Prerequisites
What you need before deploying tprm.mlab.sh.
Docker & Compose
Installed on your server or local machine.
License key
Available on mlab.sh under Organization > TPRM. Free key auto-generated.
2 GB RAM / 10 GB disk
For MySQL, ClickHouse and the app service.
Quick Start
Deploy the full platform in 3 commands.
# Create project directory mkdir tprm-mlab && cd tprm-mlab # Download config files curl -O https://mlab.sh/assets/internals/tprm.mlab.sh/docker-compose.yml curl -o .env https://mlab.sh/assets/internals/tprm.mlab.sh/.env.example # Edit .env with your license key and passwords nano .env # Launch docker-compose up -d
admin@localhost / adminadmin. Change these immediately after first login.
docker-compose.yml
Three services: the app, MySQL 8 and ClickHouse.
services: app: image: ghcr.io/mlab-sh/tprm.mlab.sh:latest ports: - "${APP_PORT:-8080}:8080" depends_on: mysql: condition: service_healthy clickhouse: condition: service_healthy env_file: .env environment: - DB_HOST=mysql - CH_HOST=clickhouse volumes: - uploads:/app_mlab_sh/uploads - logs:/app_mlab_sh/logs restart: unless-stopped mysql: image: mysql:8 environment: MYSQL_ROOT_PASSWORD: ${DB_ROOT_PASSWORD} MYSQL_DATABASE: mlabtprm MYSQL_USER: ${DB_USERNAME} MYSQL_PASSWORD: ${DB_PASSWORD} volumes: - mysql_data:/var/lib/mysql healthcheck: test: ["CMD", "mysqladmin", "ping", "-h", "localhost"] interval: 5s timeout: 5s retries: 10 restart: unless-stopped clickhouse: image: clickhouse/clickhouse-server:latest environment: CLICKHOUSE_USER: ${CH_USERNAME} CLICKHOUSE_PASSWORD: ${CH_PASSWORD} CLICKHOUSE_DB: mlabtprm CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: 1 volumes: - clickhouse_data:/var/lib/clickhouse healthcheck: test: ["CMD", "clickhouse-client", "--query", "SELECT 1"] interval: 5s timeout: 5s retries: 10 restart: unless-stopped volumes: mysql_data: clickhouse_data: uploads: logs:
Data is persisted in Docker volumes (mysql_data, clickhouse_data, uploads). Both databases include health checks — the app waits for them to be healthy before starting.
Environment Variables
Configure your .env file.
# ─── mlab.sh TPRM Platform ──────────────────────────────────── # License key (required) LICENSE_KEY=your-license-key-here # ─── Application ───────────────────────────────────────────── APP_PORT=8080 # ─── MySQL ─────────────────────────────────────────────────── DB_PORT=3306 DB_USERNAME=mlab_web DB_PASSWORD=CHANGE_ME_mysql_password DB_ROOT_PASSWORD=CHANGE_ME_mysql_root_password # ─── ClickHouse ────────────────────────────────────────────── CH_USERNAME=default CH_PASSWORD=CHANGE_ME_clickhouse_password
CHANGE_ME_* values with strong passwords. DB_HOST and CH_HOST are set automatically by Docker Compose — do not add them to your .env unless you use external databases.
Variable Reference
| Variable | Required | Description |
|---|---|---|
LICENSE_KEY | Yes | Your tprm.mlab.sh license key |
APP_PORT | No | Port exposed on host (default: 8080) |
DB_USERNAME | Yes | MySQL user |
DB_PASSWORD | Yes | MySQL password |
DB_ROOT_PASSWORD | Yes | MySQL root password |
CH_USERNAME | Yes | ClickHouse user |
CH_PASSWORD | Yes | ClickHouse password |
Licensing
How license validation works.
Your license key is set via the LICENSE_KEY environment variable in your .env file. You can find your key on mlab.sh under Organization > TPRM.
Validation Flow
- License is validated against
mlab.shat boot. - Re-checked every hour via HMAC challenge-response.
- If the license server is temporarily unreachable, a 48-hour grace period keeps the platform running.
- After 48h without connectivity, the organization is locked until restored.
Tiers
| Tier | Description |
|---|---|
free | 3 users, 5 third-party providers, core modules (dashboard, providers, contracts, assessments, incidents), read-only API |
licensed | Unlimited users & providers, all DORA modules (exit strategies, concentration, functions, subcontracting, due diligence, audits, Art. 30, EBA export, register), advanced analytics, CSV export, full CRUD API |
A free license is automatically created with your mlab.sh account. To upgrade, visit the pricing page or contact us.
Update
Pull the latest image and restart.
docker-compose pull app docker-compose up -d app
Database migrations run automatically on startup. Your data in Docker volumes is preserved across updates.
Rollback
To pin a specific version, replace latest in your docker-compose.yml with a version tag:
image: ghcr.io/mlab-sh/tprm.mlab.sh:v1.0.0
Check the announcements page for release notes.
Support
Need help? We're here.