update install/dependencies/build_env.sh
davidbeig Jan 22, 2026
1d81403
apply fixes by coderabbit
davidbeig Jan 22, 2026
66e0d91
more fixes
davidbeig Jan 22, 2026
468432b
add install readme
davidbeig Jan 22, 2026
4da520b
fix typos in readme
davidbeig Jan 23, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions .github/workflows/build_install_folder.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
name: Build Deployment Zip

on:
push:
branches:
- main
workflow_dispatch:
Comment on lines +3 to +7
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

cat -n .github/workflows/build_install_folder.yml

Repository: decidim/docker

Length of output: 172


🌐 Web query:

softprops/action-gh-release requirements tag ref behavior

💡 Result:

Summary of softprops/action-gh-release tag/ref behavior and requirements

  • tag_name input: defaults to github.ref (the workflow ref). Use the tag name you want with with.tag_name. Documentation shows tag_name defaults to github.ref. [1]
  • Expectation: the action is intended to run for tag pushes (refs/tags/*). README recommends gating the step or event to tag pushes (e.g., if: startsWith(github.ref, 'refs/tags/')). [1][2]
  • Practical requirement: the tag you reference must exist in the repository (a push of a tag or an explicit tag object). If you pass a tag_name that does not exist (or run the action on a branch ref), the release API call can fail (examples/issues show 403/failed release when using tag_name like "latest" without an actual tag). [2]
  • If you need to create a release for a branch commit, create a tag first (or ensure tag_name points to an existing tag/sha) before invoking the action. Alternatively, gate the action to tag pushes so github.ref will be a tag ref. [1][2]

Sources:
[1] softprops/action-gh-release README (usage, tag_name default and tag-gating).
[2] softprops/action-gh-release GitHub issue reporting failures when using non-existing tag_name (example "latest").


🏁 Script executed:

git ls-files | grep -E "\.github/workflows"

Repository: decidim/docker

Length of output: 132


Release step will fail on branch pushes without proper tag handling.

softprops/action-gh-release defaults tag_name to github.ref and requires an actual tag ref. Since this workflow triggers on push: branches: [main], the release step at lines 21-24 will fail with a failed release API call when invoked on branch pushes. Gate the release step with if: startsWith(github.ref, 'refs/tags/') or restrict the trigger to tag pushes only (e.g., on: push: tags: ['v*']).

🔧 Proposed fix (tag-only release)
-on:
-  push:
-    branches:
-      - main
+on:
+  push:
+    tags:
+      - 'v*'
   workflow_dispatch:

Or add a conditional gate to the release step:

       - name: Release
+        if: startsWith(github.ref, 'refs/tags/')
         uses: softprops/action-gh-release@v2
🤖 Prompt for AI Agents
In @.github/workflows/build_install_folder.yml around lines 3 - 7, The release
step using softprops/action-gh-release is vulnerable because tag_name defaults
to github.ref and the workflow is triggered on branch pushes; either restrict
the workflow trigger to tag pushes (e.g., change on: push to push: tags: ['v*'])
or add a conditional on the release job/step (use if: startsWith(github.ref,
'refs/tags/')) so the softprops/action-gh-release step (the step invoking
softprops/action-gh-release and setting tag_name) only runs for tag refs.


jobs:
build:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v4

- name: Create deployment ZIP
run: |
zip -r deploy_bundle.zip \
install/ \

- name: Release
uses: softprops/action-gh-release@v2
with:
files: deploy_bundle.zip
66 changes: 66 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -101,3 +101,69 @@ sudo chown -R $(whoami): ${APP_NAME}
```

From here on you can follow the steps on the [Getting Started](https://docs.decidim.org/en/install/) guide.

## Using a production deploy script

We've been working on a script that you can use to have a fully functional, production-ready decidim instance.

```bash
curl -fsSL https://decidim.org/install | bash
```

It will install the necessary tools to make decidim work on your server.

- Docker
- unzip
- UFW

The application will be hosted in the `/opt/decidim` directory by default, even though you can change it with `REPOSITORY_PATH` environment variable.

## App - Main Decidim Web Application
The app itself will be the container with the base image you decide (By default is the latest Decidim version: `decidim/decidim:latest`). You can change it with the `DECIDIM_IMAGE` environment variable.

This is the front-end web process users access in the browser.

## Worker
The worker will be the one responsible for all the background jobs that the application needs to run.

## Cache
The app needs a cache server. This will be a `redis:8-alpine` instance. This cache will be used both by the app and the worker.

## Database

The application needs a database to run. Through the installation process you will be asked if you have an already working database, if not, you will have a postgres container with all the schema and migrations run (It will be a `postgres:17-alpine`)

## Configuration

To configure the application you will have to answer some questions that will, at the end, generate a `.env` file.

### Environment Variables Reference

To see the full list of Decidim Environment Variables, and that you can add to your generated `.env` file, you can take a look at the official [documentation](https://docs.decidim.org/en/develop/configure/environment_variables)

| Variable | Default | Used In | Description |
|----------|---------|---------|-------------|
| **BUNDLE_GEMFILE** | `Gemfile.wrapper` | app, worker | Selects which Gemfile the container should use. |
| **DECIDIM_IMAGE** | `decidim/decidim:latest` | app, worker | Overrides the Decidim Docker image version. |
| **DECIDIM_DOMAIN** | — | app, traefik | Domain for HTTPS routing and URL generation. |
| **SECRET_KEY_BASE** | — | app, worker | Rails secret key used for sessions and cookies. |
| **DATABASE_NAME** | `decidim` | db | PostgreSQL database name. |
| **DATABASE_USER** | `decidim` | db | PostgreSQL username. |
| **DATABASE_HOST** | `db` | app, worker | Hostname of your PostgreSQL instance. |
| **DATABASE_PASSWORD** | `decidim` | db | PostgreSQL user password. |
| **DATABASE_URL** | — | app, worker | Full PostgreSQL connection URL (overrides other DB vars). |
| **SMTP_USERNAME** | — | app, worker | Username for SMTP authentication. |
| **SMTP_PASSWORD** | — | app, worker | Password for SMTP authentication. |
| **SMTP_ADDRESS** | — | app, worker | SMTP server hostname. |
| **SMTP_DOMAIN** | — | app, worker | SMTP domain. |
| **SMTP_PORT** | — | app, worker | SMTP port. |
| **SMTP_STARTTLS_AUTO** | `true` | app | Enables STARTTLS automatically. |
| **REDIS_URL** | `redis://decidim_cache:6379/0` | app | Redis URL for cache + sessions. |
| **VAPID_PUBLIC_KEY** | — | app | Web Push public key for browser notifications. |
| **VAPID_PRIVATE_KEY** | — | app | Web Push private key (keep secret). |
| **CERTIFICATE_EMAIL** | — | traefik | Email used by Let's Encrypt for certificate issues/renewals. |
| **WEB_CONCURRENCY** | `2` | app | Puma concurrency setting. |
| **LOG_LEVEL** | `info` | app | Log level for Rails. |
| **DECIDIM_FORCE_SSL** | `false` | app | Enforce HTTPS-only traffic. |
| **MAPS_API_KEY** | — | app | API key for maps provider. |
| **MAPS_PROVIDER** | `here` | app | Selects map provider (here, mapbox, google, etc). |
Loading