Sure, our main repository comes with a production-ready Dockerfile: https://github.com/plausible/analytics https://github.com/plausible/analytics We also have

Sure, our main repository comes with a production-ready Dockerfile: https://github.com/plausible/analytics https://github.com/plausible/analytics We also have a separate repository with examples and code for how to host Plausible Analytics with docker-compose: https://github.com/plausible/hosting https://github.com/plausible/hosting The hosting repo includes everything you need including databases, MaxMind GeoIP database, reverse proxy for SSL, etc. We don't host with docker-compose ourselves because we want to scale our databases independently from the app server. I'm not sure I understand your question. Secrets should never be committed to source control, whether the repo is public or not. Being open source does not change how we manage secrets in the slightest. Does that answer your question?