Skip to the page
DataMosaic

Docs · Getting started

Run Mosaic

The hosted service, a download you unzip, or Docker — and what each one needs.

There are three ways to run Mosaic. They are the same product; they differ in who operates it and where your data sits.

#Hosted

Go to cloud.getdatamosaic.com and create an account. You get a workspace of your own and there is nothing to install.

Creating the account is one question a screen: your work email, a password of at least 12 characters, then your name and company. The account is made at that point, and its workspace takes your company's name. Two questions follow, both of which you can skip: how many stores you look after, and what should agree. The last screen asks where to start — a demo retailer with nine checks already run, connecting your POS or ERP, or fifteen minutes with the founder to set it up together.

Enter goes on to the next screen, and a letter picks an answer.

Everything works before you confirm your email address. Publishing a check, sending mail from a trigger and your plan wait for the link that was mailed to you.

Choose this if you want to try Mosaic today, or if your data is reachable from the internet. Your licence, plan and the self-hosting download all live under Tenancy → Plan in the account menu once you are in.

#On your own machine

Choose this when the systems you need to read are inside your network — which, for most retail estates, they are. Mosaic only needs outbound access; nothing has to be opened to it from outside.

The download is one package for Windows, macOS and Linux. There is no installer: it is a folder you unzip and two commands.

npm install --omit=dev --ignore-scripts
npm start

Mosaic then listens on 127.0.0.1:4317. Open that in a browser and you are at first sign-in.

The package deliberately ships without node_modules, because the Oracle and SQLite drivers are compiled per platform and have to be fetched on the machine that will run them. That first npm install is what does it, and it is why the folder grows to roughly 400 MB.

#What you need

Operating systemWindows 10, macOS 12, or any current Linux
Node.js22 or newer
DiskAbout 400 MB once the drivers are fetched
NetworkOutbound only

#Keeping it running

To run Mosaic as a background service rather than a terminal window:

node scripts/service.mjs install
node scripts/service.mjs status

#Docker

From a clone of the repository:

cd infrastructure/docker
cp .env.example .env
docker compose up -d

Mosaic answers on http://localhost:4317. Data persists in a named volume, mosaic-data, mounted at /var/lib/mosaic.

The compose file ships no Redis and no Postgres on purpose — the job queue is a table, so a single-container install has nothing else to operate.

#Settings worth knowing

Nothing has to be set to start a local install. Every one of these has a working default.

VariableDefaultWhat it does
MOSAIC_DATA_DIR%APPDATA%\Mosaic on Windows, ~/.local/share/Mosaic otherwiseWhere the database and encryption key live
MOSAIC_PORT4317The port Mosaic listens on
MOSAIC_HOST127.0.0.1Set to 0.0.0.0 to accept connections from other machines
MOSAIC_PUBLIC_URLhttp://<hostname>:<port>The address published pages and webhooks use
MOSAIC_LICENCEunsetA licence key, if you are not installing one through the interface
MOSAIC_DB_DRIVERsqlitepostgres for a multi-instance deployment; needs DATABASE_URL
MOSAIC_DEMO_WORKSPACEonSet to off to stop the Demo workspace being created
MOSAIC_REQUIRE_MFAoff1 makes two-factor authentication compulsory for everybody. See Two-factor and SSO
MOSAIC_OIDC_ISSUER, MOSAIC_OIDC_CLIENT_ID, MOSAIC_OIDC_CLIENT_SECRET, MOSAIC_OIDC_NAMEunsetSingle sign-on through your identity provider
MOSAIC_SAML_ENTRY_POINT, MOSAIC_SAML_IDP_ISSUER, MOSAIC_SAML_CERT, MOSAIC_SAML_NAMEunsetSingle sign-on over SAML 2.0, for providers without OpenID Connect
MOSAIC_SSO_ONLYoff1 refuses password sign-in once single sign-on is set up
MOSAIC_LOG_DRAIN_URL, MOSAIC_LOG_DRAIN_TOKEN, MOSAIC_LOG_DRAIN_AUTH_HEADERunsetSend the server log to your own log collector or SIEM as well as standard output: batches of JSON over HTTPS, with the token as a bearer token or in the header you name. Add _2 to each name for a second collector beside the first
MOSAIC_ALERT_WEBHOOK_URLunsetPost a message to a Slack, Teams or Discord incoming webhook when the server logs an error

#Where your data lives

A local install keeps everything in one directory — the one MOSAIC_DATA_DIR names. Inside it are mosaic.db, the SQLite database, and secret.key, which encrypts stored credentials. There is no shared state anywhere else on the machine, which is what makes the install a folder you can move or delete.

Back up that directory and you have backed up Mosaic.

#Backing up

Mosaic takes a copy of its database every day on its own, and owners can take one, download it or restore it under Storage → Backups (see Storage and audit). Those copies sit on the same disk, so also copy them somewhere else. If you back up the folder yourself:

  • Both files, together. mosaic.db without secret.key restores every check, but every stored database password and API key in it is unreadable, and there is no way to recover them.
  • Not a plain copy while Mosaic is running. The database is written continuously, and a file copied mid-write can be unusable. Either stop the service for the copy, or use SQLite's own online backup, which is safe while Mosaic runs:
sqlite3 mosaic.db ".backup 'mosaic-backup.db'"
  • On Postgres, back up the database with your usual tooling (pg_dump, or your provider's backups), and keep MOSAIC_MASTER_KEY with it, in a separate place.
  • Try a restore now and then: point a spare install's MOSAIC_DATA_DIR at a copy and sign in. A backup nobody has restored is a hope, not a backup.

For a deployment that runs more than one instance, point MOSAIC_DB_DRIVER at postgres and give it a DATABASE_URL. SQLite is a file, so it is single-host by construction.

#Next

First sign-in — claiming the installation and finding your way around.