DEV Community: Vultr

Deploying Zabbix Open-Source Monitoring Platform on Ubuntu 24.04

Sanskriti Harmukh — Tue, 23 Jun 2026 18:42:34 +0000

Zabbix is an open-source monitoring platform that tracks the health and performance of servers, networks, applications, and services, with built-in alerting and visualisation. This guide deploys the Zabbix server, web UI, agent, and MySQL database using Docker Compose, with Traefik handling automatic HTTPS for the dashboard. By the end, you'll have Zabbix monitoring its own host with a secured dashboard at your domain.

Set Up the Project Directory

1. Create the project directory:

$ mkdir ~/zabbix-docker
$ cd ~/zabbix-docker

2. Create the environment file:

$ nano .env

DOMAIN=zabbix.example.com
LETSENCRYPT_EMAIL=admin@example.com
MYSQL_PASSWORD=YOUR_DB_PASSWORD
MYSQL_ROOT_PASSWORD=YOUR_ROOT_PASSWORD

Deploy with Docker Compose

1. Add your user to the Docker group:

$ sudo usermod -aG docker $USER
$ newgrp docker

2. Create the Compose manifest:

$ nano docker-compose.yaml

services:
  traefik:
    image: traefik:v3.6
    container_name: traefik
    restart: unless-stopped
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.le.acme.httpchallenge=true"
      - "--certificatesresolvers.le.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.le.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.le.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./letsencrypt:/letsencrypt
    networks:
      - zabbix-net

  mysql-server:
    image: mysql:8.4.8
    container_name: zabbix-mysql
    environment:
      MYSQL_DATABASE: zabbix
      MYSQL_USER: zabbix
      MYSQL_PASSWORD: ${MYSQL_PASSWORD}
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
    volumes:
      - ./mysql-data:/var/lib/mysql
    networks:
      - zabbix-net
    restart: unless-stopped

  zabbix-server:
    image: zabbix/zabbix-server-mysql:7.4.8-alpine
    container_name: zabbix-server
    environment:
      DB_SERVER_HOST: mysql-server
      MYSQL_DATABASE: zabbix
      MYSQL_USER: zabbix
      MYSQL_PASSWORD: ${MYSQL_PASSWORD}
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
    ports:
      - "10051:10051"
    volumes:
      - ./zabbix-server-data:/var/lib/zabbix
    networks:
      - zabbix-net
    depends_on:
      - mysql-server
    restart: unless-stopped

  zabbix-web:
    image: zabbix/zabbix-web-apache-mysql:7.4.8-alpine
    container_name: zabbix-web
    environment:
      DB_SERVER_HOST: mysql-server
      MYSQL_DATABASE: zabbix
      MYSQL_USER: zabbix
      MYSQL_PASSWORD: ${MYSQL_PASSWORD}
      ZBX_SERVER_HOST: zabbix-server
      PHP_TZ: UTC
    networks:
      - zabbix-net
    depends_on:
      - mysql-server
      - zabbix-server
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.zabbix.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.zabbix.entrypoints=websecure"
      - "traefik.http.routers.zabbix.tls=true"
      - "traefik.http.routers.zabbix.tls.certresolver=le"
      - "traefik.http.services.zabbix.loadbalancer.server.port=8080"

  zabbix-agent:
    image: zabbix/zabbix-agent:7.4.8-alpine
    container_name: zabbix-agent
    environment:
      ZBX_HOSTNAME: "Zabbix server"
      ZBX_SERVER_HOST: zabbix-server
    ports:
      - "10050:10050"
    networks:
      - zabbix-net
    depends_on:
      - zabbix-server
    restart: unless-stopped

networks:
  zabbix-net:
    driver: bridge

3. Start the stack:

$ docker compose up -d
$ docker compose ps

Sign In and Change the Admin Password

Open https://zabbix.example.com.
Sign in with admin / zabbix.
Open Users → Users, click Admin, click Change password, enter the current password, set a new one, and click Update.

Verify the Built-in Host

Navigate to Monitoring → Hosts.
Find Zabbix server in the list and check the ZBX availability badge.
If the badge is red, click the host name, open Configuration → Host, change the agent Connect to field from IP to DNS, enter zabbix-agent in the DNS name field, and click Update.
Refresh — the badge should turn green.
Open Monitoring → Latest data, filter by host Zabbix server, and confirm CPU, memory, and network metrics arrive.

Next Steps

Zabbix is running and served securely over HTTPS. From here you can:

Add more hosts by deploying the Zabbix agent on remote servers and registering them
Import community templates for common workloads (PostgreSQL, Nginx, MySQL, Linux)
Configure media types (email, Slack, PagerDuty) and triggers for alerting

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying SeaweedFS, an Open-Source S3 Storage Alternative to MinIO, on Ubuntu 24.04

Sanskriti Harmukh — Tue, 23 Jun 2026 18:42:14 +0000

SeaweedFS is an open-source, distributed object storage system with an S3-compatible API, a filer for POSIX-style hierarchical access, and a small footprint. This guide deploys SeaweedFS using Docker Compose with the master, volume, filer, S3, and admin services behind Traefik for automatic HTTPS on separate admin and S3 domains. By the end, you'll have SeaweedFS serving S3-compatible object storage securely at your domains.

Prerequisite: Two DNS A records pointing at the server — storage.example.com (admin dashboard) and s3.storage.example.com (S3 API). AWS CLI installed on your local machine for testing.

Set Up the Directory Structure

1. Create the project directory:

$ mkdir seaweedfs && cd seaweedfs

2. Generate an access key and a secret key (run twice and save both):

$ openssl rand -hex 16

3. Create the environment file:

$ nano .env

STORAGE_DOMAIN=storage.example.com
LETSENCRYPT_EMAIL=your-email@example.com
ADMIN_PASSWORD=yourpassword

4. Create the S3 identities file:

$ nano s3-config.json

{
  "identities": [
    {
      "name": "admin",
      "credentials": [
        {
          "accessKey": "YOUR_ACCESS_KEY",
          "secretKey": "YOUR_SECRET_KEY"
        }
      ],
      "actions": [
        "Admin",
        "Read",
        "Write",
        "List",
        "Tagging"
      ]
    }
  ]
}

Deploy with Docker Compose

1. Create the Compose manifest:

$ nano docker-compose.yml

services:
  traefik:
    image: traefik:v3.7.0
    container_name: traefik
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./letsencrypt:/letsencrypt
    command:
      - --providers.docker=true
      - --providers.docker.exposedByDefault=false
      - --entrypoints.web.address=:80
      - --entrypoints.websecure.address=:443
      - --entrypoints.web.http.redirections.entrypoint.to=websecure
      - --entrypoints.web.http.redirections.entrypoint.scheme=https
      - --entrypoints.web.http.redirections.entrypoint.permanent=true
      - --certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}
      - --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
      - --certificatesresolvers.letsencrypt.acme.httpchallenge=true
      - --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web

  master:
    image: chrislusf/seaweedfs:latest
    container_name: seaweed-master
    command: master -ip.bind=0.0.0.0 -port=9333
    volumes:
      - ./master-data:/data
    restart: unless-stopped

  volume:
    image: chrislusf/seaweedfs:latest
    container_name: seaweed-volume
    command: volume -mserver=master:9333 -port=8080 -ip.bind=0.0.0.0
    volumes:
      - ./volume-data:/data
    depends_on:
      - master
    restart: unless-stopped

  filer:
    image: chrislusf/seaweedfs:latest
    container_name: seaweed-filer
    command: filer -master=master:9333 -port=8888 -ip.bind=0.0.0.0
    volumes:
      - ./filer-data:/data
    depends_on:
      - master
      - volume
    restart: unless-stopped

  s3:
    image: chrislusf/seaweedfs:latest
    container_name: seaweed-s3
    command: s3 -filer=filer:8888 -port=8333 -ip.bind=0.0.0.0 -config=/etc/seaweedfs/s3.json
    volumes:
      - ./s3-config.json:/etc/seaweedfs/s3.json
    depends_on:
      - filer
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.s3.rule=Host(`s3.${STORAGE_DOMAIN}`)"
      - "traefik.http.routers.s3.entrypoints=websecure"
      - "traefik.http.routers.s3.tls.certresolver=letsencrypt"
      - "traefik.http.services.s3.loadbalancer.server.port=8333"

  admin:
    image: chrislusf/seaweedfs:latest
    container_name: seaweed-admin
    command: 'admin -masters="master:9333" -port=23646 -adminUser=admin -adminPassword=${ADMIN_PASSWORD} -dataDir=/data'
    volumes:
      - ./admin-data:/data
    depends_on:
      - master
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.admin.rule=Host(`${STORAGE_DOMAIN}`)"
      - "traefik.http.routers.admin.entrypoints=websecure"
      - "traefik.http.routers.admin.tls.certresolver=letsencrypt"
      - "traefik.http.services.admin.loadbalancer.server.port=23646"

2. Add your user to the Docker group and start the stack:

$ sudo usermod -aG docker $USER
$ newgrp docker
$ docker compose up -d
$ docker compose ps

Test the S3 API with AWS CLI

1. Configure a named profile:

$ aws configure --profile seaweedfs

Use the accessKey / secretKey from s3-config.json. Press Enter for region, then enter json for output.

2. Create a bucket and round-trip a file:

$ aws --endpoint-url https://s3.storage.example.com --profile seaweedfs s3 mb s3://test-bucket
$ echo "This is test content." | aws --endpoint-url https://s3.storage.example.com --profile seaweedfs s3 cp - s3://test-bucket/test.txt
$ aws --endpoint-url https://s3.storage.example.com --profile seaweedfs s3 cp s3://test-bucket/test.txt downloaded.txt
$ cat downloaded.txt

A printout of This is test content. confirms upload and download work end-to-end.

Browse the Admin Dashboard

Open https://storage.example.com and sign in with admin / ADMIN_PASSWORD. Use the Buckets tab to manage buckets and the Browser to inspect files.

Next Steps

SeaweedFS is running with a separate admin dashboard and S3 API behind HTTPS. From here you can:

Add more volume services for horizontal capacity scaling
Mount the filer over WebDAV or FUSE for traditional file access
Enable replication strategies (e.g. replication=001) for fault tolerance

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying Qdrant Open-Source Vector Database for AI Applications on Ubuntu 24.04

Sanskriti Harmukh — Tue, 23 Jun 2026 18:41:48 +0000

Qdrant is an open-source vector database for AI applications, optimised for similarity search over high-dimensional embeddings, with a REST/gRPC API, payload filtering, and a built-in dashboard. This guide deploys Qdrant using Docker Compose with Traefik handling automatic HTTPS, API-key authentication, and a sample collection that runs a similarity search. By the end, you'll have Qdrant serving vector search securely at your domain.

Set Up the Directory Structure

1. Create the project directory:

$ mkdir -p ~/qdrant/data
$ cd ~/qdrant

2. Generate a strong API key:

$ openssl rand -hex 32

Save the value for the .env file.

3. Create the environment file:

$ nano .env

DOMAIN=qdrant.example.com
LETSENCRYPT_EMAIL=admin@example.com
QDRANT_API_KEY=PASTE_GENERATED_KEY_HERE

Deploy with Docker Compose

1. Create the Compose manifest:

$ nano docker-compose.yaml

services:
  traefik:
    image: traefik:v3.6
    container_name: traefik
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--api.dashboard=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "./letsencrypt:/letsencrypt"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    restart: unless-stopped

  qdrant:
    image: qdrant/qdrant:v1.17.1
    container_name: qdrant
    expose:
      - "6333"
    volumes:
      - "./data:/qdrant/storage"
    environment:
      QDRANT__SERVICE__API_KEY: "${QDRANT_API_KEY}"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.qdrant.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.qdrant.entrypoints=websecure"
      - "traefik.http.routers.qdrant.tls.certresolver=letsencrypt"
      - "traefik.http.services.qdrant.loadbalancer.server.port=6333"
    restart: unless-stopped

2. Start the services and tail logs:

$ docker compose up -d
$ docker compose ps
$ docker compose logs --tail=50

Access the Dashboard and Health Endpoint

1. Open https://qdrant.example.com/dashboard and paste the API key when prompted.

2. Confirm the service is ready:

$ curl https://qdrant.example.com/readyz

A response of all shards are ready confirms Qdrant is healthy.

Create a Collection and Run a Similarity Search

1. Export the API key:

$ export QDRANT_API_KEY=YOUR_API_KEY

2. Create a 4-dimensional collection with cosine distance:

$ curl -X PUT "https://qdrant.example.com/collections/star_charts" \
    -H "Content-Type: application/json" \
    -H "api-key: ${QDRANT_API_KEY}" \
    -d '{
      "vectors": {
        "size": 4,
        "distance": "Cosine"
      }
    }'

3. Insert sample points:

$ curl -X PUT "https://qdrant.example.com/collections/star_charts/points" \
    -H "Content-Type: application/json" \
    -H "api-key: ${QDRANT_API_KEY}" \
    -d '{
      "points": [
        {"id": 1, "vector": [0.05, 0.61, 0.76, 0.74], "payload": {"colony": "Mars"}},
        {"id": 2, "vector": [0.19, 0.81, 0.75, 0.11], "payload": {"colony": "Jupiter"}},
        {"id": 3, "vector": [0.36, 0.55, 0.47, 0.94], "payload": {"colony": "Venus"}},
        {"id": 4, "vector": [0.18, 0.01, 0.85, 0.80], "payload": {"colony": "Moon"}},
        {"id": 5, "vector": [0.24, 0.18, 0.22, 0.44], "payload": {"colony": "Pluto"}}
      ]
    }'

4. Run a similarity search:

$ curl -X POST "https://qdrant.example.com/collections/star_charts/points/search" \
    -H "Content-Type: application/json" \
    -H "api-key: ${QDRANT_API_KEY}" \
    -d '{
      "vector": [0.2, 0.1, 0.9, 0.7],
      "limit": 3,
      "with_payload": true
    }'

The top result is the Moon point (cosine ~0.99). The dashboard's Collections tab shows star_charts with a green status and 5 points.

Next Steps

Qdrant is running and serving vector search over HTTPS. From here you can:

Generate embeddings with OpenAI, Cohere, or Sentence-Transformers and upsert them
Add payload filters to combine vector similarity with structured criteria
Snapshot the data/ volume regularly for restore-able backups

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying Paperless-ngx Open-Source Document Management System on Ubuntu 24.04

Sanskriti Harmukh — Tue, 23 Jun 2026 18:41:22 +0000

Paperless-ngx is an open-source document management system that converts scans and PDFs into a fully searchable archive using Tesseract OCR, with tags, custom fields, and automated processing rules. This guide deploys Paperless-ngx using Docker Compose with PostgreSQL, Redis, and Traefik handling automatic HTTPS, then uploads a document and verifies OCR extraction. By the end, you'll have Paperless-ngx serving an OCR-indexed document archive securely at your domain.

Set Up the Directory Structure

1. Create the project directories:

$ mkdir -p ~/paperless-ngx/{data,media,export,consume,pgdata}
$ cd ~/paperless-ngx

2. Create the environment file:

$ nano .env

DOMAIN=paperless.example.com
LETSENCRYPT_EMAIL=admin@example.com

PAPERLESS_SECRET_KEY=CHANGE_TO_RANDOM_STRING
PAPERLESS_URL=https://paperless.example.com
PAPERLESS_TIME_ZONE=UTC
PAPERLESS_OCR_LANGUAGE=eng
PAPERLESS_DBPASS=STRONG_PASSWORD_HERE

POSTGRES_DB=paperless
POSTGRES_USER=paperless
POSTGRES_PASSWORD=STRONG_PASSWORD_HERE

Use the same value for PAPERLESS_DBPASS and POSTGRES_PASSWORD. PAPERLESS_SECRET_KEY should be a 32+ character random string.

Deploy with Docker Compose

1. Create the Compose manifest:

$ nano docker-compose.yaml

services:
  traefik:
    image: traefik:v3.6
    container_name: traefik
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "./letsencrypt:/letsencrypt"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    restart: unless-stopped

  db:
    image: postgres:16
    container_name: paperless-db
    environment:
      POSTGRES_DB: ${POSTGRES_DB}
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    volumes:
      - "./pgdata:/var/lib/postgresql/data"
    healthcheck:
      test: ["CMD", "pg_isready", "-U", "${POSTGRES_USER}", "-d", "${POSTGRES_DB}"]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped

  redis:
    image: redis:7
    container_name: paperless-redis
    restart: unless-stopped

  paperless:
    image: ghcr.io/paperless-ngx/paperless-ngx:2.20.6
    container_name: paperless
    depends_on:
      db:
        condition: service_healthy
    environment:
      PAPERLESS_REDIS: redis://redis:6379
      PAPERLESS_DBHOST: db
      PAPERLESS_SECRET_KEY: ${PAPERLESS_SECRET_KEY}
      PAPERLESS_URL: ${PAPERLESS_URL}
      PAPERLESS_TIME_ZONE: ${PAPERLESS_TIME_ZONE}
      PAPERLESS_OCR_LANGUAGE: ${PAPERLESS_OCR_LANGUAGE}
      PAPERLESS_DBPASS: ${PAPERLESS_DBPASS}
    volumes:
      - "./data:/usr/src/paperless/data"
      - "./media:/usr/src/paperless/media"
      - "./export:/usr/src/paperless/export"
      - "./consume:/usr/src/paperless/consume"
    expose:
      - "8000"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.paperless.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.paperless.entrypoints=websecure"
      - "traefik.http.routers.paperless.tls.certresolver=letsencrypt"
      - "traefik.http.services.paperless.loadbalancer.server.port=8000"
    restart: unless-stopped

2. Start the services:

$ docker compose up -d
$ docker compose ps
$ docker compose logs

3. Create a superuser inside the Paperless container:

$ docker compose exec -it paperless python3 manage.py createsuperuser

Follow the prompts for username, email, and password.

Upload a Document and Verify OCR

Open https://paperless.example.com and sign in with the superuser.
Click Upload documents at the top right and pick a PDF or image.
Wait 5–30 seconds for Paperless to OCR the document.
Click the thumbnail, then the Content tab — the extracted text appears alongside the document preview.

Next Steps

Paperless-ngx is running with PostgreSQL persistence and Tesseract OCR. From here you can:

Set up the Consume folder for automatic ingestion of scans dropped via SFTP or a scanner watch folder
Add tags, correspondents, document types, and storage paths for auto-classification
Enable additional OCR languages by adding ISO codes to PAPERLESS_OCR_LANGUAGE (e.g. eng+deu+fra)

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying Overleaf Open-Source LaTeX Collaboration Platform on Ubuntu 24.04

Sanskriti Harmukh — Tue, 23 Jun 2026 18:41:02 +0000

Overleaf is an open-source, collaborative LaTeX editor that bundles MongoDB, Redis, and the ShareLaTeX application into a single self-hosted stack. This guide deploys Overleaf Community Edition using the official Toolkit plus a Traefik override that adds automatic HTTPS via Let's Encrypt. By the end, you'll have Overleaf serving collaborative LaTeX editing securely at your domain.

Set Up the Project Directory

1. Clone the Overleaf Toolkit:

$ git clone https://github.com/overleaf/toolkit.git ~/overleaf-toolkit
$ cd ~/overleaf-toolkit

2. Initialize the configuration:

$ bin/init

This creates config/overleaf.rc, config/variables.env, and config/version.

3. Create a directory for Traefik file-provider routes:

$ mkdir traefik-routes

Configure Overleaf for a Reverse Proxy

1. Edit config/variables.env:

$ nano config/variables.env

OVERLEAF_APP_NAME="My Overleaf Instance"
OVERLEAF_SITE_URL=https://overleaf.example.com
OVERLEAF_NAV_TITLE="Overleaf CE"
OVERLEAF_BEHIND_PROXY=true
OVERLEAF_SECURE_COOKIE=true

The last two flags are required when Overleaf is fronted by an HTTPS reverse proxy.

2. Edit config/overleaf.rc:

$ nano config/overleaf.rc

SIBLING_CONTAINERS_ENABLED=false

3. Create the project-level .env file used by the Traefik Compose file:

$ nano .env

DOMAIN=overleaf.example.com
LETSENCRYPT_EMAIL=admin@example.com
SERVER_IP=192.0.2.1

SERVER_IP should be the server's public IP (Traefik binds 80/443 to it).

Add the Traefik Route

1. Create the dynamic route:

$ nano traefik-routes/overleaf.yml

http:
  routers:
    overleaf:
      rule: "Host(`overleaf.example.com`)"
      service: overleaf
      entryPoints:
        - websecure
      tls:
        certResolver: le
  services:
    overleaf:
      loadBalancer:
        servers:
          - url: "http://sharelatex:80"

2. Create the Traefik Compose file:

$ nano docker-compose.traefik.yml

services:
  traefik:
    image: traefik:v3.6
    container_name: traefik
    restart: unless-stopped
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.file.directory=/etc/traefik/routes"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.le.acme.httpchallenge=true"
      - "--certificatesresolvers.le.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.le.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.le.acme.storage=/letsencrypt/acme.json"
    ports:
      - "${SERVER_IP}:80:80"
      - "${SERVER_IP}:443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./letsencrypt:/letsencrypt
      - ./traefik-routes:/etc/traefik/routes
    networks:
      - overleaf_default

networks:
  overleaf_default:
    external: true

Start the Stacks

1. Add your user to the Docker group:

$ sudo usermod -aG docker $USER
$ newgrp docker

2. Run the Toolkit doctor:

$ bin/doctor

3. Start Overleaf (sharelatex + mongo + redis):

$ bin/up -d
$ bin/docker-compose ps

4. Start Traefik in the same Docker network:

$ docker compose -f docker-compose.traefik.yml up -d
$ docker compose -f docker-compose.traefik.yml ps
$ docker compose -f docker-compose.traefik.yml logs traefik

Create the Admin and First Project

1. Open the launchpad and register the admin user:

https://overleaf.example.com/launchpad

2. Sign in, then open Admin → Manage Users to create more accounts.

3. Create your first LaTeX project:

Visit https://overleaf.example.com/project.
Click Create a new project → Example project.
Enter a name and click Create.
Edit the default template and click Recompile to render the PDF preview.

Next Steps

Overleaf CE is running and served securely over HTTPS. From here you can:

Configure SMTP under config/variables.env for invitations and notifications
Mount external storage volumes for data/sharelatex_data to scale capacity
Pin the Overleaf release in config/version and use bin/upgrade for controlled updates

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying Ory Kratos Open-Source Identity and User Management System on Ubuntu 24.04

Sanskriti Harmukh — Tue, 23 Jun 2026 18:40:35 +0000

Ory Kratos is an open-source, API-first identity and user management system handling registration, login, recovery, verification, and session management with a self-service UI. This guide deploys Kratos using Docker Compose with PostgreSQL, the self-service UI Node, and Traefik handling automatic HTTPS for the public API. By the end, you'll have Kratos managing identities and sessions for users registering through your domain over HTTPS.

Prerequisite: SMTP credentials are required for verification and recovery emails. The admin API stays bound to 127.0.0.1 on purpose — never expose it publicly.

Set Up the Directory Structure

1. Create the project directories:

$ mkdir -p ~/ory-kratos/{config,data/postgres}
$ cd ~/ory-kratos

2. Create the environment file:

$ nano .env

DOMAIN=kratos.example.com
LETSENCRYPT_EMAIL=admin@example.com
KRATOS_VERSION=v26.2.0
POSTGRES_USER=kratos
POSTGRES_PASSWORD=EXAMPLE_DB_PASSWORD
POSTGRES_DB=kratosdb
LOG_LEVEL=info

3. Create the identity schema — defines the user fields (email + name) and how the email maps to login, recovery, and verification:

$ nano config/identity.schema.json

Use the schema described in the Vultr Docs walkthrough — email is the login identifier with password auth; name is a free-text trait.

4. Create the Kratos configuration — public/admin API URLs, password policy (12-char minimum + HaveIBeenPwned), session lifetimes, self-service flows, SMTP courier:

$ nano config/kratos.yml

Fill in the full configuration from the source article. Key points to keep consistent with the stack below:

Public API listens on the internal port and is fronted by Traefik on ${DOMAIN}.
Admin API listens on 127.0.0.1:4434 only — used by tooling on the host.
The DSN points at the postgres service (postgres://kratos:...@postgres:5432/kratosdb?sslmode=disable).
The courier section uses your SMTP provider for verification mail.

Deploy with Docker Compose

1. Create the Compose manifest:

$ nano docker-compose.yml

services:
  traefik:
    image: traefik:v3.6
    container_name: traefik
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "./letsencrypt:/letsencrypt"
    restart: unless-stopped

  postgres:
    image: postgres:16
    container_name: kratos-postgres
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: ${POSTGRES_DB}
    volumes:
      - ./data/postgres:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD", "pg_isready", "-U", "${POSTGRES_USER}", "-d", "${POSTGRES_DB}"]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped

  kratos-migrate:
    image: oryd/kratos:${KRATOS_VERSION}
    container_name: kratos-migrate
    depends_on:
      postgres:
        condition: service_healthy
    volumes:
      - ./config:/etc/config/kratos:ro
    environment:
      DSN: "postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}?sslmode=disable"
    command: migrate -c /etc/config/kratos/kratos.yml sql -e --yes

  kratos:
    image: oryd/kratos:${KRATOS_VERSION}
    container_name: kratos
    depends_on:
      kratos-migrate:
        condition: service_completed_successfully
    volumes:
      - ./config:/etc/config/kratos:ro
    environment:
      DSN: "postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB}?sslmode=disable"
      LOG_LEVEL: ${LOG_LEVEL}
    command: serve -c /etc/config/kratos/kratos.yml --watch-courier
    ports:
      - "127.0.0.1:4434:4434"
    expose:
      - "4433"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.kratos.rule=Host(`${DOMAIN}`) && PathPrefix(`/.ory/kratos/public`)"
      - "traefik.http.routers.kratos.entrypoints=websecure"
      - "traefik.http.routers.kratos.tls.certresolver=letsencrypt"
      - "traefik.http.services.kratos.loadbalancer.server.port=4433"
    restart: unless-stopped

  kratos-ui:
    image: oryd/kratos-selfservice-ui-node:${KRATOS_VERSION}
    container_name: kratos-ui
    depends_on:
      - kratos
    environment:
      KRATOS_PUBLIC_URL: https://${DOMAIN}/.ory/kratos/public
      KRATOS_BROWSER_URL: https://${DOMAIN}/.ory/kratos/public
    expose:
      - "3000"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.kratos-ui.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.kratos-ui.entrypoints=websecure"
      - "traefik.http.routers.kratos-ui.tls.certresolver=letsencrypt"
      - "traefik.http.services.kratos-ui.loadbalancer.server.port=3000"
    restart: unless-stopped

2. Start the stack:

$ docker compose up -d
$ docker compose ps -a
$ docker compose logs

Health Checks

1. Probe the admin API on the loopback:

$ docker compose exec kratos wget -qO- http://127.0.0.1:4434/health/alive

2. Probe the public API over HTTPS:

$ curl -s https://kratos.example.com/.ory/kratos/public/health/alive

3. Confirm the self-service UI loads:

$ curl -s -o /dev/null -w "%{http_code}" https://kratos.example.com/

Register and Sign In via the API

1. Open a registration flow:

$ curl -s https://kratos.example.com/.ory/kratos/public/self-service/registration/api

Capture the id from the response — it's the FLOW_ID below.

2. Submit the registration:

$ curl -s -X POST \
    "https://kratos.example.com/.ory/kratos/public/self-service/registration?flow=FLOW_ID" \
    -H 'Content-Type: application/json' \
    -d '{
      "method": "password",
      "password": "YOUR-PASSWORD",
      "traits": {
        "email": "YOUR-EMAIL",
        "name": { "first": "FIRST-NAME", "last": "LAST-NAME" }
      }
    }'

3. List identities through the admin API:

$ docker compose exec kratos wget -qO- http://127.0.0.1:4434/admin/identities

4. Sign in:

$ curl -s https://kratos.example.com/.ory/kratos/public/self-service/login/api
$ curl -s -X POST \
    "https://kratos.example.com/.ory/kratos/public/self-service/login?flow=FLOW_ID" \
    -H 'Content-Type: application/json' \
    -d '{
      "method": "password",
      "identifier": "YOUR-EMAIL",
      "password": "YOUR-PASSWORD"
    }'

5. Verify the session:

$ curl -s https://kratos.example.com/.ory/kratos/public/sessions/whoami \
    -H "X-Session-Token: SESSION_TOKEN"

Next Steps

Kratos is running with PostgreSQL persistence, the self-service UI, and HTTPS in front of the public API. From here you can:

Add social sign-in (Google, GitHub, Apple) through the OIDC provider list
Wire Kratos sessions to other services via Ory Oathkeeper or forward-auth
Use Ory Hydra alongside Kratos to expose OpenID Connect to client apps

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying NocoDB Open-Source Airtable Alternative on Ubuntu 24.04

Sanskriti Harmukh — Tue, 23 Jun 2026 18:39:56 +0000

NocoDB is an open-source no-code platform that puts a spreadsheet-style UI on top of a relational database, with grid, form, Kanban, and gallery views plus a REST API. This guide deploys NocoDB using Docker Compose with a PostgreSQL backend and Traefik handling automatic HTTPS, then exercises the API with a sample base. By the end, you'll have NocoDB serving a base over HTTPS with API access at your domain.

Set Up the Directory Structure

1. Create the project directories:

$ mkdir -p ~/nocodb/{data,pgdata,letsencrypt}
$ cd ~/nocodb

2. Create the environment file:

$ nano .env

DOMAIN=nocodb.example.com
LETSENCRYPT_EMAIL=admin@example.com

POSTGRES_DB=postgres
POSTGRES_PASSWORD=strong_password
POSTGRES_USER=postgres

Deploy with Docker Compose

1. Create the Compose manifest:

$ nano docker-compose.yaml

services:
  traefik:
    image: traefik:v3.6
    container_name: traefik
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "./letsencrypt:/letsencrypt"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    restart: unless-stopped

  db:
    image: postgres:16
    container_name: nocodb-db
    hostname: root_db
    environment:
      POSTGRES_DB: ${POSTGRES_DB}
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    volumes:
      - "./pgdata:/var/lib/postgresql/data"
    healthcheck:
      test: ["CMD", "pg_isready", "-U", "${POSTGRES_USER}", "-d", "${POSTGRES_DB}"]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped

  nocodb:
    image: nocodb/nocodb:0.301.2
    container_name: nocodb
    depends_on:
      db:
        condition: service_healthy
    environment:
      NC_DB: "pg://db:5432?u=${POSTGRES_USER}&p=${POSTGRES_PASSWORD}&d=${POSTGRES_DB}"
    volumes:
      - "./data:/usr/app/data"
    expose:
      - "8080"
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.nocodb.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.nocodb.entrypoints=websecure"
      - "traefik.http.routers.nocodb.tls.certresolver=letsencrypt"
      - "traefik.http.services.nocodb.loadbalancer.server.port=8080"
    restart: unless-stopped

2. Start the services:

$ docker compose up -d

3. Verify the services and tail logs:

$ docker compose ps
$ docker compose logs

Create the Super Admin

Open https://nocodb.example.com.
Register the Super Admin account with email and password.
Complete the onboarding wizard (role and workspace prefs).

Create a Base and Query the API

1. From the dashboard, create a base named Employee Directory.

2. Add a table named Employees with fields: Name (text), Email (text), Department (text).

3. Insert a sample record — for example, Jane Smith, jane@example.com, Engineering.

4. Generate an API token from the profile menu → API Tokens.

5. Copy the table ID from the table context menu.

6. Query the table over HTTPS:

$ curl -s -H "xc-token: YOUR_API_TOKEN" \
    "https://nocodb.example.com/api/v2/tables/TABLE_ID/records" | jq

Next Steps

NocoDB is running and served securely over HTTPS. From here you can:

Add views (Grid, Form, Kanban, Gallery, Calendar) for the same table
Invite collaborators with role-based permissions per base
Wire automations to webhooks or Zapier/Make for downstream integrations

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying MLflow Open-Source Machine Learning Experiment Tracking on Ubuntu 24.04

Sanskriti Harmukh — Tue, 23 Jun 2026 18:39:33 +0000

MLflow is an open-source platform for managing the machine learning lifecycle — experiment tracking, model registry, and reproducible runs. This guide deploys MLflow using Docker Compose with a PostgreSQL backend, S3-compatible artifact storage, basic-auth, and Traefik handling automatic HTTPS, then logs a sample scikit-learn run. By the end, you'll have MLflow recording experiments at your domain over HTTPS.

Prerequisite: An S3-compatible bucket (e.g. Vultr Object Storage) with access key, secret key, region, and endpoint URL.

Set Up the Directory Structure

1. Create the project directory:

$ mkdir -p ~/mlflow
$ cd ~/mlflow

2. Create the environment file:

$ nano .env

DOMAIN=mlflow.example.com
LETSENCRYPT_EMAIL=admin@example.com

POSTGRES_USER=mlflow
POSTGRES_PASSWORD=StrongDatabasePassword123

MLFLOW_AUTH_CONFIG_PATH=/app/basic_auth.ini
MLFLOW_FLASK_SERVER_SECRET_KEY=GENERATED_SECRET_KEY

S3_BUCKET=mlflow-artifacts
S3_ACCESS_KEY=YOUR_ACCESS_KEY
S3_SECRET_KEY=YOUR_SECRET_KEY
S3_REGION=YOUR_REGION
S3_ENDPOINT=https://YOUR_OBJECT_STORAGE_ENDPOINT

3. Create the basic-auth configuration:

$ nano basic_auth.ini

[mlflow]
default_permission = READ
database_uri = sqlite:///basic_auth.db
admin_username = admin
admin_password = ADMIN_PASSWORD
authorization_function = mlflow.server.auth:authenticate_request_basic_auth

4. Create a Dockerfile that adds the auth-server extras and Postgres/S3 clients to the official image:

$ nano Dockerfile

FROM ghcr.io/mlflow/mlflow:v3.10.1

RUN pip install --no-cache-dir psycopg2-binary boto3 'mlflow[auth]'

Deploy with Docker Compose

1. Create the Compose manifest:

$ nano docker-compose.yml

services:
  traefik:
    image: traefik:v3.6
    container_name: traefik
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "./letsencrypt:/letsencrypt"
    restart: unless-stopped

  postgres:
    image: postgres:15
    container_name: mlflow-postgres
    environment:
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: mlflow
    volumes:
      - ./postgres_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER}"]
      interval: 10s
      retries: 5
    restart: unless-stopped

  mlflow:
    build: .
    container_name: mlflow
    expose:
      - "5000"
    environment:
      AWS_ACCESS_KEY_ID: ${S3_ACCESS_KEY}
      AWS_SECRET_ACCESS_KEY: ${S3_SECRET_KEY}
      AWS_DEFAULT_REGION: ${S3_REGION}
      AWS_S3_FORCE_PATH_STYLE: "true"
      MLFLOW_S3_ENDPOINT_URL: ${S3_ENDPOINT}
      MLFLOW_AUTH_CONFIG_PATH: ${MLFLOW_AUTH_CONFIG_PATH}
      MLFLOW_FLASK_SERVER_SECRET_KEY: ${MLFLOW_FLASK_SERVER_SECRET_KEY}
    volumes:
      - ./basic_auth.ini:/app/basic_auth.ini:ro
      - ./mlflow_auth:/app
    command: >
      mlflow server
      --backend-store-uri "postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@postgres:5432/mlflow"
      --default-artifact-root "s3://${S3_BUCKET}/"
      --serve-artifacts
      --host 0.0.0.0
      --port 5000
      --allowed-hosts "${DOMAIN},https://${DOMAIN}"
      --app-name basic-auth
    depends_on:
      postgres:
        condition: service_healthy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.mlflow.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.mlflow.entrypoints=websecure"
      - "traefik.http.routers.mlflow.tls.certresolver=letsencrypt"
    restart: unless-stopped

2. Build and start the stack:

$ docker compose up -d --build

3. Verify the services and tail logs:

$ docker compose ps
$ docker compose logs

Sign In and Log a Sample Experiment

1. Open https://mlflow.example.com and authenticate with admin / the password from basic_auth.ini.

2. On the workstation, create a virtualenv and install dependencies:

$ sudo apt install python3-venv -y
$ python3 -m venv mlflow-env
$ source mlflow-env/bin/activate
$ pip install mlflow scikit-learn pandas numpy boto3

3. Save a demo experiment script:

$ nano mlflow_demo.py

import mlflow
import mlflow.sklearn
from sklearn.model_selection import train_test_split
from sklearn.linear_model import ElasticNet
from sklearn.metrics import mean_squared_error, r2_score
from sklearn.datasets import load_diabetes
import pandas as pd
import numpy as np

diabetes = load_diabetes()
X = pd.DataFrame(diabetes.data, columns=diabetes.feature_names)
y = pd.Series(diabetes.target)

X_train, X_test, y_train, y_test = train_test_split(X, y, test_size=0.2, random_state=42)

mlflow.set_tracking_uri("https://mlflow.example.com")
mlflow.set_experiment("official_demo_experiment")

with mlflow.start_run():
    alpha, l1_ratio = 0.5, 0.5
    mlflow.log_param("alpha", alpha)
    mlflow.log_param("l1_ratio", l1_ratio)

    model = ElasticNet(alpha=alpha, l1_ratio=l1_ratio, random_state=42)
    model.fit(X_train, y_train)

    y_pred = model.predict(X_test)
    rmse = np.sqrt(mean_squared_error(y_test, y_pred))
    r2 = r2_score(y_test, y_pred)
    mlflow.log_metric("rmse", rmse)
    mlflow.log_metric("r2", r2)

    mlflow.sklearn.log_model(model, "model")

4. Export credentials and run the script:

$ export MLFLOW_TRACKING_USERNAME=admin
$ export MLFLOW_TRACKING_PASSWORD=ADMIN_PASSWORD
$ export AWS_ACCESS_KEY_ID=YOUR_ACCESS_KEY
$ export AWS_SECRET_ACCESS_KEY=YOUR_SECRET_KEY
$ export MLFLOW_S3_ENDPOINT_URL=https://YOUR_OBJECT_STORAGE_ENDPOINT
$ python3 mlflow_demo.py

Refresh the MLflow UI — the run appears under official_demo_experiment with logged parameters, metrics, and the persisted model artifact.

Next Steps

MLflow is running with PostgreSQL persistence and S3 artifacts. From here you can:

Register top runs in the Model Registry for staged promotion
Wire mlflow.autolog() into your training code for hands-off tracking
Add team users and per-experiment permissions in the basic-auth database

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying LocalAI Self-Hosted AI Model Management Platform on Ubuntu 24.04

Sanskriti Harmukh — Tue, 23 Jun 2026 18:38:59 +0000

LocalAI is an open-source platform for running Large Language Models locally with an OpenAI-compatible API, so you can swap it in behind existing OpenAI client code without paying per-token or sending data off-server. This guide deploys LocalAI using Docker Compose with Traefik handling automatic HTTPS, persistent model and cache directories, and a working chat-completion test. By the end, you'll have LocalAI serving an OpenAI-compatible API securely at your domain.

Set Up the Directory Structure

1. Create the project directories:

$ mkdir -p ~/localai/{models,cache}
$ cd ~/localai

models/ holds downloaded model files; cache/ persists between restarts.

2. Create the environment file:

$ nano .env

DOMAIN=localai.example.com
LETSENCRYPT_EMAIL=admin@example.com

Deploy with Docker Compose

1. Add your user to the Docker group:

$ sudo usermod -aG docker $USER
$ newgrp docker

2. Create the Compose manifest:

$ nano docker-compose.yaml

services:
  traefik:
    image: traefik:v3.6
    container_name: traefik
    restart: unless-stopped
    environment:
      DOCKER_API_VERSION: "1.44"
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.le.acme.httpchallenge=true"
      - "--certificatesresolvers.le.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.le.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.le.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./letsencrypt:/letsencrypt

  localai:
    image: localai/localai:latest-aio-cpu
    container_name: localai
    restart: unless-stopped
    volumes:
      - ./models:/models:cached
      - ./cache:/cache:cached
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/readyz"]
      interval: 1m
      timeout: 20s
      retries: 5
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.localai.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.localai.entrypoints=websecure"
      - "traefik.http.routers.localai.tls=true"
      - "traefik.http.routers.localai.tls.certresolver=le"
      - "traefik.http.services.localai.loadbalancer.server.port=8080"

Swap localai/localai:latest-aio-cpu for a GPU variant (latest-aio-gpu-nvidia-cuda-12) if the host has an NVIDIA GPU.

3. Set the models directory permissions and start the stack:

$ sudo chmod -R 755 ~/localai/models
$ docker compose up -d
$ docker compose ps

Verify the API

1. Check readiness:

$ curl -i https://localai.example.com/readyz

A 200 OK confirms Traefik is routing to LocalAI.

2. List the available models:

$ curl https://localai.example.com/v1/models

3. Run a chat completion:

$ curl -X POST https://localai.example.com/v1/chat/completions \
    -H "Content-Type: application/json" \
    -d '{
      "model": "gpt-4",
      "messages": [
        {"role": "user", "content": "Explain what LocalAI does in one sentence."}
      ],
      "max_tokens": 60
    }'

LocalAI returns a response in the OpenAI completion shape.

Access the Dashboard

Open https://localai.example.com in a browser to browse the model gallery, install new models, and run inference from the UI.

Next Steps

LocalAI is running and served securely over HTTPS. From here you can:

Install additional models from the gallery for domain-specific tasks
Point any OpenAI SDK at the LocalAI base URL by changing OPENAI_API_BASE
Run a GPU variant for image generation, embeddings, and faster LLM inference

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying LibreChat Open-Source AI Chat Platform on Ubuntu 24.04

Sanskriti Harmukh — Tue, 23 Jun 2026 18:38:22 +0000

LibreChat is an open-source, ChatGPT-style web UI that supports OpenAI, Anthropic, Azure OpenAI, Gemini, OpenRouter, local OpenAI-compatible endpoints, and more — with MongoDB-backed conversation history and Meilisearch-powered search. This guide deploys LibreChat using its official Compose manifest plus a Traefik override for automatic HTTPS. By the end, you'll have LibreChat running with a registration page and multi-provider chat at your domain over HTTPS.

Clone LibreChat and Prepare the Environment

1. Clone the LibreChat repository and check out a stable tag:

$ git clone https://github.com/danny-avila/LibreChat.git
$ cd LibreChat
$ git checkout tags/v0.8.3

2. Find the Meilisearch data directory name pinned by this release:

$ grep -o 'meili_data_v[0-9.]*' docker-compose.yml | head -1

3. Create the required data directories (replace meili_data_v1.35.1 if the previous command printed a different name):

$ mkdir -p data-node images logs meili_data_v1.35.1 uploads
$ sudo chown -R 1000:1000 meili_data_v1.35.1

4. Copy the env template and uncomment the UID/GID lines:

$ cp .env.example .env
$ nano .env

UID=1000
GID=1000

Override the Compose Stack with Traefik

1. Create a Compose override that adds Traefik and wires the API to it:

$ nano docker-compose.override.yml

services:
  api:
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.librechat.rule=Host(`librechat.example.com`)"
      - "traefik.http.routers.librechat.entrypoints=websecure"
      - "traefik.http.routers.librechat.tls.certresolver=leresolver"
      - "traefik.http.services.librechat.loadbalancer.server.port=3080"
    volumes:
      - ./librechat.yaml:/app/librechat.yaml

  traefik:
    image: traefik:v3.6.10
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "./letsencrypt:/letsencrypt"
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--entrypoints.web.http.redirections.entrypoint.permanent=true"
      - "--certificatesresolvers.leresolver.acme.httpchallenge=true"
      - "--certificatesresolvers.leresolver.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.leresolver.acme.email=admin@example.com"
      - "--certificatesresolvers.leresolver.acme.storage=/letsencrypt/acme.json"

2. Create an empty LibreChat configuration file (mounted by the override):

$ touch librechat.yaml

Start the Stack

1. Bring everything up:

$ docker compose up -d

Compose starts the LibreChat API, MongoDB, Meilisearch, and Traefik. Traefik requests a TLS certificate from Let's Encrypt over the HTTP-01 challenge and routes HTTPS to LibreChat on port 3080.

2. Verify the containers are running:

$ docker compose ps

3. Tail the logs:

$ docker compose logs --tail=50

You should see MongoDB initialize, Meilisearch start, Traefik register the route, and the LibreChat API listening on port 3080.

Register and Sign In

1. Open the registration page in a browser:

https://librechat.example.com/register

2. Fill in your name, username, email, and password and click **Continue.**

3. Sign in with the new credentials — the dashboard loads with the model selector and conversation interface.

To enable Google / GitHub / Discord / OpenID Connect sign-up, set ALLOW_SOCIAL_LOGIN=true and ALLOW_SOCIAL_REGISTRATION=true in .env and restart the stack.

Next Steps

LibreChat is running and served securely over HTTPS. From here you can:

Plug in API keys for OpenAI, Anthropic, Azure, Gemini, or OpenRouter in .env
Point LibreChat at a local OpenAI-compatible endpoint (Ollama, LocalAI) via librechat.yaml
Enable file uploads, RAG, and image generation through the dashboard settings

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying Label Studio Open-Source Data Labeling Platform on Ubuntu 24.04

Sanskriti Harmukh — Tue, 16 Jun 2026 20:57:20 +0000

Label Studio is an open-source data labeling platform that supports annotation across text, images, audio, video, and time series, with collaborative workflows and ML-model integrations. This guide deploys Label Studio using Docker Compose with Traefik handling automatic HTTPS and persistent volumes for projects and labels. By the end, you'll have Label Studio serving an annotation workspace securely at your domain.

Set Up the Directory Structure

1. Create the project directory:

$ mkdir ~/labelstudio
$ cd ~/labelstudio

2. Create the environment file:

$ nano .env

DOMAIN=labelstudio.example.com
LETSENCRYPT_EMAIL=admin@example.com

Deploy with Docker Compose

1. Create the Compose manifest:

$ nano docker-compose.yaml

services:
  traefik:
    image: traefik:v3.6
    container_name: traefik
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "./letsencrypt:/letsencrypt"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
    restart: unless-stopped

  labelstudio:
    image: heartexlabs/label-studio:1.23.0
    container_name: labelstudio
    expose:
      - "8080"
    environment:
      - DJANGO_ALLOWED_HOSTS=${DOMAIN}
      - CSRF_TRUSTED_ORIGINS=https://${DOMAIN}
      - USE_X_FORWARDED_HOST=true
      - SECURE_PROXY_SSL_HEADER=HTTP_X_FORWARDED_PROTO,https
    volumes:
      - ./data:/label-studio/data
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.labelstudio.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.labelstudio.entrypoints=websecure"
      - "traefik.http.routers.labelstudio.tls.certresolver=letsencrypt"
      - "traefik.http.services.labelstudio.loadbalancer.server.port=8080"
    restart: unless-stopped

2. Create the data directory with group write access:

$ mkdir data
$ sudo chown :0 data

3. Start the services:

$ docker compose up -d

4. Verify the services and view logs:

$ docker compose ps
$ docker compose logs

Create the Admin and a Sample Project

1. Open https://labelstudio.example.com and click Sign Up to create the first administrator.

2. From the dashboard, click Create Project and set:

Project Name: Sentiment Analysis
Labeling Template: Text Classification

3. Click Save, then Import and paste the sample data:

[
  {"text": "This product is amazing."},
  {"text": "Worst experience ever."}
]

4. Annotate each task, click Submit, and confirm the Data Manager shows them as Completed.

Next Steps

Label Studio is running and served securely over HTTPS. From here you can:

Configure ML backends (PyTorch, scikit-learn) for active learning loops
Invite collaborators with role-based permissions per project
Export annotated datasets in COCO, YOLO, JSON, or CSV for downstream training

For the full guide with additional tips, visit the original article on Vultr Docs.

Deploying Kestra Open-Source Workflow Orchestration Platform on Ubuntu 24.04

Sanskriti Harmukh — Tue, 16 Jun 2026 20:55:36 +0000

Kestra is an open-source workflow orchestration platform that runs YAML-defined pipelines on schedules, triggers, or events, with a web UI for managing executions, logs, and metadata. This guide deploys Kestra using Docker Compose with a PostgreSQL backend and Traefik handling automatic HTTPS. By the end, you'll have Kestra running a sample workflow with a SUCCESS execution at your domain.

Set Up the Directory Structure

1. Create the project directories:

$ mkdir -p ~/kestra/data/{postgres,kestra,traefik}
$ cd ~/kestra

postgres/ holds the database, kestra/ holds execution artifacts, traefik/ holds Let's Encrypt certificates.

2. Create the environment file:

$ nano .env

POSTGRES_DB=kestra
POSTGRES_USER=kestra
POSTGRES_PASSWORD=STRONG-PASSWORD
DOMAIN=kestra.example.com
LETSENCRYPT_EMAIL=admin@example.com

Deploy with Docker Compose

1. Create the Compose manifest:

$ nano docker-compose.yml

services:
  traefik:
    image: traefik:v3.6
    restart: unless-stopped
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
      - "--certificatesresolvers.letsencrypt.acme.email=${LETSENCRYPT_EMAIL}"
      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./data/traefik:/letsencrypt

  postgres:
    image: postgres:15
    restart: unless-stopped
    environment:
      POSTGRES_DB: ${POSTGRES_DB}
      POSTGRES_USER: ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    volumes:
      - ./data/postgres:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER}"]
      interval: 10s
      timeout: 5s
      retries: 5

  kestra:
    image: kestra/kestra:v1.3.6
    restart: unless-stopped
    command: server standalone
    environment:
      KESTRA_CONFIGURATION: |
        datasources:
          postgres:
            url: jdbc:postgresql://postgres:5432/${POSTGRES_DB}
            driverClassName: org.postgresql.Driver
            username: ${POSTGRES_USER}
            password: ${POSTGRES_PASSWORD}
        kestra:
          repository:
            type: postgres
          storage:
            type: local
            local:
              basePath: /app/storage
          queue:
            type: postgres
    volumes:
      - ./data/kestra:/app/storage
    depends_on:
      postgres:
        condition: service_healthy
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.kestra.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.kestra.entrypoints=websecure"
      - "traefik.http.routers.kestra.tls.certresolver=letsencrypt"
      - "traefik.http.services.kestra.loadbalancer.server.port=8080"

2. Start the services:

$ docker compose up -d

3. Verify the services are running:

$ docker compose ps
$ docker compose logs

Create the Admin Account

Open https://kestra.example.com.
On the Create an admin user page, fill in email and a password with ≥8 characters, ≥1 uppercase, ≥1 number.
Click Create admin user, then Start Kestra UI.

Create and Run a Sample Workflow

1. Click **Flows → Create in the sidebar, then paste:**

id: hello_world
namespace: demo

tasks:
  - id: log_message
    type: io.kestra.core.tasks.log.Log
    message: "Hello from Kestra!"

2. Click **Save, then Execute in the top right.**

3. Open **Executions and select the run** — the status should read SUCCESS.

Next Steps

Kestra is running and served securely over HTTPS. From here you can:

Add schedules, webhook triggers, and event-based triggers to your flows
Install plugins for AWS, GCP, Kubernetes, dbt, and Python tasks
Wire RBAC for multi-team usage and store secrets via the secret manager

For the full guide with additional tips, visit the original article on Vultr Docs.