Deployment Guide

Server Requirements

Recommended providers: DigitalOcean, Hetzner, Vultr, Linode, AWS Lightsail

One-Click Install

curl -sSL https://wplauncher.msrbuilds.com/install.sh | bash

The script handles everything: swap setup, Docker installation, config prompts, admin account creation, secret generation, Traefik SSL, image building, and service startup.

Manual VPS Setup

For custom deployments when the one-click installer doesn't fit your needs.

Step 1: Prepare Server

sudo apt update && sudo apt upgrade -y
sudo apt install -y docker.io docker-compose-plugin git
sudo systemctl enable docker

Step 2: Configure Firewall

sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

Step 3: Clone and Configure

cd /opt
git clone https://github.com/msrbuilds/wp-launcher.git
cd wp-launcher
cp .env.example .env

# Generate secure secrets
openssl rand -hex 32  # Use for JWT_SECRET
openssl rand -hex 32  # Use for API_KEY
openssl rand -hex 16  # Use for other secrets

Step 4: Configure Traefik

Update traefik/traefik.yml with your Let's Encrypt email and create a docker-compose.override.yml for production TLS labels.

Step 5: Build and Start

bash scripts/build-wp-image.sh
docker compose up -d --build

Dokploy

WP Launcher also runs on Dokploy as a Docker Compose service using docker-compose.dokploy.yml. Dokploy's Traefik keeps serving the panel, while WP Launcher runs its own Traefik for site traffic.

• TLS: Dokploy's Traefik forwards *.BASE_DOMAIN to WP Launcher's Traefik by SNI without decrypting it (TLS passthrough). WP Launcher terminates TLS and owns certificate issuance, so nothing is configured on the host and a Dokploy upgrade can't break renewal.
• Certificates: each site gets its own Let's Encrypt certificate over TLS-ALPN-01 by default. Set ACME_DNS_PROVIDER (e.g. cloudflare with CF_DNS_API_TOKEN) to switch to one wildcard certificate — worth it once you approach Let's Encrypt's 50-certificates-per-week limit.
• Isolation: site containers run on a private wpl-sites network and can't reach other apps on the Dokploy instance.
• Required environment: ACME_EMAIL, BASE_DOMAIN_REGEX, ADMINER_AUTH_USERS (Adminer requires a login) and SHARED_DB_ROOT_PASSWORD, plus real SMTP — there is no bundled Mailpit.
• Persistent paths: PRODUCT_ASSETS_PATH and SITES_HOST_PATH must be absolute host paths under Dokploy's files/ directory, since code/ is wiped on every redeploy.

DNS Configuration

Set up two DNS A records pointing to your server IP:

SSL / HTTPS

Enable TLS in your .env:

ENABLE_TLS=true
CERT_RESOLVER=letsencrypt

Cloudflare DNS Challenge

Creates one wildcard certificate. Requires a Cloudflare API token with Zone > DNS > Edit permissions.

[email protected]
CF_DNS_API_TOKEN=your-api-token

HTTP Challenge

Creates separate certificates per subdomain. No Cloudflare account needed, but incompatible with Cloudflare proxy.

Cloudflare DNS Setup

If using the Cloudflare DNS challenge for wildcard SSL:

1. Log into the Cloudflare dashboard
2. Go to My Profile → API Tokens
3. Click Create Token
4. Create a Custom Token with permissions: Zone → DNS → Edit for your specific domain
5. Copy the token and add to your .env:

[email protected]
CF_DNS_API_TOKEN=your-cloudflare-api-token

Verify it's working by checking Traefik logs:

docker compose logs traefik | grep -i "certificate"
# Should show: "Certificate obtained successfully"

Email Configuration

For sending verification and notification emails in Agency Mode.

SMTP Configuration