Self Hosting in CHT 4.x - Single CouchDB Node

Self Hosting in CHT 4.x - Single CouchDB Node

This for a single node CHT 4.x instance and is the recommended solution for small deployments. If you want a more powerful setup, check out the 4.x multi-node install docs.


Be sure you have followed the requirements document including installing Docker and Docker Compose. This guide assumes you’re using the ubuntu user and that it has sudo-less access to Docker.

Directory Structure

Create the following directory structure:

|-- /home/ubuntu/cht/
                  |-- compose/
                  |-- certs/
                  |-- couchdb/
                  |-- upgrade-service/

By calling this mkdir commands:

mkdir -p /home/ubuntu/cht/{compose,certs,upgrade-service,couchdb}
  1. compose - docker-compose files for cht-core and CouchDB
  2. certs - TLS certificates directory
  3. upgrade-service - where docker-compose file for the upgrade-service
  4. couchdb - the path for the docker-compose file of the upgrade-service (not used in multi-node)

Download required docker-compose files

The following 3 curl commands download CHT version 4.0.1 compose files, which you can change as needed. Otherwise, call:

cd /home/ubuntu/cht/
curl -s -o ./compose/cht-core.yml
curl -s -o ./compose/cht-couchdb.yml
curl -s -o ./upgrade-service/docker-compose.yml

Prepare Environment Variables file

Prepare a .env file by running this code:

sudo apt install wamerican
couchdb_secret=$(shuf -n7 /usr/share/dict/words --random-source=/dev/random | tr '\n' '-' | tr -d "'" | cut -d'-' -f1,2,3,4,5,6,7)
couchdb_password=$(shuf -n7 /usr/share/dict/words --random-source=/dev/random | tr '\n' '-' | tr -d "'" | cut -d'-' -f1,2,3,4,5,6,7)
cat > /home/ubuntu/cht/upgrade-service/.env << EOF

Note that secure passwords and UUIDs were generated on the first four calls and saved in the resulting .env file.

Launch containers

To start your CHT instance, run the following

cd /home/ubuntu/cht/upgrade-service
docker compose up --detach

Docker will start the upgrade service, which in turn pulls the required images and starts all the services as defined by the compose files in /home/ubuntu/cht/compose.

To follow the progress tail the log of the upgrade service container by running this:

docker logs -f upgrade-service_cht-upgrade-service_1

To make sure everything is running correctly, call docker ps and make sure that 7 CHT containers show:

CONTAINER ID   IMAGE                                                         COMMAND                   CREATED          STATUS         PORTS                                                                      NAMES
8c1c22d526f3                 "/docker-entrypoint.…"    17 minutes ago   Up 8 minutes>80/tcp, :::80->80/tcp,>443/tcp, :::443->443/tcp   cht_nginx_1
f7b596be2721                   "/bin/bash /api/dock…"    17 minutes ago   Up 8 minutes   5988/tcp                                                                   cht_api_1
029cd86ac721              "/bin/bash /sentinel…"    17 minutes ago   Up 8 minutes                                                                              cht_sentinel_1
61ee1e0b377b   "/bin/sh -c \"/app/ch…"   17 minutes ago   Up 8 minutes                                                                              cht_healthcheck_1
87415a2d91ea               "/ -f /…"    17 minutes ago   Up 8 minutes   5984/tcp                                                                   cht_haproxy_1
58454457467a               "tini -- /docker-ent…"    17 minutes ago   Up 8 minutes   4369/tcp, 5984/tcp, 9100/tcp                                               cht_couchdb_1
d01343658f3f            "node /app/src/index…"    17 minutes ago   Up 8 minutes                                                                              upgrade-service-cht-upgrade-service-1

This should show related to the CHT core are running

  • cht_nginx
  • cht_api
  • cht_sentinel
  • cht_couchdb
  • cht_healthcheck
  • cht_haproxy
  • cht-upgrade-service

Take note of the STATUS column and make sure no errors are displayed there. If any container is restarting or mentioning any other error, check the logs using the docker logs <container-name> command.

If all has gone well, nginx should now be listening at both port 80 and port 443. Port 80 has a permanent redirect to port 443, so you can only access the CHT using https.

To login as the medic user in the web app, you can find your password with this command:

grep COUCHDB_PASSWORD /home/ubuntu/cht/upgrade-service/.env | cut -d'=' -f2

TLS Certificates

See the TLS Certificates page for how to import your certificates.


During upgrades, the CHT upgrade service updates the docker-compose files located in /home/ubuntu/cht/compose/. This means that any and all changes made to the docker-compose files will be overwritten. If there is ever a need to make any changes to the docker-compose files, be sure to re-do them post upgrades or should consider implementing them outside of those docker-compose files.