Skip to content

Backend — Pro edition

Pro is Community plus automation: instead of uploading WireGuard® .conf files by hand, the backend creates and removes VPN peers itself through the integrated WireGuard® server. It also adds MFA session gating, traffic dashboards, and appliance fleet management.

The Pro backend is a pre-built container image — no source checkout, no build step. Pro features switch on once a license key is loaded; without one, the same image simply runs as Community. Get a free 14-day trial from valenius.com.

Prerequisites

  • A server prepared as described in Prerequisites (Docker, domain, HTTPS reverse proxy).
  • A Pro license key or trial key (you can also add it later).

Steps

1. Create a deployment folder

mkdir -p ~/valenius-pro/data/downloads
cd ~/valenius-pro

2. Create the .env file

Create a file named .env with this content, replacing every change-me value with a strong random one (generate them with openssl rand -hex 32):

# .env
IMAGE_TAG=ghcr.io/valeniusvpn/valenius-pro:latest

DB_PASSWORD=change-me-a-strong-random-password

# Shared secret between the backend and every desktop client it issues.
WGT_API_KEY=change-me-a-random-key

# Bootstrap admin — your first login. Also your emergency fallback later.
ADMIN_EMAIL=admin@example.com
ADMIN_PASSWORD=change-me-a-strong-random-password

# Host port the backend listens on (your reverse proxy forwards to this).
BACKEND_PORT=9001

# Leave blank to run as Community until you add a license in the UI.
VALENIUS_LICENSE_KEY=

Special characters are safe here

Values in .env are not $-expanded by Docker Compose, so any random key — including ones containing $ — works without escaping.

3. Download the compose file and start the stack

curl -fsSLO https://raw.githubusercontent.com/valeniusvpn/valenius/master/Backend/msp/docker-compose.yml
docker compose up -d
docker compose logs -f backend

Wait until the log shows a line beginning with Now listening on:, then press Ctrl+C to leave the logs (the stack keeps running).

4. Put your reverse proxy in front

In your reverse proxy, create an HTTPS host (for example vpn.example.com) that forwards to http://<server-ip>:9001 (or whatever you set as BACKEND_PORT).

5. Add your license and sign in

  1. Put your license or trial key into .env as VALENIUS_LICENSE_KEY=… and apply it with docker compose up -d. (Skipping this runs the same image as Community — you can add the key any time later.)
  2. Open https://vpn.example.com/ and sign in with the ADMIN_EMAIL and ADMIN_PASSWORD from your .env. The License card on the Overview page shows the key's status.

Verify it works

  1. docker compose ps — both containers show running, db shows healthy.
  2. The admin panel opens at your HTTPS hostname and you can sign in.
  3. After adding the license, the Pro badge and the extra menu items (Server, MFA, Appliances) appear in the admin panel.

Next: set up the integrated WireGuard® server so clients get their VPN peers automatically — then continue with First steps after install.

Common problems

The Pro menu items don't appear. The license key is missing, mistyped, or expired. The License card on the Overview page shows the validation result; the backend log (docker compose logs backend) states the reason if the key was rejected. Without a valid key the backend runs as Community; nothing is broken.

docker compose up fails with "port is already allocated". Another service is using the port. Pick a different BACKEND_PORT in .env and run docker compose up -d again.

The image can't be pulled. The image is public and needs no docker login — if the pull fails, check the server's internet access and that IMAGE_TAG in .env is exactly as shown above.

I can sign in, but only when I access the port directly — through the proxy I land back on the sign-in page. Your proxy isn't forwarding HTTPS properly. Make sure the proxy host uses HTTPS with a valid certificate and forwards to the backend port over plain HTTP. Learn more →

I forgot the admin password. Set a new ADMIN_PASSWORD in .env and run docker compose up -d again — the bootstrap admin's password is updated on every container start.

Upgrading later

cd ~/valenius-pro
docker compose pull backend
docker compose up -d

Database upgrades happen automatically at startup; your data is kept.