DEV Community: Sanskriti Harmukh

Deploying Label Studio Open-Source Data Labeling Platform on Ubuntu 24.04

Sanskriti Harmukh — Tue, 16 Jun 2026 20:57:20 +0000

Label Studio is an open-source data labeling platform that supports annotation across text, images, audio, video, and time series, with collaborative workflows and ML-model integrations. This guide deploys Label Studio using Docker Compose with Traefik handling automatic HTTPS and persistent volumes for projects and labels. By the end, you'll have Label Studio serving an annotation workspace securely at your domain.

Set Up the Directory Structure

1. Create the project directory:

$ mkdir ~/labelstudio
$ cd ~/labelstudio

2. Create the environment file:

$ nano .env

DOMAIN=labelstudio.example.com
LETSENCRYPT_EMAIL=admin@example.com

Deploy with Docker Compose

1. Create the Compose manifest:

$ nano docker-compose.yaml

services:
  traefik:
    image: traefik:v3.6
    container_name: traefik
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "./letsencrypt:/letsencrypt"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    restart: unless-stopped

  labelstudio:
    image: heartexlabs/label-studio:1.23.0
    container_name: labelstudio
    expose:
      - "8080"
    environment:
      - DJANGO_ALLOWED_HOSTS=${DOMAIN}
      - CSRF_TRUSTED_ORIGINS=https://${DOMAIN}
      - USE_X_FORWARDED_HOST=true
      - SECURE_PROXY_SSL_HEADER=HTTP_X_FORWARDED_PROTO,https
    volumes:
      - ./data:/label-studio/data
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.labelstudio.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.labelstudio.entrypoints=websecure"
      - "traefik.http.routers.labelstudio.tls.certresolver=letsencrypt"
      - "traefik.http.services.labelstudio.loadbalancer.server.port=8080"
    restart: unless-stopped

2. Create the data directory with group write access:

$ mkdir data
$ sudo chown :0 data

3. Start the services:

$ docker compose up -d

4. Verify the services and view logs:

$ docker compose ps
$ docker compose logs

Create the Admin and a Sample Project

1. Open https://labelstudio.example.com and click Sign Up to create the first administrator.

2. From the dashboard, click Create Project and set:

Project Name: Sentiment Analysis
Labeling Template: Text Classification

3. Click Save, then Import and paste the sample data:

[
  {"text": "This product is amazing."},
  {"text": "Worst experience ever."}
]

4. Annotate each task, click Submit, and confirm the Data Manager shows them as Completed.

Next Steps

Label Studio is running and served securely over HTTPS. From here you can:

Configure ML backends (PyTorch, scikit-learn) for active learning loops
Invite collaborators with role-based permissions per project
Export annotated datasets in COCO, YOLO, JSON, or CSV for downstream training

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying Kestra Open-Source Workflow Orchestration Platform on Ubuntu 24.04

Sanskriti Harmukh — Tue, 16 Jun 2026 20:55:36 +0000

Kestra is an open-source workflow orchestration platform that runs YAML-defined pipelines on schedules, triggers, or events, with a web UI for managing executions, logs, and metadata. This guide deploys Kestra using Docker Compose with a PostgreSQL backend and Traefik handling automatic HTTPS. By the end, you'll have Kestra running a sample workflow with a SUCCESS execution at your domain.

Set Up the Directory Structure

1. Create the project directories:

$ mkdir -p ~/kestra/data/{postgres,kestra,traefik}
$ cd ~/kestra

postgres/ holds the database, kestra/ holds execution artifacts, traefik/ holds Let's Encrypt certificates.

2. Create the environment file:

$ nano .env

POSTGRES_DB=kestra
POSTGRES_USER=kestra
POSTGRES_PASSWORD=STRONG-PASSWORD
DOMAIN=kestra.example.com
LETSENCRYPT_EMAIL=admin@example.com

Deploy with Docker Compose

1. Create the Compose manifest:

$ nano docker-compose.yml

services:
  traefik:
    image: traefik:v3.6
    restart: unless-stopped
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./data/traefik:/letsencrypt

  postgres:
    image: postgres:15
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB}
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    volumes:
      - ./data/postgres:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER}"]
      interval: 10s
      timeout: 5s
      retries: 5

  kestra:
    image: kestra/kestra:v1.3.6
    restart: unless-stopped
    command: server standalone
    environment:
      KESTRA_CONFIGURATION: |
        datasources:
          postgres:
            url: jdbc:postgresql://postgres:5432/${POSTGRES_DB}
            driverClassName: org.postgresql.Driver
            username: ${POSTGRES_USER}
            password: ${POSTGRES_PASSWORD}
        kestra:
          repository:
            type: postgres
          storage:
            type: local
            local:
              basePath: /app/storage
          queue:
            type: postgres
    volumes:
      - ./data/kestra:/app/storage
    depends_on:
      postgres:
        condition: service_healthy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.kestra.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.kestra.entrypoints=websecure"
      - "traefik.http.routers.kestra.tls.certresolver=letsencrypt"
      - "traefik.http.services.kestra.loadbalancer.server.port=8080"

2. Start the services:

$ docker compose up -d

3. Verify the services are running:

$ docker compose ps
$ docker compose logs

Create the Admin Account

Open https://kestra.example.com.
On the Create an admin user page, fill in email and a password with ≥8 characters, ≥1 uppercase, ≥1 number.
Click Create admin user, then Start Kestra UI.

Create and Run a Sample Workflow

1. Click **Flows → Create in the sidebar, then paste:**

id: hello_world
namespace: demo

tasks:
  - id: log_message
    type: io.kestra.core.tasks.log.Log
    message: "Hello from Kestra!"

2. Click **Save, then Execute in the top right.**

3. Open **Executions and select the run** — the status should read SUCCESS.

Next Steps

Kestra is running and served securely over HTTPS. From here you can:

Add schedules, webhook triggers, and event-based triggers to your flows
Install plugins for AWS, GCP, Kubernetes, dbt, and Python tasks
Wire RBAC for multi-team usage and store secrets via the secret manager

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying Jina Serve Open-Source Neural Search and AI Serving Framework on Ubuntu 24.04

Sanskriti Harmukh — Tue, 16 Jun 2026 20:55:00 +0000

Jina Serve is an open-source framework for building neural search and multimodal AI applications, with a cloud-native runtime that handles dynamic batching, async streaming, and microservice orchestration. This guide deploys a Jina Flow with a custom text executor using Docker Compose, with Traefik handling automatic HTTPS in front of the gateway. By the end, you'll have a Jina Flow serving an /index and /search API securely at your domain.

Set Up the Directory Structure

1. Create the project directory structure:

$ mkdir -p ~/jina-serve/executor
$ cd ~/jina-serve

2. Create the executor module:

$ nano executor/executor.py

from jina import Executor, requests
from docarray import BaseDoc, DocList

class TextDoc(BaseDoc):
    text: str = ""

class TextProcessor(Executor):
    @requests(on="/index")
    def index(self, docs: DocList[TextDoc], **kwargs) -> DocList[TextDoc]:
        for doc in docs:
            if doc.text:
                doc.text = doc.text.upper()
        return docs

    @requests(on="/search")
    def search(self, docs: DocList[TextDoc], **kwargs) -> DocList[TextDoc]:
        return docs

3. Pin the executor's Python dependencies:

$ nano executor/requirements.txt

jina==3.34.0
docarray>=0.40.0

4. Wire the executor into Jina's loader:

$ nano executor/config.yml

jtype: TextProcessor
py_modules:
  - executor.py

5. Define the Flow:

$ nano flow.yml

jtype: Flow
with:
  protocol: http
  port: 8080

executors:
  - name: textprocessor
    uses: executor/config.yml

6. Build the container image with the Flow baked in:

$ nano Dockerfile

FROM jinaai/jina:3.34.0-py39-standard

WORKDIR /app

COPY executor/requirements.txt /app/executor/requirements.txt
RUN pip install --no-cache-dir -r /app/executor/requirements.txt

COPY executor /app/executor
COPY flow.yml /app/flow.yml

ENTRYPOINT ["jina", "flow", "--uses", "flow.yml"]

7. Create the environment file:

$ nano .env

DOMAIN=jina.example.com
LETSENCRYPT_EMAIL=admin@example.com
JINA_LOG_LEVEL=INFO

Deploy with Docker Compose

1. Create the Compose manifest:

$ nano docker-compose.yml

services:
  traefik:
    image: traefik:v3.6
    container_name: traefik
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "./letsencrypt:/letsencrypt"
    restart: unless-stopped

  jina:
    build:
      context: .
      dockerfile: Dockerfile
    container_name: jina-flow
    environment:
      - JINA_LOG_LEVEL=${JINA_LOG_LEVEL}
    expose:
      - "8080"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.jina.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.jina.entrypoints=websecure"
      - "traefik.http.routers.jina.tls.certresolver=letsencrypt"
      - "traefik.http.services.jina.loadbalancer.server.port=8080"
    restart: unless-stopped

2. Build and start the stack:

$ docker compose up -d --build

3. Verify the services and tail logs:

$ docker compose ps
$ docker compose logs

Verify the Gateway

1. Check the status endpoint:

$ curl https://jina.example.com/status

{"jina":{"jina":"3.34.0","docarray":"0.40.1"...

2. POST a document to /index:

$ curl -X POST https://jina.example.com/index \
    -H "Content-Type: application/json" \
    -d '{"data": [{"text": "hello world"}]}'

{"data":[{"id":null,"text":"HELLO WORLD"}],...}

3. POST to /search to see the passthrough endpoint:

$ curl -X POST https://jina.example.com/search \
    -H "Content-Type: application/json" \
    -d '{"data": [{"text": "test message"}]}'

4. Submit a batch of documents:

$ curl -X POST https://jina.example.com/index \
    -H "Content-Type: application/json" \
    -d '{"data": [{"text": "first"}, {"text": "second"}, {"text": "third"}]}'

Next Steps

Jina Serve is running and serving requests over HTTPS. From here you can:

Add more executors to the Flow for pre-processing, embedding, and ranking
Switch the runtime to GPU images for accelerated inference
Persist embeddings in Qdrant, Weaviate, or other vector stores

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying Instant Open-Source Firebase Alternative on Ubuntu 24.04

Sanskriti Harmukh — Tue, 16 Jun 2026 20:54:16 +0000

Instant (InstantDB) is an open-source, real-time backend platform (a self-hosted alternative to Firebase) built around a PostgreSQL store with relational queries, authentication, and live sync. This guide deploys Instant using Docker Compose with PostgreSQL and Traefik for automatic HTTPS. By the end, you'll have Instant serving its backend API securely at your domain.

Set Up the Directory Structure

1. Create the project directory and clone Instant:

$ mkdir ~/instant
$ cd ~/instant
$ git clone https://github.com/instantdb/instant.git app
$ cd app/server

2. Move the bundled Compose file aside (we'll provide our own):

$ mv docker-compose.yml docker-compose.yml.bak

3. Create the environment file:

$ nano .env

TZ=UTC

DOMAIN=instant.example.com
EMAIL=admin@example.com

POSTGRES_USER=instant
POSTGRES_PASSWORD=YOUR_DATABASE_PASSWORD
POSTGRES_DB=instant

Deploy with Docker Compose

1. Create the Compose manifest:

$ nano docker-compose.yml

services:
  traefik:
    image: traefik:v3.6
    container_name: traefik
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.letsencrypt.acme.email=${EMAIL}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "./letsencrypt:/letsencrypt"
    restart: unless-stopped

  postgres:
    image: ghcr.io/instantdb/postgresql:postgresql-16-pg-hint-plan
    container_name: postgres
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
    volumes:
      - ./postgres-data:/var/lib/postgresql/data
    command:
      - postgres
      - -c
      - wal_level=logical
      - -c
      - max_replication_slots=4
      - -c
      - max_wal_senders=4
      - -c
      - shared_preload_libraries=pg_hint_plan
      - -c
      - random_page_cost=1.1
    healthcheck:
      test: ["CMD", "pg_isready", "-U", "instant"]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped

  server:
    build:
      context: .
      dockerfile: Dockerfile-dev
    container_name: instant
    working_dir: /app
    command: ["make", "dev-oss"]
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      TZ: ${TZ}
      DATABASE_URL: "postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}"
      NREPL_BIND_ADDRESS: "0.0.0.0"
    volumes:
      - ./:/app
    expose:
      - "8888"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.instant.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.instant.entrypoints=websecure"
      - "traefik.http.routers.instant.tls.certresolver=letsencrypt"
      - "traefik.http.services.instant.loadbalancer.server.port=8888"
    restart: unless-stopped

2. Build and start the stack:

$ docker compose up -d --build

3. Verify the services and tail logs:

$ docker compose ps
$ docker compose logs

Verify the Backend

1. Test the HTTPS endpoint:

$ curl https://instant.example.com

You should see:

<code>Welcome to Instant's Backend!</code>

Note: First request may take ~1 minute while Let's Encrypt issues the certificate.

2. Confirm in a browser:

Open https://instant.example.com and verify the page loads over HTTPS.

Verify Database Connectivity

1. Open a psql session inside the postgres container:

$ docker compose exec postgres psql -U instant -d instant

2. Run sample DDL/DML:

CREATE TABLE messages (id SERIAL PRIMARY KEY, content TEXT NOT NULL, created_at TIMESTAMP DEFAULT NOW());
INSERT INTO messages (content) VALUES ('Hello from Instant'), ('Real-time sync test');
SELECT id, content, created_at FROM messages ORDER BY created_at DESC;
\q

3. Review backend logs:

$ docker compose logs --tail=20 server

Next Steps

Instant is running and served securely over HTTPS. From here you can:

Wire client SDKs against your domain for live-sync apps
Configure authentication providers and per-table permissions
Set up backups against the postgres-data volume for durability

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying Immich, an Open-Source Alternative to Google Photos, on Ubuntu 24.04

Sanskriti Harmukh — Tue, 16 Jun 2026 20:53:30 +0000

Immich is an open-source photo and video management platform — a self-hosted alternative to Google Photos — with native mobile apps, machine-learning search, and automatic backup. This guide deploys Immich using Docker Compose, fronts it with Nginx, and secures it with a Let's Encrypt TLS certificate. By the end, you'll have Immich syncing photos and videos securely at your domain.

Set Up the Directory Structure

1. Create the project directory:

$ mkdir ~/immich
$ cd ~/immich

2. Download the official .env template:

$ wget -O .env https://github.com/immich-app/immich/releases/latest/download/example.env

3. Edit the environment file:

$ nano .env

Uncomment and set the timezone, plus customize secrets:

TZ=Europe/London

Key variables in the file:

UPLOAD_LOCATION — where uploaded media is stored
DB_DATA_LOCATION — PostgreSQL data path
IMMICH_VERSION — Immich release tag
DB_PASSWORD, DB_USERNAME, DB_DATABASE_NAME — database credentials

Deploy with Docker Compose

1. Download the official Compose manifest:

$ wget https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml

This brings up three services: immich-server, postgres, and valkey for cache/queues.

2. Add your user to the Docker group:

$ sudo usermod -aG docker $USER
$ newgrp docker

3. Start the stack:

$ docker compose up -d

4. Verify the services are running and the API responds:

$ docker compose ps
$ curl -X GET 127.0.0.1:2283

Front Immich with Nginx

1. Install and enable Nginx:

$ sudo apt update
$ sudo apt install nginx -y
$ sudo systemctl enable nginx

2. Remove the default site:

$ sudo rm /etc/nginx/sites-enabled/default

3. Create the Immich virtual host:

$ sudo nano /etc/nginx/sites-available/immich.conf

server {
    listen 80;
    server_name immich.example.com;

    location / {
        client_max_body_size 10M;
        proxy_pass http://127.0.0.1:2283;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

4. Enable the site and reload:

$ sudo ln -s /etc/nginx/sites-available/immich.conf /etc/nginx/sites-enabled/
$ sudo nginx -t
$ sudo systemctl restart nginx

5. Open the firewall:

$ sudo ufw allow 80/tcp
$ sudo ufw allow 443/tcp
$ sudo ufw reload

Issue a Let's Encrypt Certificate

$ sudo apt install certbot python3-certbot-nginx -y
$ sudo certbot --nginx -d immich.example.com -m admin@example.com --non-interactive

Certbot edits the Nginx config in place and enables auto-renewal.

Access and Configure Immich

Open https://immich.example.com and click Getting Started.
Create the admin account with email, password, and display name.
Sign in and walk through the initial settings: theme, language, privacy, storage template, backup strategy.
Click Upload to add a batch of photos. They appear under Photos once processed.

Add team members from Administration → Users with per-user storage quotas.

Next Steps

Immich is running and served securely over HTTPS. From here you can:

Install the iOS / Android app and point it at your domain for automatic phone backup
Enable machine-learning search and face recognition for richer organisation
Move UPLOAD_LOCATION to Vultr Block Storage to scale beyond the host disk

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying Discourse Open-Source Community Discussion Platform on Ubuntu 24.04

Sanskriti Harmukh — Tue, 16 Jun 2026 20:52:38 +0000

Discourse is an open-source community discussion platform that merges traditional forums, mailing-list workflows, and real-time conversations into a mobile-first interface. This guide deploys Discourse on Ubuntu 24.04 using the official installer, which handles Docker setup, configuration generation, and automatic Let's Encrypt HTTPS. By the end, you'll have a Discourse forum running securely at your domain with the community dashboard ready.

Prerequisite: A Discourse ID account at id.discourse.com. Custom domain or a free discourse.diy subdomain works.

Claim a Free Subdomain (Optional)

If you don't have a custom domain:

Visit https://id.discourse.com/my/subdomain.
Sign in with your Discourse ID account.
Pick a unique subdomain (e.g. mydiscourse.discourse.diy).
Click Claim Subdomain.
Generate the verification code (expires in 10 minutes — keep it ready).

Run the Discourse Installer

Warning: Run installer scripts only from trusted sources. The Discourse installer runs as root and modifies Docker, firewall rules, and TLS settings.

1. Create the project directory:

$ mkdir discourse
$ cd discourse

2. Download and execute the installer:

$ wget -qO- https://raw.githubusercontent.com/discourse/discourse_docker/main/install-discourse | sudo bash

The script installs Docker, generates configuration, enables Let's Encrypt, and launches the setup wizard.

Configure the Deployment

The interactive wizard prompts for:

Admin email — your Discourse ID account email.
Domain selection — No to use a discourse.diy subdomain (enter the verification code); Yes for a custom domain already pointing at the server.
SMTP configuration — No to defer until later; Yes to configure SMTP now.

After reviewing the settings, select Yes to deploy. The first build can take a few minutes.

Verify the container is running:

$ docker ps

Look for a container named app using the local_discourse/app image with ports 80 and 443 mapped.

Access the Discourse Dashboard

1. Open the site over HTTPS:

https://discourse.example.com

2. Sign in with **Login with Discourse ID.**

3. Complete the Getting Started wizard:

Community name — forum title.
Language — primary interface language.
Visibility — public (searchable) or private (login required).
Registration — open sign-up or invite only.
Account approval — toggle moderator review for new users.

4. Create a starter category and publish an introduction topic from the New Topic button.

Next Steps

Discourse is running with HTTPS at your domain. From here you can:

Configure SMTP under Admin → Email for transactional and digest emails
Install themes and plugins from the official marketplace
Enable single sign-on (Discourse Connect, SAML, OAuth) to bridge your existing user base

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying CyberChef Open-Source Data Transformation Platform on Ubuntu 24.04

Sanskriti Harmukh — Tue, 16 Jun 2026 20:52:04 +0000

CyberChef is GCHQ's open-source "cyber swiss army knife", a browser-based tool for encoding, encryption, compression, and data analysis pipelines. Everything runs client-side, so no data ever leaves the browser. This guide deploys CyberChef using Docker Compose with Traefik handling automatic HTTPS. By the end, you'll have CyberChef serving its full operations catalogue securely at your domain.

Set Up the Directory Structure

1. Create the project directory:

$ mkdir -p ~/cyberchef
$ cd ~/cyberchef

2. Create the environment file:

$ nano .env

DOMAIN=cyberchef.example.com
LETSENCRYPT_EMAIL=admin@example.com

CyberChef is stateless — no other directories are needed.

Deploy with Docker Compose

1. Create the Docker Compose manifest:

$ nano docker-compose.yaml

services:
  traefik:
    image: traefik:v3.6
    container_name: traefik
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "letsencrypt:/letsencrypt"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    restart: unless-stopped

  cyberchef:
    image: ghcr.io/gchq/cyberchef:10.22.0
    container_name: cyberchef
    expose:
      - "80"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.cyberchef.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.cyberchef.entrypoints=websecure"
      - "traefik.http.routers.cyberchef.tls.certresolver=letsencrypt"
      - "traefik.http.services.cyberchef.loadbalancer.server.port=80"
    restart: unless-stopped

volumes:
  letsencrypt:

2. Start the services:

$ docker compose up -d

3. Verify the services are running:

$ docker compose ps
$ docker compose logs

Access CyberChef

Open https://cyberchef.example.com in a browser. The four-panel UI loads:

Operations (left): searchable transform list
Recipe (centre): chain of operations
Input (top right): paste data
Output (bottom right): result

Run a Sample Recipe

1. Paste the Base64 input:

Q3liZXJDaGVmIHN1Y2Nlc3NmdWxseSBkZXBsb3llZCE=

2. Search for From Base64, drag it into the Recipe panel, then click Bake.

The Output panel shows:

CyberChef successfully deployed!

Next Steps

CyberChef is running and served securely over HTTPS. From here you can:

Save recipes as shareable URLs or JSON for reuse
Pin operations as favourites for quick recall
Front CyberChef with Authelia or basic auth if you want access control

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying CapRover Self-Hosted PaaS for Docker Applications on Ubuntu 24.04

Sanskriti Harmukh — Tue, 16 Jun 2026 20:50:21 +0000

CapRover is an open-source, self-hosted Platform-as-a-Service that automates application deployment with Docker Swarm, Nginx, and automatic Let's Encrypt certificates. This guide deploys CapRover on Ubuntu 24.04 using Docker Compose, opens the required firewall ports, enables HTTPS for the dashboard, and deploys a sample app from the one-click marketplace. By the end, you'll have a CapRover PaaS running apps on subdomains of your wildcard root domain.

Prerequisite: A wildcard DNS A record (e.g. *.apps.example.com) pointing at the server's IP. Don't use a proxying DNS (Cloudflare orange-cloud), or the ACME challenge will fail.

Set Up the Directory Structure

1. Create the project directory:

$ mkdir -p ~/caprover
$ cd ~/caprover

2. Create the environment file:

$ nano .env

ACCEPTED_TERMS=true
DEFAULT_PASSWORD=StrongPassword-321
CAPROVER_ROOT_DOMAIN=apps.example.com

Deploy with Docker Compose

1. Create the Docker Compose manifest:

$ nano docker-compose.yml

services:
  caprover:
    image: caprover/caprover:1.14.1
    ports:
      - "80:80"
      - "443:443"
      - "3000:3000"
    environment:
      ACCEPTED_TERMS: "${ACCEPTED_TERMS}"
      DEFAULT_PASSWORD: "${DEFAULT_PASSWORD}"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /captain:/captain

Configure the Firewall

1. Allow SSH and the CapRover ports:

$ sudo ufw allow OpenSSH
$ sudo ufw allow 80,443,996,7946,4789,2377/tcp
$ sudo ufw allow 3000/tcp
$ sudo ufw allow 7946,4789,2377,443/udp

2. Enable and verify the firewall:

$ sudo ufw enable
$ sudo ufw status

Port 3000 is the initial dashboard and will be closed after HTTPS is forced.

Start CapRover

1. Launch the stack in detached mode:

$ docker compose up -d

2. Verify Swarm services and tail the init logs:

$ docker service ls
$ docker service logs captain-captain --tail 20

Wait until the log prints Captain is initialized and ready to serve you.

Configure the Dashboard

1. Sign in:

Open http://YOUR_SERVER_IP:3000 and authenticate with DEFAULT_PASSWORD from .env.

2. Set the root domain:

Enter apps.example.com, click Update Domain, and reopen http://YOUR_SERVER_IP:3000 once CapRover confirms DNS resolution.

3. Enable and force HTTPS:

Click Enable HTTPS, enter the Let's Encrypt email, then click Force HTTPS. The dashboard now lives at https://captain.apps.example.com.

4. Close port 3000 and change the password:

$ sudo ufw delete allow 3000/tcp

Change the dashboard password from Settings in the sidebar.

Deploy a Sample App

1. From the dashboard, open Apps → One-Click Apps/Databases.

Search Uptime Kuma.
Set the App Name to uptime-kuma and the version to latest.
Click Deploy.

5. Enable HTTPS for the app:

Go to Apps → uptime-kuma, confirm Websocket Support is enabled, click Enable HTTPS, check Force HTTPS, and click Save & Restart. The app is live at https://uptime-kuma.apps.example.com.

If a deploy fails, check:

$ docker service logs captain-captain --tail 50

Next Steps

CapRover is running with HTTPS for the dashboard and a sample app deployed. From here you can:

Deploy your own apps via the CapRover CLI (captain-cli) or tar.gz upload
Wire git push deploys with GitHub/GitLab webhooks
Cluster multiple servers into a single Swarm for horizontal scaling

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying Cal.com Open-Source Calendly Alternative on Ubuntu 24.04

Sanskriti Harmukh — Tue, 16 Jun 2026 20:49:41 +0000

Cal.com is an open-source scheduling platform (a self-hosted alternative to Calendly) that handles bookings, event types, and calendar integrations on infrastructure you control. This guide deploys Cal.com with a PostgreSQL backend using Docker Compose, with Traefik handling automatic HTTPS. By the end, you'll have Cal.com serving bookings securely at your domain.

Set Up the Directory Structure

1. Create the project directory:

$ mkdir calcom
$ cd calcom

2. Generate two random secrets:

$ openssl rand -base64 32
$ openssl rand -base64 32

Save the outputs — they go into .env as NEXTAUTH_SECRET and CALENDSO_ENCRYPTION_KEY.

3. Create the environment file:

$ nano .env

NODE_ENV=production

DOMAIN=cal.example.com
LETSENCRYPT_EMAIL=admin@example.com

NEXT_PUBLIC_WEBAPP_URL=https://cal.example.com
NEXTAUTH_URL=https://cal.example.com
ALLOWED_HOSTNAMES=["cal.example.com"]
NEXTAUTH_URL_INTERNAL=http://calcom:3000
AUTH_TRUST_HOST=true

NEXTAUTH_SECRET=REPLACE_WITH_GENERATED_SECRET
CALENDSO_ENCRYPTION_KEY=REPLACE_WITH_GENERATED_ENCRYPTION_KEY

DATABASE_URL=postgresql://calcom:calcompass@postgres:5432/calcom
DATABASE_DIRECT_URL=postgresql://calcom:calcompass@postgres:5432/calcom

CALCOM_TELEMETRY_DISABLED=1
CAL_SIGNATURE_TOKEN=self-hosted

Deploy with Docker Compose

1. Add your user to the Docker group:

$ sudo usermod -aG docker $USER
$ newgrp docker

2. Create the Docker Compose manifest:

$ nano docker-compose.yaml

services:
  traefik:
    image: traefik:v3.6
    container_name: traefik
    restart: unless-stopped
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.le.acme.httpchallenge=true"
      - "--certificatesresolvers.le.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.le.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.le.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./letsencrypt:/letsencrypt

  postgres:
    image: postgres:15
    container_name: postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: calcom
      POSTGRES_PASSWORD: calcompass
      POSTGRES_DB: calcom
    volumes:
      - ./postgres-data:/var/lib/postgresql/data

  calcom:
    image: calcom/cal.com:v6.2.0
    container_name: calcom
    env_file:
      - .env
    depends_on:
      - postgres
    expose:
      - "3000"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.calcom.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.calcom.entrypoints=websecure"
      - "traefik.http.routers.calcom.tls=true"
      - "traefik.http.routers.calcom.tls.certresolver=le"
      - "traefik.http.services.calcom.loadbalancer.server.port=3000"
    volumes:
      - ./calcom-data:/data/app/.data
    restart: unless-stopped

3. Start the services:

$ docker compose up -d

4. Verify the services are running:

$ docker compose ps
$ docker compose logs calcom

Complete the Setup Wizard

Navigate to https://cal.example.com/auth/setup.
Fill in administrator username, full name, email, and password.
Accept the AGPLv3 license option.
Pick integrations and complete profile (timezone, calendars, video conferencing).
Set availability and event types.

Create and Test a Booking

Open the sidebar and select Event Types → New.
Fill in title, description, and duration.
Copy the booking URL, open it in an incognito window, pick a slot, and confirm.
Refresh the Bookings view to see the new event appear.

Next Steps

Cal.com is running and served securely over HTTPS. From here you can:

Connect Google, Microsoft 365, or Apple calendars for two-way sync
Add team event types with round-robin or collective scheduling
Configure webhooks and Zapier triggers for downstream automation

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying Authelia Open-Source Authentication and Authorization Gateway on Ubuntu 24.04

Sanskriti Harmukh — Tue, 16 Jun 2026 20:49:01 +0000

Authelia is an open-source authentication and authorization gateway that adds SSO, two-factor authentication, and policy-based access control in front of web applications, integrating natively with reverse proxies through forward-auth. This guide deploys Authelia using Docker Compose with Traefik handling automatic HTTPS, file-backed users, TOTP 2FA, and a sample whoami app protected by forward-auth. By the end, you'll have Authelia gating multiple subdomains with SSO and 2FA over HTTPS.

Set Up the Directory Structure

1. Create the project directory structure:

$ mkdir -p ~/authelia/{config,secrets,logs}
$ cd ~/authelia

2. Create the environment file:

$ nano .env

DOMAIN=example.com
LETSENCRYPT_EMAIL=admin@example.com

DNS A records for auth.${DOMAIN}, app.${DOMAIN}, and traefik.${DOMAIN} must point at the server.

Generate Authelia Secrets

1. Own the secrets directory:

$ sudo chown 8000:8000 ./secrets
$ sudo chmod 0700 ./secrets

2. Generate session, storage, and JWT secrets in one shot:

$ docker run --rm -u 8000:8000 -v ./secrets:/secrets docker.io/authelia/authelia:4.39 \
    sh -c "cd /secrets && authelia crypto rand --length 64 session_secret.txt storage_encryption_key.txt jwt_secret.txt"

Write the Authelia Configuration

1. Create the configuration file:

$ nano config/configuration.yml

server:
  address: 'tcp4://:9091'

log:
  level: 'info'
  file_path: '/var/log/authelia/authelia.log'
  keep_stdout: true

identity_validation:
  elevated_session:
    require_second_factor: true
  reset_password:
    jwt_lifespan: '5 minutes'
    jwt_secret: {{ secret "/secrets/jwt_secret.txt" | mindent 0 "|" | msquote }}

totp:
  disable: false
  issuer: 'example.com'
  period: 30
  skew: 1

authentication_backend:
  file:
    path: '/config/users.yml'
    password:
      algorithm: 'argon2'
      argon2:
        variant: 'argon2id'
        iterations: 3
        memory: 65535
        parallelism: 4
        key_length: 32
        salt_length: 16

access_control:
  default_policy: 'deny'
  rules:
    - domain: 'app.example.com'
      policy: 'two_factor'
    - domain: 'traefik.example.com'
      policy: 'one_factor'

session:
  name: 'authelia_session'
  secret: {{ secret "/secrets/session_secret.txt" | mindent 0 "|" | msquote }}
  cookies:
    - domain: 'example.com'
      authelia_url: 'https://auth.example.com'

regulation:
  max_retries: 4
  find_time: 120
  ban_time: 300

storage:
  encryption_key: {{ secret "/secrets/storage_encryption_key.txt" | mindent 0 "|" | msquote }}
  local:
    path: '/config/db.sqlite3'

notifier:
  disable_startup_check: false
  filesystem:
    filename: '/config/notification.txt'

2. Generate an argon2 hash for the first user's password:

$ docker run --rm authelia/authelia:4.39 authelia crypto hash generate argon2 --password 'your-secure-password'

3. Create the user database with that hash:

$ nano config/users.yml

users:
  authuser:
    displayname: 'Auth User'
    password: '$argon2id$v=19$m=65536,t=3,p=4$BpLnfgDsc2WD8F2q$Zis.ixdg9s/UOJYrs56b5QEZFiZECu0qZVNsIYxBaNJ7ucIL.nlxVCT5tqh8KHG8X4tlwCFm5r6NTOZZ5qRFN/'
    email: 'authuser@example.com'
    groups:
      - 'admin'

Deploy with Docker Compose

1. Create the Docker Compose manifest:

$ nano docker-compose.yaml

services:
  traefik:
    image: traefik:v3.6
    container_name: traefik
    depends_on:
      - authelia
    command:
      - "--api.dashboard=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "./letsencrypt:/letsencrypt"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.dashboard.rule=Host(`traefik.${DOMAIN}`)"
      - "traefik.http.routers.dashboard.entrypoints=websecure"
      - "traefik.http.routers.dashboard.tls.certresolver=letsencrypt"
      - "traefik.http.routers.dashboard.service=api@internal"
      - "traefik.http.routers.dashboard.middlewares=authelia@docker"
    restart: unless-stopped

  authelia:
    image: authelia/authelia:4.39
    container_name: authelia
    volumes:
      - "./secrets:/secrets:ro"
      - "./config:/config"
      - "./logs:/var/log/authelia"
    environment:
      TZ: "UTC"
      X_AUTHELIA_CONFIG_FILTERS: "template"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.authelia.rule=Host(`auth.${DOMAIN}`)"
      - "traefik.http.routers.authelia.entrypoints=websecure"
      - "traefik.http.routers.authelia.tls.certresolver=letsencrypt"
      - "traefik.http.middlewares.authelia.forwardAuth.address=http://authelia:9091/api/authz/forward-auth"
      - "traefik.http.middlewares.authelia.forwardAuth.trustForwardHeader=true"
      - "traefik.http.middlewares.authelia.forwardAuth.authResponseHeaders=Remote-User,Remote-Groups,Remote-Name,Remote-Email"
    restart: unless-stopped

  whoami:
    image: traefik/whoami
    container_name: whoami
    depends_on:
      - authelia
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.whoami.rule=Host(`app.${DOMAIN}`)"
      - "traefik.http.routers.whoami.entrypoints=websecure"
      - "traefik.http.routers.whoami.tls.certresolver=letsencrypt"
      - "traefik.http.routers.whoami.middlewares=authelia@docker"
    restart: unless-stopped

2. Start the services:

$ docker compose up -d

3. Verify the services are running:

$ docker compose ps
$ docker compose logs

Register TOTP and Test SSO

1. Open the login portal:

Navigate to https://auth.example.com and sign in as authuser.

2. Register a TOTP device:

Click Register device and capture the verification code from the filesystem notifier:

$ docker compose exec authelia cat /config/notification.txt

Scan the QR code with an authenticator app and enter the 6-digit code.

3. Visit a protected app:

Open https://app.example.com — the request redirects through Authelia for password + TOTP, then the whoami container returns the injected identity headers.

4. Confirm SSO:

Open https://traefik.example.com from the same browser — no re-authentication required.

Next Steps

Authelia is gating multiple subdomains with SSO and 2FA. From here you can:

Protect more apps by adding traefik.http.routers.<svc>.middlewares=authelia@docker and a matching access_control rule
Switch the authentication backend to LDAP or OpenID Connect 1.0
Configure SMTP under notifier to deliver verification codes by email

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying Vector High-Performance Observability Data Pipeline on Ubuntu 24.04

Sanskriti Harmukh — Wed, 10 Jun 2026 22:24:20 +0000

Vector is a high-performance observability data pipeline from Datadog that collects, transforms, and routes logs, metrics, and traces across heterogeneous backends. This guide deploys Vector using Docker Compose with Traefik handling automatic HTTPS for the GraphQL API and HTTP ingest endpoint, plus a working sources → transforms → sinks pipeline. By the end, you'll have Vector accepting JSON over HTTPS and forwarding it to multiple sinks on your server.

Set Up the Directory Structure and Configuration

1. Create the project directory structure:

$ mkdir -p ~/vector/{config,data}
$ cd ~/vector

2. Create the environment file:

$ nano .env

DOMAIN=vector.example.com
LETSENCRYPT_EMAIL=admin@example.com

3. Create the Vector pipeline configuration:

$ nano config/vector.yaml

api:
  enabled: true
  address: "0.0.0.0:8686"

sources:
  demo_logs:
    type: "demo_logs"
    format: "syslog"
    interval: 1.0

  http_input:
    type: "http_server"
    address: "0.0.0.0:8080"
    decoding:
      codec: "json"

transforms:
  parse_logs:
    type: "remap"
    inputs:
      - "demo_logs"
      - "http_input"
    source: |
      .processed_at = now()
      .pipeline = "vector-demo"

sinks:
  console_output:
    type: "console"
    inputs:
      - "parse_logs"
    encoding:
      codec: "json"

  file_output:
    type: "file"
    inputs:
      - "parse_logs"
    path: "/var/lib/vector/logs-%Y-%m-%d.log"
    encoding:
      codec: "json"

  http_output:
    type: "http"
    inputs:
      - "parse_logs"
    uri: "https://httpbin.org/post"
    encoding:
      codec: "json"
    batch:
      max_bytes: 1048576
      timeout_secs: 10

Deploy with Docker Compose

1. Create the Docker Compose manifest:

$ nano docker-compose.yaml

services:
  traefik:
    image: traefik:v3.6
    container_name: traefik
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "./letsencrypt:/letsencrypt"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    restart: unless-stopped

  vector:
    image: timberio/vector:0.44.0-alpine
    container_name: vector
    expose:
      - "8080"
      - "8686"
    volumes:
      - "./config/vector.yaml:/etc/vector/vector.yaml:ro"
      - "./data:/var/lib/vector"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.vector-api.rule=Host(`${DOMAIN}`) && (PathPrefix(`/playground`) || PathPrefix(`/graphql`) || PathPrefix(`/health`))"
      - "traefik.http.routers.vector-api.entrypoints=websecure"
      - "traefik.http.routers.vector-api.tls.certresolver=letsencrypt"
      - "traefik.http.routers.vector-api.service=vector-api"
      - "traefik.http.services.vector-api.loadbalancer.server.port=8686"
      - "traefik.http.routers.vector-ingest.rule=Host(`${DOMAIN}`) && PathPrefix(`/ingest`)"
      - "traefik.http.routers.vector-ingest.entrypoints=websecure"
      - "traefik.http.routers.vector-ingest.tls.certresolver=letsencrypt"
      - "traefik.http.routers.vector-ingest.service=vector-ingest"
      - "traefik.http.services.vector-ingest.loadbalancer.server.port=8080"
      - "traefik.http.middlewares.strip-ingest.stripprefix.prefixes=/ingest"
      - "traefik.http.routers.vector-ingest.middlewares=strip-ingest"
    restart: unless-stopped

2. Start the services:

$ docker compose up -d

3. Verify the services are running:

$ docker compose ps
$ docker compose logs vector

Verify the Pipeline

1. POST a JSON log to the ingest endpoint:

$ curl -X POST https://vector.example.com/ingest \
    -H "Content-Type: application/json" \
    -d '{"level":"error","service":"api","message":"Database connection timeout","user_id":12345}'

2. Confirm the file sink wrote the event:

$ ls -lh data/
$ grep "Database connection timeout" data/logs-*.log

3. Stream the live console sink:

$ docker compose logs -f vector

Next Steps

Vector is running with HTTPS ingest and three sinks active. From here you can:

Add sources for files, Kafka, syslog, journald, or Kubernetes logs
Route to production sinks (Loki, Elasticsearch, S3, Datadog, Splunk)
Use VRL (Vector Remap Language) for richer transforms and enrichment

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying Dokku Lightweight Open-Source PaaS on Ubuntu 24.04

Sanskriti Harmukh — Wed, 10 Jun 2026 22:23:48 +0000

Dokku is an open-source, Heroku-like Platform-as-a-Service that lets you git push apps and have them built and deployed automatically. This guide deploys Dokku on Ubuntu 24.04 with Docker Compose, registers an SSH key, deploys a sample Ruby app, and switches the proxy to Traefik for automatic HTTPS. By the end, you'll have a Dokku PaaS running an app at your domain over HTTPS.

Set Up the Directory Structure

1. Create the project directory:

$ mkdir -p ~/dokku/data
$ cd ~/dokku

2. Create the environment file:

$ nano .env

DOKKU_HOSTNAME=dokku.example.com
DOKKU_VERSION=0.37.6

Deploy with Docker Compose

1. Add your user to the Docker group:

$ sudo usermod -aG docker $USER
$ newgrp docker

2. Create the Docker Compose manifest:

$ nano docker-compose.yml

services:
  dokku:
    image: dokku/dokku:${DOKKU_VERSION}
    container_name: dokku
    network_mode: bridge
    ports:
      - "3022:22"
    volumes:
      - "./data:/mnt/dokku"
      - "/var/run/docker.sock:/var/run/docker.sock"
    environment:
      DOKKU_HOSTNAME: ${DOKKU_HOSTNAME}
      DOKKU_HOST_ROOT: /var/lib/dokku/home/dokku
      DOKKU_LIB_HOST_ROOT: /var/lib/dokku/var/lib/dokku
    restart: unless-stopped

3. Start the service:

$ docker compose up -d
$ docker compose ps

Register an SSH Key

1. Generate a key on your workstation:

$ ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 -C "dokku"
$ cat ~/.ssh/id_ed25519.pub

2. Register the public key with Dokku:

$ echo "YOUR_SSH_KEY" | docker compose exec -T dokku dokku ssh-keys:add admin
$ docker compose exec -it dokku dokku ssh-keys:list

3. Add a Dokku entry to your SSH config:

$ nano ~/.ssh/config

Host dokku-server
  HostName YOUR_SERVER_IP
  User dokku
  Port 3022
  IdentityFile ~/.ssh/id_ed25519

Deploy a Sample App

1. Create the app on the server:

$ ssh dokku-server apps:create ruby-getting-started
$ ssh dokku-server apps:list

2. Clone the sample app locally and push it:

$ git clone https://github.com/heroku/ruby-getting-started
$ cd ruby-getting-started
$ git remote add dokku dokku-server:ruby-getting-started
$ git push dokku main

Switch to Traefik with Let's Encrypt

1. Stop the default Nginx proxy and enable Traefik:

$ ssh dokku-server nginx:stop
$ ssh dokku-server proxy:set --global traefik
$ ssh dokku-server traefik:set --global letsencrypt-email username@example.com

2. Assign the domain and start Traefik:

$ ssh dokku-server domains:set ruby-getting-started dokku.example.com
$ ssh dokku-server traefik:start
$ ssh dokku-server ps:rebuild ruby-getting-started

Open https://dokku.example.com to confirm the app is served over HTTPS.

Manage Environment Variables

$ ssh dokku-server config:set ruby-getting-started SECRET_KEY=your-secret-value
$ ssh dokku-server config:set ruby-getting-started DB_HOST=localhost DB_USER=admin DB_PASS=secret
$ ssh dokku-server config:show ruby-getting-started
$ ssh dokku-server config:unset ruby-getting-started SECRET_KEY

Next Steps

Dokku is running with an app deployed via git push and Traefik handling HTTPS. From here you can:

Install plugins for PostgreSQL, MySQL, Redis, and other backing services
Configure zero-downtime deploys with checks and procfile health endpoints
Deploy multiple apps under subdomains by repeating the apps:create flow

For the full guide with additional tips, visit the original article on Vultr Docs.