Self-host Kestra

copy# Kestra standalone server + PostgreSQL, with the Docker socket mounted so flows can run containers — based on the docker-compose.yml from Kestra's Docker Compose installation docs, pinned to v2.0.6 (all plugins bundled; the -slim tag ships none)
echo "KESTRA_PG_PASS=$(openssl rand -hex 16)" > .env
cat > docker-compose.yml <<'EOF'
volumes:
  postgres-data:
  kestra-data:
services:
  postgres:
    image: postgres:18
    restart: unless-stopped
    volumes:
      - postgres-data:/var/lib/postgresql
    environment:
      POSTGRES_DB: kestra
      POSTGRES_USER: kestra
      POSTGRES_PASSWORD: ${KESTRA_PG_PASS}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
      interval: 10s
      timeout: 10s
      retries: 10
  kestra:
    image: kestra/kestra:v2.0.6
    restart: unless-stopped
    stop_grace_period: 6m
    user: "root"
    command: server standalone
    volumes:
      - kestra-data:/app/storage
      - /var/run/docker.sock:/var/run/docker.sock
      - /tmp/kestra-wd:/tmp/kestra-wd
    environment:
      KESTRA_CONFIGURATION: |
        datasources:
          postgres:
            url: jdbc:postgresql://postgres:5432/kestra
            driverClassName: org.postgresql.Driver
            username: kestra
            password: ${KESTRA_PG_PASS}
        kestra:
          repository:
            type: postgres
          storage:
            type: local
            local:
              base-path: "/app/storage"
          queue:
            type: postgres
          tasks:
            tmp-dir:
              path: /tmp/kestra-wd/tmp
          url: http://localhost:8080/
    ports:
      - 8080:8080
    depends_on:
      postgres:
        condition: service_healthy
EOF
docker compose up -d
# → http://SERVER_IP:8080 — the management port 8081 is unauthenticated and stays unexposed, as in upstream's file