Quick start

The fastest way to run QueryProxy is a single container. It needs no compose file and no external services.

docker run -d --name queryproxy \
  -p 7432:7432 \
  -v queryproxy-data:/var/www/html/storage/app \
  -e [email protected] \
  -e QUERYPROXY_ADMIN_PASSWORD='choose-a-strong-password' \
  queryproxy/queryproxy

Then open http://localhost:7432 and log in with that address.

Three processes run inside that one container:

The first boot generates an application key, runs the migrations and creates a SQLite database. Everything that must survive a container replacement — that database, the generated key and the result files — lives on the single /var/www/html/storage/app volume. The image also declares a Docker HEALTHCHECK that polls http://localhost:7432/up.

Images are published for linux/amd64 and linux/arm64 on every release, to both Docker Hub (queryproxy/queryproxy) and the GitHub Container Registry (ghcr.io/queryproxy/queryproxy), as latest and per-version tags.

For production, set APP_KEY explicitly and keep it stable. It encrypts your stored connection credentials; if the volume is lost and the key regenerates, those credentials become unreadable. Generate one with docker run --rm queryproxy/queryproxy php artisan key:generate --show, pass it as -e APP_KEY=..., and rotate via APP_PREVIOUS_KEYS.

Putting a reverse proxy in front of it? Set TRUSTED_PROXIES too. No proxy is trusted by default, so until you name yours QueryProxy sees the proxy as the client: HTTPS is not detected and audit entries record the proxy’s address. Never use * — see Configuration. The docker run above is reached directly and needs no extra setting.

Your first account

QueryProxy has no public registration, and a fresh instance has no accounts. The QUERYPROXY_ADMIN_EMAIL / QUERYPROXY_ADMIN_PASSWORD variables above create the first administrator on boot. They are ignored once the instance has any user, so leaving them in place across restarts is harmless.

To create the account by hand instead — or to add another administrator later:

docker exec -it queryproxy php artisan queryproxy:create-admin

Demo accounts

Demo seeding is off by default. To explore with sample data, set QUERYPROXY_SEED_DEMO=true. That seeds a global admin plus a demo team with one DBA, one developer and one auditor:

All four share one randomly generated password, printed once in the container logs (docker logs queryproxy) — there is no fixed default password. For safety the seeder refuses to run while APP_ENV=production unless you also set QUERYPROXY_SEED_DEMO_FORCE=true.

Log in as each role to explore the product: the DBA creates connections and approves requests, the developer submits queries, the auditor reads the trail.

Prefer Compose?

The repository ships a docker-compose.yml with that same single service, plus commented blocks for running the worker as its own container or pointing the application database at MySQL/PostgreSQL:

git clone https://github.com/QueryProxy/QueryProxy.git
cd QueryProxy
docker compose up -d

First real request, end to end

1. As Admin, create a team and add your users with roles (Administration → Teams & Users; members are added from the team’s Members action).
2. As DBA, add a database connection (Connections → New connection) and use its Test action to verify it. Grant it to your developers with Grants.
3. As Developer, open Query Studio, pick the connection, write a query and submit it.
4. As DBA, approve it from Approvals — the worker executes it and the requester gets the masked result.

Next steps

• Installing without Docker? See Manual installation.
• All environment variables: Configuration.
• Approvals in chat: Slack integration.