Admin Guide
This section is for administrators who install and operate Semaphore for other people. Everything here needs access the server itself: the configuration file, environment variables, command line, or the machine Semaphore runs on. Work done inside a project through the web interface is covered in the User Guide.
Semaphore is a single Go binary with a web interface and a REST API. It stores its data in SQLite, MySQL, or PostgreSQL, keeps credentials encrypted, and runs tasks either on the server itself or on separate runners. A working installation therefore comes down to four decisions: how to install it, where the database lives, how users sign in, and where tasks execute.
Set up
Everything you configure before or around starting the server.
| Page | What it covers |
|---|---|
| Installation | Package manager, Docker, binary, Kubernetes, and a manual setup. |
| Configuration | The config.json file, environment variables, and every supported option. |
| Upgrading | Moving to a newer release and what to check first. |
| Reverse proxy | Serving Semaphore behind nginx, Apache, or Caddy, with TLS. |
| Security | Password hashing, secret encryption, network hardening, and task JWTs. |
| Authentication | Local accounts and two-factor, LDAP and Active Directory, and single sign-on with twelve OpenID Connect providers. |
| Runners | Executing tasks on machines other than the server. |
| High availability | Running several Semaphore nodes against one database. |
Operate
Everything you do on a server that is already running.
| Page | What it covers |
|---|---|
| CLI | Managing users, projects, vaults, runners, and database migrations from the shell. |
| API | Authenticating with a token and driving Semaphore programmatically. |
| CI/CD integration | Starting Semaphore tasks from an external pipeline. |
| Logs | Server logs, task logs, and forwarding them elsewhere. |
| Audit log | Security events, local audit capture, and Pro export to a SIEM. |
| Metrics | The Prometheus endpoint and the metrics it exposes. |
| Notifications | Delivery channels for alerts: e-mail, Telegram, Slack, and others. |
| License | Activating a Pro or Enterprise subscription. |
Where to start
If you are installing Semaphore for the first time, read Installation and pick one method, then Configuration to learn how options are supplied. Put the server behind a reverse proxy with TLS before anyone else uses it.
To see what a paid subscription adds, see Editions.