Technical docs

Install and operate the Acorn CCMS stack.

Use these docs to run the Community Edition locally, evaluate a production deployment, and understand the services Acorn expects.

Local development

Quickstart

The local stack uses Docker Compose for infrastructure and a Next.js development server for the web app.

git clone https://github.com/Paint-The-Night/Acorn-CCMS.git
cd Acorn-CCMS
docker compose up -d
npm install
cd web
npm install
npm run db:generate
npm run db:seed
npm run dev

Local only: default Docker credentials are for development. Replace all secrets before any production use.

Deployment shape

Self-hosting architecture

Web appNext.js app in `web/` serving UI, server actions, and API routes.

DatabasePostgreSQL 16 with Prisma schema, migrations, and seed scripts.

Object storageS3-compatible storage for documents and uploads. MinIO is used locally.

EmailSMTP provider for invitations, password reset, and operational messages.

Document APIFastAPI service for PDF and document operations.

Optional AIxAI/OpenAI-compatible provider keys for AI-assisted workflows.

Configuration

Environment files

Use committed examples as templates. Never commit real provider keys, database URLs, deployment dumps, or production `.env` files.

Local

Copy `web/.env.example` to `web/.env.local` and use Docker Compose defaults for local development.

Production

Use your host's secret manager. Rotate local defaults and require a strong `AUTH_SESSION_SECRET`.

Before real data

Production checklist

Replace local credentials and weak development secrets. Review tenant isolation for organisation, centre, family, staff, document, and billing access. Use private object storage unless a file is intentionally public. Configure transactional email from a verified sending domain. Test database and object-storage restore before onboarding a centre. Define audit logging, retention, deletion, and incident-response procedures.

Reliability

Backup and restore

A useful backup strategy covers both PostgreSQL and object storage. A backup that has not been restored is not yet proven.

PostgreSQL

Schedule database dumps or managed snapshots. Keep restore instructions with the deployment runbook.

pg_dump

Object storage

Version or replicate document storage where possible. Confirm restore preserves private access controls.

S3

Secrets

Backups are useless if production secrets are lost. Store secrets in a managed secret store.

Secrets

Maintenance

Upgrades

Treat upgrades as application changes: read migrations, back up first, run smoke tests, and have a rollback path.

git pull
cd web
npm install
npm run db:generate
npm run db:migrate
npm run build