4eb5fa6434
Both apps demanded a domain and Traefik. That was over-constrained: LibrePortal ships WireGuard, Headscale and private ports, so LAN and VPN-only is a first-class deployment here, and Rocket.Chat and Mattermost already prove chat apps work fine on http://<lan-ip>:<port>. The gate on Matrix rested on a mistake of mine: server_name being permanent. server_name and public_baseurl are independent — the identity can be a domain you own with no DNS behind it while clients reach the server on a LAN address, so federation can be switched on later by adding DNS and TLS, with no rebuild and no lost history. CFG_MATRIX_SERVER_NAME now exposes exactly that, and the install warns when it falls back to the machine's IP. What is genuinely lost without a domain is stated where it belongs, at install: Matrix cannot federate and Element's mobile apps want HTTPS; Stoat cannot do camera or microphone, because browsers gate getUserMedia on a secure context and a VPN does not change that, the check being on the URL scheme. Both now derive their URL from the port that was actually allocated. Since ports are only assigned during compose-up, each writes a best guess before start and corrects it afterwards, restarting only when the value really changed. Three bugs found while proving it works end to end: - The Synapse image writes /data as its UID/GID env, default 991, which under rootless is a host sub-UID owning nothing — so the generated signing key could not be moved by the install user. Both the generate container and the service now run as the same identity USER_TAG resolves to. - Element's config.json is bind-mounted as a file, and docker silently creates a DIRECTORY when the source is missing. An early return left exactly that landmine, which then broke every later run. It is written first now, and a stale directory is cleared. - A successful admin registration was reported as an error: checkSuccess read $? after an intervening [[ ]] test rather than the command's own status. Verified with no domain and no Traefik installed: Synapse answers /_matrix/client/versions and /health on http://<ip>:<port>, admin login returns a token, and Element is configured against the corrected base_url. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
LibrePortal
Your own private corner of the internet — free, open, and yours.
LibrePortal is a self-hosted platform for running the apps you rely on, on your own server: one-click installs, a reverse proxy with automatic SSL, rootless Docker, optional VPN routing, and a clean web dashboard to manage it all.
⚠️ v0.1.0 — early days. Expect rough edges while things settle.
Why LibrePortal
Too many services today treat your data as theirs to take — quietly overstepping boundaries that should never have been crossed. LibrePortal grew out of frustration with that: it's a way to run the apps you depend on on your own server, where your data stays yours. Privacy here isn't a feature to toggle — it's the whole point.
Free & open — forever
The entire platform is free software under the GNU AGPLv3. Self-host it and you get everything — every feature, no paywalls, no telemetry. See our Promise for exactly what that means.
What you get
- 📦 One-click self-hosted apps (Nextcloud, Vaultwarden, Jellyfin, Gitea, …)
- 🔀 Traefik reverse proxy + automatic Let's Encrypt SSL
- 🔒 Rootless Docker, CrowdSec, sane security defaults
- 🛡️ Optional VPN routing (gluetun) for any app
- 🖥️ A web dashboard to install, configure, back up, and monitor everything
Quick start
curl -fsSL https://get.libreportal.org/install.sh | sudo bash
This installs a versioned, checksum-verified release (Debian/Ubuntu, root). Put
data on separate disks with --system-dir= / --containers-dir= / --backups-dir=.
The
get.libreportal.orghost is still being set up — until it's live, build a release and install from it locally (see the docs below).
Documentation
- docs/guide/install-and-use.md — install, place data on separate disks/drives, update, back up, uninstall.
- docs/contributing/development.md — run a dev copy, cut stable/edge releases, and test them before publishing.
LibrePortal Connect (optional)
Self-hosting is free and complete. If you'd rather not fiddle with the tricky parts — like reaching your server from your phone, or keeping off-site backups — LibrePortal Connect will handle them for you. Here's the catch that makes us different: we work like a courier carrying a sealed box. We move your data between your devices and store backup copies, but it stays locked and you hold the only key — we can't open it, and we never run your apps for you. Everything we offer, you can also set up yourself for free. Our Promise spells out exactly where that line sits.
Contributing
PRs welcome — see CONTRIBUTING.md. We use a lightweight
DCO sign-off (git commit -s), no CLA.
Acknowledgments
LibrePortal has been built from scratch since 2023. Its spark of inspiration
was a small installer script from Brian McGonagill (OpenSourceIsAwesome):
gitlab.com/bmcgonag/docker_installs.
From that seed it grew start to finish — refined, extended, and refactored
into the platform it is today.
License
GNU AGPLv3. What's open stays open.