> ## Documentation Index
> Fetch the complete documentation index at: https://docs.openhands.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Run on a VM with HTTPS

> Run the Docker Compose stack on a Linux VM and serve it over HTTPS at your own domain

This guide runs the [Docker Compose](https://docs.openhands.dev/enterprise/docker-compose) stack on a Linux VM and serves it
over HTTPS at your own domain. Caddy handles HTTPS. Caddy can get a certificate from Let's Encrypt
automatically, or it can use a certificate that you provide.

## Prerequisites

* A Linux VM with at least 4 CPUs, 16 GB of memory, and 100 GB of disk
* [Docker Engine](https://docs.docker.com/engine/install/) with the Compose plugin, and Git
* A domain name for OpenHands, such as `openhands.example.com`
* Ports 80 and 443 open to your users
* An API key from your LLM provider

## Install

**1. Create a DNS record**

Create a DNS A record that points your domain to the IP address of the VM.

**2. Clone the repository**

On the VM, run:

```bash theme={null}
git clone https://github.com/OpenHands/enterprise.git
cd enterprise
```

**3. Configure the stack**

Create a `.env` file in the `enterprise` directory. Replace `openhands.example.com` with your
domain.

**Automatic certificate**

```bash .env theme={null}
COMPOSE_FILE=docker-compose.yml:docker-compose.https.yml
WEB_HOST=openhands.example.com
WEB_URL=https://openhands.example.com
AGENT_CANVAS_LOCK_TO_CLOUD=https://openhands.example.com
```

Caddy gets a certificate from Let's Encrypt when the stack starts and renews it
automatically. Let's Encrypt must be able to reach the VM from the internet on port 80 or
443\.

**Your own certificate**

```bash .env theme={null}
COMPOSE_FILE=docker-compose.yml:docker-compose.https-own-cert.yml
WEB_HOST=openhands.example.com
WEB_URL=https://openhands.example.com
AGENT_CANVAS_LOCK_TO_CLOUD=https://openhands.example.com
```

Copy your certificate and private key into the `certs` directory:

```bash theme={null}
mkdir -p certs
cp /path/to/fullchain.pem certs/cert.pem
cp /path/to/privkey.pem certs/key.pem
```

The certificate must be issued by a public certificate authority, and `cert.pem` must
contain the full certificate chain.

`COMPOSE_FILE` adds a Caddy service that serves HTTPS on ports 80 and 443. Docker Compose
reads this file on every command, so the commands on the
[Docker Compose](https://docs.openhands.dev/enterprise/docker-compose) page work without changes.

**4. Start the stack**

```bash theme={null}
docker compose up --wait
```

**5. Complete onboarding**

Open `https://openhands.example.com` and follow the onboarding flow to create your first user
and configure your LLM provider.

## Replace Your Certificate

If you use your own certificate, copy the new files to `certs/cert.pem` and `certs/key.pem`, then
restart Caddy:

```bash theme={null}
docker compose restart https
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.