Installing Checkmate
Deploy Checkmate using Docker, Kubernetes, or from source.
Overview
Checkmate offers several installation options depending on your needs:
- Docker (recommended) — fastest way to get running
- Kubernetes / Helm — for orchestrated deployments
- Developer setup — for contributing or customizing
Option 1: Docker
Checkmate ships as a single all-in-one application image, ghcr.io/bluewave-labs/checkmate. It serves the React frontend from the API server, so only two services are needed: the application and MongoDB.
The image is multi-arch (linux/amd64 and linux/arm64), so the same tag works on x86 servers, Apple Silicon, and ARM devices such as a Raspberry Pi 4/5.
MongoDB is not embedded in the image and remains required. The reference Compose file starts it for you. For custom deployments, point DB_CONNECTION_STRING at an external MongoDB instance.
Local deployment
Download the reference Compose file and start it:
curl -O https://raw.githubusercontent.com/bluewave-labs/checkmate/master/docker/docker-compose.yaml
JWT_SECRET="$(openssl rand -hex 32)" docker compose up -dThen open http://localhost:52345.
Remote server deployment
When the app is reached at another origin — a domain or a LAN IP rather than localhost — set CLIENT_HOST to that URL:
CLIENT_HOST=https://checkmate.example.com \
JWT_SECRET="$(openssl rand -hex 32)" \
docker compose up -dFor TLS, put a reverse proxy (Caddy, Traefik, nginx) in front of port 52345.
Configuration
The application is configured entirely through environment variables:
| Variable | Required | Purpose |
|---|---|---|
DB_CONNECTION_STRING | Yes | MongoDB connection string, e.g. mongodb://mongodb:27017/uptime_db |
JWT_SECRET | Yes | Secret used to sign auth tokens; generate with openssl rand -hex 32 |
CLIENT_HOST | Yes | The URL users reach the app at; used for CORS and for links in notifications and emails |
LOG_LEVEL | No | Server log level: error, warn, info, or debug (default debug) |
The web client needs no configuration by default — it calls the API on the same origin it was served from. For setups where that does not apply, the server renders overrides into the client at runtime:
| Variable | Purpose |
|---|---|
CLIENT_CONFIG_API_BASE_URL | Full base URL the client calls the API at; defaults to same-origin /api/v1 |
CLIENT_CONFIG_CLIENT_HOST | Origin used when building absolute links (invites, status pages); defaults to the browser's current origin |
CLIENT_CONFIG_LOG_LEVEL | Browser console log level (default error) |
Upgrading from an older image? The UPTIME_APP_* variables (UPTIME_APP_API_BASE_URL, UPTIME_APP_CLIENT_HOST, UPTIME_APP_LOG_LEVEL) are no longer read. In most setups no replacement is needed — the same-origin defaults cover them. If you pointed the client at a different origin, use the CLIENT_CONFIG_* equivalents above.
The checkmate-client, checkmate-backend, checkmate-mongo, and checkmate-backend-mono-multiarch images are no longer updated. Switch to ghcr.io/bluewave-labs/checkmate, keeping your existing MongoDB service and data volume.
Mount identical MongoDB directories to retain data during upgrades. Always back up your data directory before migrating versions.
Monitoring Docker containers
To monitor containers on the host, mount the Docker socket into the Checkmate service:
volumes:
- /var/run/docker.sock:/var/run/docker.sock:roSocket access is root-equivalent on that host, so enable it deliberately.
Building the image yourself
docker build -f docker/Dockerfile -t checkmate .Option 2: Third-party hosting
You can also deploy Checkmate using these hosting providers:
- Elestio — managed open-source hosting
- PikaPods — one-click container hosting
- Sive Host — hosting provider (South Africa)
- RepoCloud
- Coolify
- Cloudzy
Option 3: Kubernetes with Helm
Prerequisites
- A running Kubernetes cluster
- Helm CLI installed and configured
kubectlconfigured to access your cluster
Deploy
git clone https://github.com/bluewave-labs/checkmate.git
cd checkmate/charts/helm/checkmateEdit values.yaml to configure:
client.ingress.hostandserver.ingress.hostwith your domain namesserver.protocol(http or https)- Secrets under the
secretssection (JWT_SECRET, email credentials, API keys)
Then deploy:
helm install checkmate ./charts/helm/checkmateVerify the deployment:
kubectl get pods
kubectl get svcEnabling TLS with cert-manager
If you have cert-manager installed, enable automatic TLS:
client:
protocol: https
ingress:
enabled: true
host: checkmate.example.com
className: nginx
annotations:
cert-manager.io/cluster-issuer: "letsencrypt-prod"
tls:
enabled: true
secretName: checkmate-client-tls
server:
protocol: https
ingress:
enabled: true
host: checkmate.example.com
className: nginx
annotations:
cert-manager.io/cluster-issuer: "letsencrypt-prod"
tls:
enabled: true
secretName: checkmate-server-tlsVerify certificates:
kubectl get certificates
kubectl describe certificate checkmate-client-tlsOption 4: Developer installation
For contributing or customizing Checkmate with hot-reload support.
Clone and start MongoDB
You don't need to build any Docker images for development. The only container required is MongoDB:
git clone https://github.com/bluewave-labs/checkmate
cd checkmate
docker run -d -p 27017:27017 \
-v uptime_mongo_data:/data/db \
--name uptime_database_mongo mongo:8.0Start the server
cd checkmate/server
npm installCreate a .env file in the server directory (see environment variables below), then:
npm run devServer runs on localhost:52345 by default.
Start the client
cd checkmate/client
npm installCreate a .env file in the client directory (see environment variables below), then:
npm run devFrontend runs on localhost:5173 by default.
Environment variables
Client variables
Create .env in the client directory:
| Variable | Required | Description |
|---|---|---|
VITE_APP_API_BASE_URL | Yes | Server base URL, e.g. http://localhost:52345/api/v1 |
VITE_APP_LOG_LEVEL | No | Logging level: none, error, warn, debug |
VITE_APP_DEMO | No | Enable demo mode: true or false |
VITE_APP_API_BASE_URL="http://localhost:52345/api/v1"
VITE_APP_LOG_LEVEL="debug"Server variables
Create .env in the server directory:
| Variable | Required | Description |
|---|---|---|
CLIENT_HOST | Yes | Frontend URL (must be a full URL), e.g. http://localhost:5173 |
JWT_SECRET | Yes | Secret key for JWT authentication |
DB_CONNECTION_STRING | Yes | MongoDB URL, e.g. mongodb://localhost:27017/uptime_db |
ORIGIN | No | CORS origin for requests |
LOG_LEVEL | No | debug, info, warn, error |
TOKEN_TTL | No | Token expiration, e.g. 99d |
CLIENT_HOST="http://localhost:5173"
JWT_SECRET="my_secret"
DB_CONNECTION_STRING="mongodb://localhost:27017/uptime_db"
TOKEN_TTL="99d"
ORIGIN="localhost"For PageSpeed monitoring, you'll need a free Google PageSpeed API key.
Using a custom CA
If you need to monitor internal HTTPS endpoints with certificates from private Certificate Authorities (like Smallstep), see the Custom CA Trust Guide for Docker configuration options.