Home/Docs/Self-hosting on your own box
Deploy & ops · 6 min read

Self-hosting on your own box

Run the whole stack as an isolated Docker Compose deployment behind a single Cloudflare Tunnel.

You can run the entire platform as an isolated Docker Compose stack on a machine you already own — its own containers, database and secrets, separate from everything else on the host.

Ingress model (recommended)

One Cloudflare Tunnel is the only internet ingress — no open ports on your box. Route two hostnames to the app:

yourshop.linebook.ca → the public booking site, open to anyone.
studio.linebook.ca → the admin console, behind a Cloudflare Access policy (staff get an email code; nothing to install). The app also re-verifies the Access token at the origin.

Configure

cp .env.docker.example .env.docker
# generate the four app secrets + POSTGRES_PASSWORD
for k in SESSION_SECRET PASSWORD_PEPPER DATA_ENCRYPTION_KEY \
         BLIND_INDEX_KEY POSTGRES_PASSWORD; do
  echo "$k=\"$(node -e 'console.log(require("crypto").randomBytes(32).toString("base64"))')\""
done
NoteEscrow DATA_ENCRYPTION_KEY somewhere safe and separate from your backups — lose it and encrypted customer fields are unrecoverable.

Launch

docker compose --env-file .env.docker up -d --build
docker compose logs -f app   # watch it start ("Ready in …")

Staff reach the console at studio.linebook.ca/studio — Cloudflare Access prompts for an email code, then they log in. /studio on the public host returns 404.

Self-hosting on your own box — Linebook docs