Production stack: docker compose

The recommended way to deploy single-node production. One command brings up:

Service	Port (host)	Purpose
roxa	9092 / 50051 / 9644	Kafka wire / gRPC / Prometheus /metrics
roxa-admin	8080	web console and monitoring (sign-in from admin.toml)
minio	9001	S3 segment storage (the S3 port 9000 stays inside the network)
prometheus	9090	metrics collection
grafana	3000	the “Roxa — Overview” dashboard (provisioned automatically)

Requirements

• A Linux server: 2+ vCPUs, 4+ GB RAM for real workloads (less for a demo).
• Docker + Docker Compose v2.
• Ports open to the outside: 9092 (Kafka), 50051 (gRPC), 8080 (web console). The S3 port (MinIO 9000) is not published externally.

Run

The deploy/onprem directory ships with the distribution (request it via support if you do not have it) — inside are docker-compose.yml, serve.toml, admin.toml, .env.example.

cd deploy/onprem
cp .env.example .env      # secrets: MinIO/Grafana passwords, the license (if any)
# edit serve.toml and admin.toml: change the passwords (CHANGE_ME...), kafka_advertised_addr
docker compose up -d
docker compose ps         # all services healthy/running
docker compose logs -f roxa

Secrets must match in three places

• the MinIO password: .env (MINIO_ROOT_PASSWORD) = serve.toml ([storage.s3].secret_key);
• the data-plane password: serve.toml ([[auth.users]].password) = admin.toml (broker_password).

Post-launch check

# roxactl (gRPC, with authentication):
roxactl --endpoint http://SERVER:50051 --user app --password <pass> topic create demo --partitions 3
roxactl --endpoint http://SERVER:50051 --user app --password <pass> produce demo hello world
roxactl --endpoint http://SERVER:50051 --user app --password <pass> consume demo

# any Kafka client (a kcat example, SASL/PLAIN):
kcat -b SERVER:9092 -X security.protocol=SASL_PLAINTEXT -X sasl.mechanism=PLAIN \
     -X sasl.username=app -X sasl.password=<pass> -L

The dashboard: http://SERVER:3000 → “Roxa — Overview” (throughput, produce/fetch latency, S3 write lag).

What next

• TLS and security — a must before going public.
• Backup and restore.
• Licensing — Community works without a token; Enterprise features are enabled by ROXA_LICENSE.