Self-hosting

Reverse proxy & HTTPS

Put Inkspace behind Caddy, Nginx, Traefik or Cloudflare Tunnel with HTTPS.

For anything reachable from the internet, run Inkspace behind a reverse proxy that terminates HTTPS. Whatever proxy you choose:

  • set BETTER_AUTH_URL to the external HTTPS URL, for example https://stories.example.com;
  • forward requests to the app on port 6767, keeping the original Host and Origin headers;
  • allow request bodies of at least 25 MB so data imports and 10 MB images fit;
  • never expose the PostgreSQL port publicly.

Caddy

Caddy obtains and renews certificates automatically.

stories.example.com {
	request_body {
		max_size 30MB
	}
	reverse_proxy localhost:6767
}

Nginx

server {
    listen 443 ssl;
    http2 on;
    server_name stories.example.com;

    ssl_certificate     /etc/letsencrypt/live/stories.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/stories.example.com/privkey.pem;

    client_max_body_size 30m;

    location / {
        proxy_pass http://127.0.0.1:6767;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Traefik

Add labels to the app service in your Compose file (assuming an existing Traefik instance with a websecure entrypoint and a letsencrypt resolver):

services:
  app:
    labels:
      - traefik.enable=true
      - traefik.http.routers.inkspace.rule=Host(`stories.example.com`)
      - traefik.http.routers.inkspace.entrypoints=websecure
      - traefik.http.routers.inkspace.tls.certresolver=letsencrypt
      - traefik.http.services.inkspace.loadbalancer.server.port=6767

When Traefik reaches the app over the Docker network, you can remove the ports: mapping from the app service entirely.

Cloudflare Tunnel

Point a public hostname at http://localhost:6767 (or http://app:6767 if cloudflared runs in the same Compose project), and set BETTER_AUTH_URL to the tunnel’s https:// hostname. No ports need to be opened on your router.

Checklist

  • BETTER_AUTH_URL uses https:// and matches the hostname exactly.
  • Signing in and uploading an avatar both work through the proxy.
  • Port 5432 is not reachable from outside your server.
  • Backups are scheduled — see Backups & restore.