Self-Hosting the Open Source Edition

The core nano engine — ingestion, search, and detection — is open source under AGPL-3.0. You can run the whole stack on a single host with one command. No account, no bill.

The open-source edition is the engine. Commercial modules (case management, pivt investigations, risk scoring, AI triage, managed hosting) are part of the hosted / BYOC platform. See Open Source for the full open-vs-commercial split.

Requirements

• A Linux host (or macOS) you control
• Docker Engine with the Compose v2 plugin (docker compose version)
• git, curl, and openssl (present on most systems)
• Roughly 4 GB RAM and a few GB of free disk for a small deployment — more as your ingest grows

The installer checks for each of these up front and tells you what's missing.

Install

curl -fsSL https://get.nano.rs | bash

That's it. The script will:

1. Validate prerequisites and that the Docker daemon is reachable
2. Clone nano-rs/nano into ~/nano
3. Prompt for an admin email, password, and your public base URL (it reads your terminal even though the script is piped from curl)
4. Generate strong random secrets and write a 0600 .env
5. Pull the images from ghcr.io/nano-rs and bring the stack up behind nginx
6. Wait for the API to report healthy, then create your first admin account
7. Print your login URL and an ingest token

Prefer to read it first?

Piping a remote script straight into a shell means trusting it. If you'd rather inspect before running — recommended for a security tool — download, read, then execute:

curl -fsSL https://get.nano.rs -o install.sh
less install.sh        # read it
bash install.sh

The bigger integrity question is the container images, not the bootstrap script — and those are pinned. After pulling, the installer compares each first-party ghcr.io/nano-rs/* image against the sha256 digests committed in images.lock and refuses to start the stack on any mismatch. Docker already checksum-verifies image layers on download; pinning to the committed digest additionally guarantees the latest tag wasn't re-pushed with content other than the published release. You can review exactly what will run before installing:

curl -fsSL https://raw.githubusercontent.com/nano-rs/nano/main/images.lock

After install

The script prints everything you need on success:

• Login URL and the admin credentials (if you let it autogenerate the password, it's saved to ~/nano/.env as INITIAL_ADMIN_PASSWORD — delete it once you've signed in)
• An ingest token plus ready-to-paste curl / Splunk HEC / Vector examples for pointing your first source at the instance

From there, follow Set Up Your First Feed to onboard a log source.

Running in production

The default http://localhost setup enables NANOSIEM_DEV_MODE, which lets the login cookie work over plain HTTP. Do not run a production deployment on plain HTTP — without the Secure cookie flag, sessions are far more exposed.

For anything internet-facing, serve nano over HTTPS and set your public BASE_URL to the https:// origin during install. With an https:// base URL the installer leaves dev mode off.

Enabling HTTPS

nano's bundled nginx can terminate TLS directly — bring your own certificate. Drop a certificate chain and private key into config/nginx/ssl/:

~/nano/config/nginx/ssl/fullchain.pem   # certificate (leaf + intermediates)
~/nano/config/nginx/ssl/privkey.pem     # private key

Get them however you like — Let's Encrypt / certbot, your own CA, or a self-signed pair for testing (./config/nginx/generate-ssl.sh, which browsers will warn on). Both *.pem files are gitignored, so your key is never committed.

Then bring the stack up with the TLS overlay:

docker compose -f docker-compose.opensource.yml -f docker-compose.tls.yml up -d

nginx now serves HTTPS on :443 and redirects :80 → :443. Renewal is out of band: refresh the PEM files and docker compose ... restart nginx to pick up the new certificate.

Already fronting nano with your own TLS reverse proxy or a tunnel (e.g. Cloudflare Tunnel)? Skip the overlay — keep nano on :80 behind it and just set your https:// BASE_URL.

Manage the stack

All commands run from the install directory (~/nano by default):

# Tail logs
docker compose -f ~/nano/docker-compose.opensource.yml logs -f

# Stop (keeps your data)
docker compose -f ~/nano/docker-compose.opensource.yml down

# Reset — deletes ALL data
docker compose -f ~/nano/docker-compose.opensource.yml down -v

Re-running the install script is safe: it detects an existing .env, keeps your secrets, and just restarts the stack.

Upgrading

Pull the latest engine and restart:

cd ~/nano
git pull
docker compose -f docker-compose.opensource.yml pull
docker compose -f docker-compose.opensource.yml up -d

Or simply re-run curl -fsSL https://get.nano.rs | bash — it fast-forwards the checkout and brings the stack back up with your existing configuration.