Troubleshooting

Give the second one its own name and ports:

./setup.sh --project gorunner-2 --https-port 8443 --http-port 8080

1. Sign in again with your GitHub account’s user name and its read-only token: docker login ghcr.io -u <user name>. If the token ended, make a new one. See Sign in to the registry.
2. Check the version’s spelling, with its v.
3. For a mirror, sign in to it and give the setup its address: ./setup.sh --registry registry.example.com/ralve-org.

1. Fix what the line says, and run ./setup.sh again. The preflight check lists what it tests.
2. Sure it doesn’t matter? Run the command after “Sure it’s fine?”: yours, with --skip-check.

“Going on would put data GoRunner already holds at risk” is never skipped: put the right encryption key back, or switch file storage on again.

1. Check the version, with its v.
2. Sign in again: docker login ghcr.io -u <user name>. If your token ended, make a new one on GitHub.

1. Fix what the lines above it say.
2. Run the same ./deploy.sh again.

“building index … waited 1m0s for older transactions to end” means a long transaction, often a pg_dump, held up the migrations. Let it end, then run it again. Going back has its own rules.

1. Check the domain’s A (and AAAA) record has the server’s public address, and the firewall opens 80 and 443.
2. Read why: docker compose logs -f caddy. Caddy tries again by itself.
3. Behind your own proxy, ask GoRunner directly on the server. {"status":"ok" means the problem is in the proxy.

curl -sS http://127.0.0.1:8080/api/ready

The setup warns “… does not resolve yet” and goes on: Caddy keeps trying. It stops at “… does not answer over https yet”. Once DNS is right, run ./setup.sh again and answer y to “Check that everything is running with these answers?”.

Let’s Encrypt issues at most five certificates for one name a week. Never run docker compose down -v: it deletes Caddy’s.

Save Caddy’s own authority in the install folder, and point your programs at it:

docker compose exec -T caddy cat \
  /data/caddy/pki/authorities/local/root.crt > gorunner-test-ca.crt
curl --cacert gorunner-test-ca.crt https://gorunner.localhost:8443/api/ready
NODE_EXTRA_CA_CERTS=/path/to/gorunner-test-ca.crt node node.mjs
SSL_CERT_FILE=/path/to/gorunner-test-ca.crt python3 python.py

In the browser, accept the warning for this address before you try Embed, or the embed fails with nothing but a failed load in the console. For an Embed test, allow http://localhost:3000 under Allowed websites, and leave the key’s address list empty: the installation sees your app’s calls from Docker’s own network.

1. Print it again on the server:

docker compose exec api gorunner setup-code

kubectl --namespace gorunner exec deploy/gorunner-api -- gorunner setup-code

“This installation already has an admin” means the account exists: sign in. With GORUNNER_ADMIN_EMAIL set, only that address can be the first admin.

1. Look in the spam folder, and wait a minute before asking again: one address may ask once a minute and five times an hour, one network 20 times an hour. Only the newest email’s link and code work.
2. Read what the mail service answered: docker compose logs api.
3. Check the sender’s domain is verified with Resend, or has SPF and DKIM on your SMTP server.
4. Run docker compose run --rm check: it signs in to the mail server without sending.

Port 465 expects TLS from the first byte; elsewhere set SMTP_SECURE=tls for that. Mixed up, it looks like a timeout. A mail server with a private certificate needs it in certs/. Some clouds block mail ports: use another port, or Resend. Change the answers with ./setup.sh.

1. An owner or admin of their organization makes them a reset link. See Someone forgot their password.
2. An admin who forgot their own runs gorunner reset-password on the server.

“Too many wrong passwords.” lifts after 15 minutes, or with a reset link. “Too many sign-in attempts from this network. Try again later.” counts wrong passwords from one network; the right password clears it. “This installation has no free seat” means every seat of the license is taken.

1. Next to Platform admin?, press Sign in.
2. Load a license on the page that follows. See Start it again.

docker compose logs api | grep "REFUSING TO START"
docker compose logs caddy postgres redis

Fix it in .env and apply it with ./deploy.sh "$(cat VERSION)".

1. Turn it on. See Turn on two-factor.
2. Press Sign out and sign in again, and type the code.

No Platform in the menu means your account isn’t a platform admin. Every address showing the license page means the installation is paused.

Someone with the server runs:

docker compose exec api gorunner reset-two-factor dana@example.com

kubectl --namespace gorunner exec deploy/gorunner-api -- \
  gorunner reset-two-factor dana@example.com

It works for a platform admin only. It turns their two-factor off, deletes their recovery codes, ends their sessions and records it in the audit log. When it works, it says “Two-factor is off for dana@example.com, and every session they had has ended.” They then turn two-factor on again.

The server’s operator has a console of their own at /admin, the Instance console. It is closed until you set a secret.

1. Make a secret with openssl rand -hex 32 and set it as PLATFORM_ADMIN_SECRET: in .env, then ./deploy.sh "$(cat VERSION)"; on Kubernetes, in your Secret.
2. Open https://automations.example.com/admin, type it as Console secret and press Unlock.

There you can Activate license or Revoke license…. The same secret, in an X-Platform-Admin header, makes an existing account a platform admin:

curl -X POST https://automations.example.com/api/instance/platform-admins \
  -H "X-Platform-Admin: $SECRET" -H "Content-Type: application/json" \
  -d '{"email":"dana@example.com"}'

Remove the secret again afterwards.