Step 3 — Configure services
Pick one tool per pipeline layer, provide credentials, and OrcheStack pulls the Docker images you chose — writing a generated docker-compose.yml and .env under the hood.
Pick your tools
After signing up, you land on the Service selection page. Each pipeline layer has a dropdown with a tested default and documented alternatives:
- Ingestion — Airbyte (recommended), Custom Python, None
- Orchestration — Apache Airflow (core, always-on)
- Warehouse — PostgreSQL (recommended), ClickHouse, DuckDB
- Data lake — MinIO (core)
- Transformation — dbt Core (recommended), SQLMesh
- Data quality — Great Expectations (recommended), Soda Core, None
- Governance — OpenMetadata (recommended), DataHub, None
- BI — Metabase (recommended), Apache Superset, Lightdash
- Database admin UI — pgAdmin (recommended), Adminer, pgweb, None
Pick the defaults if you're unsure — they're the ones OrcheStack tests end-to-end.
Enter credentials
For each service you enabled, OrcheStack shows a credentials form. The fields are specific to that tool — for example, OpenMetadata asks for:
- Admin email and password
- JWT secret (32+ characters)
- PostgreSQL backend details (host, port, database, user, password)
OrcheStack runs a live connection test against every backend before allowing you to proceed. Invalid credentials fail fast — no container rebuilds burning time.
Where credentials go. OrcheStack writes them to a file at ./config/.env on the host, chmod 600-protected. Your docker-compose.yml references them via ${VAR} placeholders. Add ./config to your .gitignore before committing anything — you don't want credentials in source control.
Pull and start
Once you click Save & deploy, OrcheStack does three things:
- Regenerates
docker-compose.ymlwith just the services you picked. - Pulls each service's Docker image (first time only — cached after).
- Runs
docker compose up -dto start hot-tier services and register cold-tier services with the orchestrator.
Expect the first-time pull to take 2–5 minutes depending on your internet connection. Subsequent saves are near-instant.
Editing credentials later
From the OrcheStack admin dashboard, click any service tile and choose Edit config. Saving a change writes the new value to .env and issues:
docker compose up -d --force-recreate <service>
Container recreation picks up the new environment variables. Data volumes are preserved, so you don't lose history when rotating a password.
Heads up for admins. Any credential change triggers a container recreation. If a service currently has active user sessions (e.g. someone is using pgAdmin), OrcheStack will ask you to confirm because recreation disconnects them. Scheduled updates during off-hours are safest.