DEV Community: Sanskriti Harmukh

Deploying Unbound Validating DNS Resolver on Ubuntu 24.04

Sanskriti Harmukh — Tue, 26 May 2026 15:22:46 +0000

Unbound is a validating, recursive, and caching DNS resolver that performs DNSSEC validation locally and answers queries without relying on third-party resolvers. This guide deploys Unbound using Docker Compose after freeing the system's port 53, with access controls that restrict who can query the resolver. By the end, you'll have a validating DNS resolver answering queries from approved clients on your server.

Free Port 53

Ubuntu's systemd-resolved binds port 53 by default. Release it before deploying.

1. Stop and disable systemd-resolved:

$ sudo systemctl stop systemd-resolved
$ sudo systemctl disable systemd-resolved

2. Replace the resolver configuration:

$ sudo rm /etc/resolv.conf
$ echo "nameserver 1.1.1.1" | sudo tee /etc/resolv.conf

Set Up the Directory Structure and Configuration

1. Create the project directory:

$ mkdir -p ~/unbound
$ cd ~/unbound

2. Create the Unbound configuration file:

$ nano unbound.conf

server:
  interface: 0.0.0.0
  interface: ::0
  port: 53

  access-control: 127.0.0.0/8 allow
  access-control: 192.168.0.0/16 allow
  access-control: 172.16.0.0/12 allow
  access-control: 10.0.0.0/8 allow
  access-control: YOUR_CLIENT_IP/32 allow
  access-control: 0.0.0.0/0 refuse

  hide-identity: yes
  hide-version: yes
  use-caps-for-id: yes
  prefetch: yes

  num-threads: 2
  msg-cache-slabs: 4
  rrset-cache-slabs: 4
  infra-cache-slabs: 4
  key-cache-slabs: 4
  rrset-cache-size: 100m
  msg-cache-size: 50m
  so-rcvbuf: 1m

remote-control:
  control-enable: no

Replace YOUR_CLIENT_IP/32 with the IP allowed to query the resolver.

Deploy with Docker Compose

1. Create the Docker Compose manifest:

$ nano docker-compose.yml

services:
  unbound:
    image: mvance/unbound:latest
    container_name: unbound
    restart: unless-stopped
    environment:
      TZ: UTC
    ports:
      - "53:53/tcp"
      - "53:53/udp"
    volumes:
      - ./unbound.conf:/opt/unbound/etc/unbound/unbound.conf:ro

2. Start the service:

$ docker compose up -d

3. Verify the service is running:

$ docker compose ps

Test Resolution

From an allowed client, query the resolver:

$ dig @SERVER_IP vultr.com

A valid answer section confirms Unbound is resolving queries.

Next Steps

Unbound is running with DNSSEC validation and tight access controls. From here you can:

Point your network's clients at the resolver to gain DNSSEC validation
Tune cache sizes and thread counts for your traffic volume
Layer block lists into unbound.conf to filter ads and malicious domains

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying Prometheus Metrics Collection Server on Ubuntu 24.04

Sanskriti Harmukh — Tue, 26 May 2026 15:22:17 +0000

Prometheus is an open-source systems monitoring and alerting toolkit that scrapes targets over HTTP and stores time-series metrics in a local TSDB. It exposes a powerful query language (PromQL) and pairs natively with Grafana for visualization. This guide deploys Prometheus using Docker Compose with Traefik handling automatic HTTPS, and verifies the server via a sample scrape config. By the end, you'll have Prometheus collecting and serving metrics over HTTPS at your domain.

Set Up the Directory Structure

1. Create the project directory structure:

$ mkdir -p ~/prometheus-monitoring/{prometheus-data,prometheus-config}
$ cd ~/prometheus-monitoring

2. Set ownership for the Prometheus data directory:

$ sudo chown -R 65534:65534 prometheus-data

3. Create the environment file:

$ nano .env

DOMAIN=prometheus.example.com
LETSENCRYPT_EMAIL=admin@example.com

4. Create the Prometheus configuration file:

$ nano prometheus-config/prometheus.yml

global:
  scrape_interval: 15s
  evaluation_interval: 15s

scrape_configs:
  - job_name: 'prometheus'
    static_configs:
      - targets: ['localhost:9090']

Deploy with Docker Compose

1. Create the Docker Compose manifest:

$ nano docker-compose.yaml

services:
  traefik:
    image: traefik:v3.6
    container_name: traefik
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "letsencrypt:/letsencrypt"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    restart: unless-stopped

  prometheus:
    image: prom/prometheus:latest
    container_name: prometheus
    hostname: prometheus
    expose:
      - "9090"
    volumes:
      - "./prometheus-config/prometheus.yml:/etc/prometheus/prometheus.yml"
      - "./prometheus-data:/prometheus"
    command:
      - "--config.file=/etc/prometheus/prometheus.yml"
      - "--storage.tsdb.path=/prometheus"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.prometheus.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.prometheus.entrypoints=websecure"
      - "traefik.http.routers.prometheus.tls.certresolver=letsencrypt"
      - "traefik.http.services.prometheus.loadbalancer.server.port=9090"
    restart: unless-stopped

volumes:
  letsencrypt:

2. Start the services:

$ docker compose up -d

3. Verify the services are running:

$ docker compose ps

4. View the logs:

$ docker compose logs

Access Prometheus

Open https://prometheus.example.com in a browser. Try a basic PromQL query in the expression bar to confirm scraping:

up — scrape status of every target
process_cpu_seconds_total — Prometheus's own CPU usage
process_resident_memory_bytes — Prometheus's own memory usage

Next Steps

Prometheus is running and scraping metrics over HTTPS. From here you can:

Add scrape targets for your application, node exporters, and infrastructure
Connect Prometheus as a data source in Grafana for dashboards
Configure alerting rules and route them through Alertmanager

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying Grafana Metrics Visualization Platform on Ubuntu 24.04

Sanskriti Harmukh — Tue, 26 May 2026 15:21:54 +0000

Grafana is an open-source dashboard and visualization platform that connects to dozens of data sources (Prometheus, Loki, Mimir, Tempo, PostgreSQL, and more) and renders metrics, logs, and traces in interactive panels. This guide deploys Grafana using Docker Compose with Traefik handling automatic HTTPS. By the end, you'll have Grafana running with a persistent data store and a secured admin login at your domain.

Set Up the Directory Structure

1. Create the project directory structure:

$ mkdir -p ~/grafana-monitoring/grafana-data
$ cd ~/grafana-monitoring

2. Set ownership for the Grafana data directory:

$ sudo chown -R 472:472 grafana-data

3. Create the environment file:

$ nano .env

DOMAIN=grafana.example.com
LETSENCRYPT_EMAIL=admin@example.com
GF_ADMIN_PASSWORD=changeme

Deploy with Docker Compose

1. Create the Docker Compose manifest:

$ nano docker-compose.yaml

services:
  traefik:
    image: traefik:v3.6
    container_name: traefik
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "letsencrypt:/letsencrypt"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    restart: unless-stopped

  grafana:
    image: grafana/grafana:latest
    container_name: grafana
    hostname: grafana
    expose:
      - "3000"
    volumes:
      - "./grafana-data:/var/lib/grafana"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=${GF_ADMIN_PASSWORD}
      - GF_SERVER_ROOT_URL=https://${DOMAIN}
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.grafana.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.grafana.entrypoints=websecure"
      - "traefik.http.routers.grafana.tls.certresolver=letsencrypt"
      - "traefik.http.services.grafana.loadbalancer.server.port=3000"
    restart: unless-stopped

volumes:
  letsencrypt:

2. Start the services:

$ docker compose up -d

3. Verify the services are running:

$ docker compose ps

4. View the logs:

$ docker compose logs

Access Grafana

Open https://grafana.example.com in a browser. Sign in with:

Username: admin
Password: the value of GF_ADMIN_PASSWORD from .env

Navigate to Connections → Data sources to wire in Prometheus, Loki, or other backends.

Next Steps

Grafana is running and served securely over HTTPS. From here you can:

Add Prometheus, Loki, Mimir, or Tempo as data sources
Import community dashboards or build custom ones for your stack
Configure alerting rules and notification channels

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying Gogs Simple Git Hosting on Ubuntu 24.04

Sanskriti Harmukh — Tue, 26 May 2026 15:21:29 +0000

Gogs (Go Git Service) is a lightweight, self-hosted Git server written in Go, designed to be fast, simple, and easy to run on modest hardware. This guide deploys Gogs with a PostgreSQL backend using Docker Compose, with Traefik handling automatic HTTPS and SSH exposed on port 2222. By the end, you'll have a Gogs instance ready for repositories at your domain.

Set Up the Directory Structure

1. Create the project directory structure:

$ mkdir -p ~/gogs/{data,db,letsencrypt}
$ cd ~/gogs

2. Create the environment file:

$ nano .env

POSTGRES_USER=gogs
POSTGRES_PASSWORD=STRONG_DB_PASSWORD
POSTGRES_DB=gogs

DOMAIN=gogs.example.com
LETSENCRYPT_EMAIL=admin@example.com

Deploy with Docker Compose

1. Add your user to the Docker group:

$ sudo usermod -aG docker $USER
$ newgrp docker

2. Create the Docker Compose manifest:

$ nano docker-compose.yml

services:
  traefik:
    image: traefik:latest
    container_name: traefik
    restart: unless-stopped
    environment:
      DOCKER_API_VERSION: "1.44"
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.le.acme.httpchallenge=true"
      - "--certificatesresolvers.le.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.le.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.le.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./letsencrypt:/letsencrypt

  db:
    image: postgres:16-alpine
    container_name: gogs-db
    restart: unless-stopped
    environment:
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DB=${POSTGRES_DB}
    volumes:
      - ./db:/var/lib/postgresql/data

  gogs:
    image: gogs/gogs:latest
    container_name: gogs
    restart: unless-stopped
    depends_on:
      - db
    ports:
      - "2222:22"
    volumes:
      - ./data:/data
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.gogs.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.gogs.entrypoints=websecure"
      - "traefik.http.routers.gogs.tls=true"
      - "traefik.http.routers.gogs.tls.certresolver=le"
      - "traefik.http.services.gogs.loadbalancer.server.port=3000"

3. Start the services:

$ docker compose up -d

4. Verify the services are running:

$ docker compose ps

Complete the Installation

Open https://gogs.example.com in a browser and fill in the install form:

Database Host: db:5432
Database User / Password / Name: the values from .env
SSH Port: 2222
Application URL: https://gogs.example.com/

Configure the administrator account and click Install Gogs.

Next Steps

Gogs is running and served securely over HTTPS. From here you can:

Create organizations and repositories, and invite collaborators
Push and clone via SSH on port 2222 or HTTPS on 443
Configure SMTP for email notifications and webhooks for CI integrations

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying MongoDB NoSQL Document Database on Ubuntu 24.04

Sanskriti Harmukh — Tue, 26 May 2026 15:21:07 +0000

MongoDB is an open-source NoSQL document database that stores data as flexible BSON documents and scales horizontally through sharding. This guide deploys MongoDB using Docker Compose with persistent volume storage and a root user, then verifies it with the mongosh shell. By the end, you'll have a MongoDB instance ready for application use on your server.

Set Up the Directory Structure

1. Create the project directory structure:

$ mkdir -p ~/mongodb-logging/mongodb-data
$ cd ~/mongodb-logging

2. Create the environment file:

$ nano .env

MONGO_ROOT_USERNAME=admin
MONGO_ROOT_PASSWORD=changeme

Pick a strong password before deploying.

Deploy with Docker Compose

1. Create the Docker Compose manifest:

$ nano docker-compose.yaml

services:
  mongodb:
    image: mongo:latest
    container_name: mongodb
    hostname: mongodb
    ports:
      - "27017:27017"
    volumes:
      - "./mongodb-data:/data/db"
    environment:
      - MONGO_INITDB_ROOT_USERNAME=${MONGO_ROOT_USERNAME}
      - MONGO_INITDB_ROOT_PASSWORD=${MONGO_ROOT_PASSWORD}
    restart: unless-stopped

2. Start the service:

$ docker compose up -d

3. Verify the service is running:

$ docker compose ps

4. View the logs:

$ docker compose logs

Access MongoDB

1. Open a mongosh shell inside the container:

$ docker exec -it mongodb mongosh -u admin -p changeme

2. Switch to an application database and insert a document:

use logs
db.application_logs.insertOne({ level: "info", message: "first entry", timestamp: new Date() })

3. Query and index the collection:

db.application_logs.find()
db.application_logs.createIndex({ timestamp: -1 })
show collections
exit

Next Steps

MongoDB is running with persistent storage and authenticated access. From here you can:

Create application-scoped users with db.createUser() instead of using root
Enable TLS by mounting certificates and adding --tlsMode requireTLS
Bind the port to 127.0.0.1 and front MongoDB with a VPN for remote access

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying Passbolt Team Password Manager on Ubuntu 24.04

Sanskriti Harmukh — Tue, 26 May 2026 15:20:46 +0000

Passbolt CE is an open-source, end-to-end encrypted password manager built for teams, with browser extensions and a web interface for secure credential sharing. This guide deploys Passbolt with a MariaDB backend using Docker Compose, with Traefik handling automatic HTTPS, then registers the first administrator. By the end, you'll have Passbolt running securely at your domain with the first admin account ready.

Set Up the Directory Structure

1. Create the project directory structure:

$ mkdir -p ~/passbolt/{db,gpg,letsencrypt}
$ sudo chown -R 33:33 ~/passbolt/gpg
$ cd ~/passbolt

2. Create the environment file:

$ nano .env

DOMAIN=passbolt.example.com
LETSENCRYPT_EMAIL=admin@example.com

MYSQL_USER=passbolt
MYSQL_PASSWORD=STRONG_DB_PASSWORD
MYSQL_DATABASE=passbolt

Deploy with Docker Compose

1. Add your user to the Docker group:

$ sudo usermod -aG docker $USER
$ newgrp docker

2. Create the Docker Compose manifest:

$ nano docker-compose.yml

services:
  traefik:
    image: traefik:latest
    container_name: traefik
    restart: unless-stopped
    environment:
      DOCKER_API_VERSION: "1.44"
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.le.acme.httpchallenge=true"
      - "--certificatesresolvers.le.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.le.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.le.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./letsencrypt:/letsencrypt

  db:
    image: mariadb:latest
    container_name: passbolt-db
    restart: unless-stopped
    environment:
      - MYSQL_RANDOM_ROOT_PASSWORD=yes
      - MYSQL_DATABASE=${MYSQL_DATABASE}
      - MYSQL_USER=${MYSQL_USER}
      - MYSQL_PASSWORD=${MYSQL_PASSWORD}
    volumes:
      - ./db:/var/lib/mysql

  passbolt:
    image: passbolt/passbolt:latest-ce
    container_name: passbolt
    restart: unless-stopped
    depends_on:
      - db
    environment:
      - APP_FULL_BASE_URL=https://${DOMAIN}
      - DATASOURCES_DEFAULT_HOST=db
      - DATASOURCES_DEFAULT_USERNAME=${MYSQL_USER}
      - DATASOURCES_DEFAULT_PASSWORD=${MYSQL_PASSWORD}
      - DATASOURCES_DEFAULT_DATABASE=${MYSQL_DATABASE}
    volumes:
      - ./gpg:/etc/passbolt/gpg
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.passbolt.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.passbolt.entrypoints=websecure"
      - "traefik.http.routers.passbolt.tls=true"
      - "traefik.http.routers.passbolt.tls.certresolver=le"
      - "traefik.http.services.passbolt.loadbalancer.server.port=80"

3. Start the services:

$ docker compose up -d

4. Verify the services are running:

$ docker compose ps

Create the First Administrator

$ docker compose exec passbolt su -m -c "/usr/share/php/passbolt/bin/cake passbolt register_user -u admin@example.com -f FIRSTNAME -l LASTNAME -r admin" -s /bin/sh www-data

The command prints a one-time setup URL. Open it in a browser, install the Passbolt browser extension, and complete the account creation flow.

Next Steps

Passbolt is running and served securely over HTTPS. From here you can:

Invite team members and organize credentials into shared groups
Configure SMTP for invitation and notification emails
Enable MFA (TOTP, YubiKey, or DUO) for admin and team accounts

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying OpenWebUI Local AI Interface on Ubuntu 24.04

Sanskriti Harmukh — Tue, 26 May 2026 15:20:17 +0000

Open WebUI is a self-hosted, ChatGPT-style interface for local and remote AI models, supporting Ollama, OpenAI-compatible endpoints, and per-user authentication. This guide deploys Open WebUI using Docker Compose with Traefik handling automatic HTTPS. By the end, you'll have an Open WebUI instance running securely at your domain, ready to point at a model backend.

Set Up the Directory Structure

1. Create the project directory:

$ mkdir -p ~/openwebui/data
$ cd ~/openwebui

2. Create the environment file:

$ nano .env

DOMAIN=openwebui.example.com
LETSENCRYPT_EMAIL=admin@example.com

Deploy with Docker Compose

1. Create the Docker Compose manifest:

$ nano docker-compose.yaml

services:
  traefik:
    image: traefik:v3.6
    container_name: traefik
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "letsencrypt:/letsencrypt"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    restart: unless-stopped

  openwebui:
    image: ghcr.io/open-webui/open-webui:main
    container_name: openwebui
    hostname: openwebui
    expose:
      - "8080"
    volumes:
      - "./data:/app/backend/data"
    environment:
      - WEBUI_AUTH=true
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.openwebui.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.openwebui.entrypoints=websecure"
      - "traefik.http.routers.openwebui.tls.certresolver=letsencrypt"
      - "traefik.http.services.openwebui.loadbalancer.server.port=8080"
    restart: unless-stopped

volumes:
  letsencrypt:

2. Start the services:

$ docker compose up -d

3. Verify the services are running:

$ docker compose ps

4. View the logs:

$ docker compose logs

Access Open WebUI

Open https://openwebui.example.com in a browser. The first user you register becomes the administrator. Additional users sign up through the same flow and can be managed from Admin Panel → Users.

Next Steps

Open WebUI is running and served securely over HTTPS. From here you can:

Connect a local Ollama instance or any OpenAI-compatible endpoint as a model backend
Enable RAG by uploading documents to the knowledge base
Configure per-user model permissions and rate limits from the admin panel

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying Bitwarden Password Management Vault on Ubuntu 24.04

Sanskriti Harmukh — Tue, 26 May 2026 15:19:46 +0000

Bitwarden is an open-source, end-to-end encrypted password manager. The official self-hosted server runs as a stack of Docker containers and ships with an interactive installer that wires up TLS and the database. This guide installs the official Bitwarden server on Ubuntu 24.04, configures automatic Let's Encrypt TLS through the installer, and creates the first vault user. By the end, you'll have a self-hosted Bitwarden vault available securely at your domain.

Prerequisites: Ubuntu 24.04 with at least 2 GB RAM (4 GB recommended), Docker + Docker Compose installed, a domain pointed at the server, and an Installation ID + Key from bitwarden.com/host.

Prepare the Environment

1. Add your user to the Docker group:

$ sudo usermod -aG docker $USER
$ newgrp docker

2. Create and own the install directory:

$ sudo mkdir -p /opt/bitwarden
$ sudo chown -R $USER:$USER /opt/bitwarden
$ cd /opt/bitwarden

Download and Install Bitwarden

1. Fetch the installer script:

$ curl -Lso bitwarden.sh https://go.btwrdn.co/bw-sh
$ chmod 700 bitwarden.sh

2. Run the installer:

$ ./bitwarden.sh install

Answer the interactive prompts:

Domain name: your fully qualified domain (e.g. bitwarden.example.com)
Use Let's Encrypt: y (recommended) — supply a contact email
Database name: vault (default is fine)
Installation ID and Key: from bitwarden.com/host
Region: US or EU to match where you obtained your install ID

Start the Server

1. Bring the stack online:

$ ./bitwarden.sh start

2. Confirm the containers are running:

$ docker container ls

The first start downloads images and builds configuration. Initial start can take a few minutes.

Create Your First User

Open https://bitwarden.example.com in a browser.
Click Create Account and complete the signup form.
Verify the email address (configure SMTP in /opt/bitwarden/bwdata/env/global.override.env if not already set).
Sign in to create your first organization and vault items.

Warning: Bitwarden uses zero-knowledge encryption. If the master password is lost, the vault cannot be recovered. Save it in a secure offline location.

Next Steps

Bitwarden is running securely at your domain. From here you can:

Configure SMTP so users receive invitations and password reset emails
Set up scheduled backups of /opt/bitwarden/bwdata
Use ./bitwarden.sh update and ./bitwarden.sh restart to roll new releases

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying GitLab CE DevOps Management Suite on Ubuntu 24.04

Sanskriti Harmukh — Tue, 26 May 2026 15:19:00 +0000

GitLab CE (Community Edition) is a complete, open-source DevOps platform that combines source code management, CI/CD pipelines, security testing, and project planning in a single application. This guide deploys GitLab CE using Docker Compose with Traefik handling automatic HTTPS, then retrieves the initial root password. By the end, you'll have a self-hosted GitLab instance running securely at your domain.

Set Up the Directory Structure

1. Create the project directory structure:

$ mkdir -p ~/gitlab/{config,logs,data,letsencrypt}
$ cd ~/gitlab

2. Create the environment file:

$ nano .env

GITLAB_DOMAIN=gitlab.example.com
LETSENCRYPT_EMAIL=admin@example.com

Deploy with Docker Compose

1. Add your user to the Docker group:

$ sudo usermod -aG docker $USER
$ newgrp docker

2. Create the Docker Compose manifest:

$ nano docker-compose.yml

services:
  traefik:
    image: traefik:latest
    container_name: traefik
    restart: unless-stopped
    environment:
      DOCKER_API_VERSION: "1.44"
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.le.acme.httpchallenge=true"
      - "--certificatesresolvers.le.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.le.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.le.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./letsencrypt:/letsencrypt

  gitlab:
    image: gitlab/gitlab-ce:latest
    container_name: gitlab
    restart: always
    hostname: ${GITLAB_DOMAIN}
    shm_size: '256m'
    environment:
      GITLAB_OMNIBUS_CONFIG: |
        external_url 'https://${GITLAB_DOMAIN}'
        nginx['listen_port'] = 80
        nginx['listen_https'] = false
        nginx['proxy_set_headers'] = {
          "X-Forwarded-Proto" => "https",
          "X-Forwarded-Ssl" => "on"
        }
        gitlab_rails['gitlab_shell_ssh_port'] = 2222
    ports:
      - "2222:22"
    volumes:
      - ./config:/etc/gitlab
      - ./logs:/var/log/gitlab
      - ./data:/var/opt/gitlab
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.gitlab.rule=Host(`${GITLAB_DOMAIN}`)"
      - "traefik.http.routers.gitlab.entrypoints=websecure"
      - "traefik.http.routers.gitlab.tls=true"
      - "traefik.http.routers.gitlab.tls.certresolver=le"
      - "traefik.http.services.gitlab.loadbalancer.server.port=80"

3. Start the services:

$ docker compose up -d

4. Verify the services are running:

$ docker compose ps

GitLab takes a few minutes to initialize on the first start.

Access GitLab

1. Retrieve the initial root password:

$ sudo docker exec -it gitlab grep 'Password:' /etc/gitlab/initial_root_password

This file auto-deletes after 24 hours, so capture the password right away.

2. Sign in:

URL: https://gitlab.example.com
Username: root
Password: the value from the command above

Change the root password immediately after first login.

Next Steps

GitLab CE is running and served securely over HTTPS. From here you can:

Create groups and projects, and invite team members
Configure GitLab Runners to execute CI/CD pipelines
Set up SMTP for email notifications and SAML/OIDC for SSO

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying n8n Workflow Automation Engine on Ubuntu 24.04

Sanskriti Harmukh — Tue, 26 May 2026 15:18:31 +0000

n8n is an open-source, node-based workflow automation engine (a self-hosted alternative to Zapier and Make) with hundreds of integrations and full control over data flow. This guide deploys n8n using Docker Compose with Traefik handling automatic HTTPS. By the end, you'll have an n8n instance running securely at your domain, ready to build workflows.

Set Up the Directory Structure

1. Create the project directory structure:

$ mkdir -p ~/n8n-automation/n8n-data
$ cd ~/n8n-automation

2. Set ownership for the n8n data directory:

$ sudo chown -R 1000:1000 n8n-data

3. Create the environment file:

$ nano .env

DOMAIN=n8n.example.com
LETSENCRYPT_EMAIL=admin@example.com

Deploy with Docker Compose

1. Create the Docker Compose manifest:

$ nano docker-compose.yaml

services:
  traefik:
    image: traefik:v3.6
    container_name: traefik
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "letsencrypt:/letsencrypt"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    restart: unless-stopped

  n8n:
    image: n8nio/n8n:latest
    container_name: n8n
    hostname: n8n
    expose:
      - "5678"
    volumes:
      - "./n8n-data:/home/node/.n8n"
    environment:
      - N8N_HOST=${DOMAIN}
      - N8N_PORT=5678
      - N8N_PROTOCOL=https
      - WEBHOOK_URL=https://${DOMAIN}/
      - GENERIC_TIMEZONE=UTC
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.n8n.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.n8n.entrypoints=websecure"
      - "traefik.http.routers.n8n.tls.certresolver=letsencrypt"
      - "traefik.http.services.n8n.loadbalancer.server.port=5678"
    restart: unless-stopped

volumes:
  letsencrypt:

2. Start the services:

$ docker compose up -d

3. Verify the services are running:

$ docker compose ps

4. View the logs:

$ docker compose logs

Access n8n

Open https://n8n.example.com in a browser. The first sign-up creates the owner account — from there you can build workflows in the node-based editor or import community templates.

Next Steps

n8n is running and served securely over HTTPS. From here you can:

Connect to your services with built-in nodes (HTTP, databases, SaaS APIs, AI)
Add credentials and create scheduled, webhook-triggered, or event-driven workflows
Switch persistence to PostgreSQL for production-scale workloads

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying Tempo Distributed Tracing Backend on Ubuntu 24.04

Sanskriti Harmukh — Wed, 20 May 2026 14:04:17 +0000

Tempo is an open-source, high-scale distributed tracing backend from Grafana Labs that ingests trace spans over Jaeger, OpenTelemetry, and Zipkin protocols. It requires only object storage and pairs natively with Grafana for trace visualization. This guide deploys Tempo using Docker Compose with Traefik handling automatic HTTPS, and verifies the backend through its status endpoints. By the end, you'll have Tempo accepting trace spans over HTTPS at your domain.

Set Up the Directory Structure

1. Create the project directory structure:

$ mkdir -p ~/tempo-tracing/{tempo-data,tempo-config}
$ cd ~/tempo-tracing

2. Set ownership for the Tempo data directory:

$ sudo chown -R 10001:10001 tempo-data

3. Create the environment file:

$ nano .env

DOMAIN=tempo.example.com
LETSENCRYPT_EMAIL=admin@example.com

4. Create the Tempo configuration file:

$ nano tempo-config/tempo-config.yaml

server:
  http_listen_port: 3200

distributor:
  receivers:
    jaeger:
      protocols:
        thrift_http:
        grpc:
    otlp:
      protocols:
        http:
        grpc:

storage:
  trace:
    backend: local
    local:
      path: /var/tempo/traces
    wal:
      path: /var/tempo/wal

compactor:
  compaction:
    block_retention: 168h

Deploy with Docker Compose

1. Create the Docker Compose manifest:

$ nano docker-compose.yaml

services:
  traefik:
    image: traefik:v3.6
    container_name: traefik
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "letsencrypt:/letsencrypt"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    restart: unless-stopped

  tempo:
    image: grafana/tempo:latest
    container_name: tempo
    hostname: tempo
    expose:
      - "3200"
      - "4317"
      - "4318"
      - "14250"
      - "14268"
    volumes:
      - "./tempo-config/tempo-config.yaml:/etc/tempo/tempo.yaml"
      - "./tempo-data:/var/tempo"
    command: -config.file=/etc/tempo/tempo.yaml
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.tempo.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.tempo.entrypoints=websecure"
      - "traefik.http.routers.tempo.tls.certresolver=letsencrypt"
      - "traefik.http.services.tempo.loadbalancer.server.port=3200"
    restart: unless-stopped

volumes:
  letsencrypt:

2. Start the services:

$ docker compose up -d

3. Verify the services are running:

$ docker compose ps

4. View the logs:

$ docker compose logs

Access Tempo

1. Check the readiness endpoint:

$ curl https://tempo.example.com/ready

A ready response confirms the backend is up.

2. Query the service status:

$ curl https://tempo.example.com/status

3. Check the build information:

$ curl https://tempo.example.com/api/status/buildinfo

{"version":"v2.9.0","revision":"032d47627","branch":"main","buildUser":"","buildDate":"","goVersion":"go1.25.1"}

Next Steps

Tempo is running and accepting distributed trace spans over HTTPS. From here you can:

Add Tempo as a data source in Grafana for trace visualization
Point OpenTelemetry, Jaeger, or Zipkin exporters at your domain
Swap the local storage backend for S3-compatible object storage at scale

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying Technitium DNS Server Platform on Ubuntu 24.04

Sanskriti Harmukh — Wed, 20 May 2026 14:04:03 +0000

Technitium DNS Server is an open-source, authoritative and recursive DNS server built for privacy and security, with DNS-over-TLS, DNS-over-HTTPS, ad blocking, and a modern web console for zone and record management. This guide deploys Technitium using Docker Compose with Traefik securing the web console over HTTPS, after freeing the system's port 53. By the end, you'll have a working DNS server resolving queries with an HTTPS-secured admin console.

Free Port 53

Ubuntu's systemd-resolved binds port 53 by default. Release it before deploying.

1. Stop and disable systemd-resolved:

$ sudo systemctl stop systemd-resolved
$ sudo systemctl disable systemd-resolved

2. Replace the resolver configuration:

$ sudo rm /etc/resolv.conf
$ echo "nameserver 1.1.1.1" | sudo tee /etc/resolv.conf

Set Up the Directory Structure

1. Create the project directory structure:

$ mkdir -p ~/technitium/{config,letsencrypt}
$ cd ~/technitium

2. Create the environment file:

$ nano .env

DOMAIN=technitium.example.com
LETSENCRYPT_EMAIL=admin@example.com

Deploy with Docker Compose

1. Add your user to the Docker group:

$ sudo usermod -aG docker $USER
$ newgrp docker

2. Create the Docker Compose manifest:

$ nano docker-compose.yml

services:
  traefik:
    image: traefik:latest
    container_name: traefik
    restart: unless-stopped
    environment:
      DOCKER_API_VERSION: "1.44"
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=traefik-public"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.le.acme.httpchallenge=true"
      - "--certificatesresolvers.le.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.le.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.le.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./letsencrypt:/letsencrypt

  dns-server:
    image: technitium/dns-server:latest
    container_name: dns-server
    restart: unless-stopped
    environment:
      - TZ=UTC
      - DNS_SERVER_DOMAIN=${DOMAIN}
    ports:
      - "53:53/udp"
      - "53:53/tcp"
    volumes:
      - ./config:/etc/dns
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dns.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.dns.entrypoints=websecure"
      - "traefik.http.routers.dns.tls=true"
      - "traefik.http.routers.dns.tls.certresolver=le"
      - "traefik.http.services.dns.loadbalancer.server.port=5380"

3. Start the services:

$ docker compose up -d

4. Verify the services are running:

$ docker compose ps

Initial Configuration

Navigate to https://technitium.example.com.
Log in with the default credentials admin / admin.
Change the password when prompted.
Go to Settings → Proxy & Forwarders.
Add upstream DNS providers, one per line: 1.1.1.1 and 8.8.8.8.
Click Save Settings.

Test Resolution

From any machine, query the server by its IP:

$ dig @SERVER_IP vultr.com

A valid answer section confirms the DNS server is resolving queries.

Next Steps

Technitium is running with an HTTPS-secured console. From here you can:

Create authoritative zones and records for your domains
Enable DNS-over-TLS and DNS-over-HTTPS for encrypted resolution
Turn on block lists to filter ads and malicious domains network-wide

For the full guide with additional tips, visit the original article on Vultr Docs.