Self-Hosting Guide

OpenGlaze is currently optimized for a small-studio or personal self-hosted deployment: one Flask container, SQLite in a writable Docker volume, and local uploads in a second volume.

Quick start

git clone https://github.com/Pastorsimon1798/openglaze.git
cd openglaze
cp .env.example .env
# Edit SECRET_KEY before exposing the app publicly
docker compose up -d
curl http://localhost:8768/health

Open <http://localhost:8768>.

Supported production shape today

Browser -> OpenGlaze Flask container :8768
              |-> /data/glaze.db              (openglaze_data volume)
              |-> /app/frontend/uploads       (openglaze_uploads volume)

This keeps setup simple and matches the current code. PostgreSQL and Ory Kratos are present as experimental services, but they are not the supported default until the data layer is migrated away from SQLite-only connections.

Environment

Use `.env.example` as the source of truth. Minimum public deployment settings:

OPENGLAZE_MODE=personal
BASE_URL=https://openglaze.kyanitelabs.tech
FLASK_HOST=0.0.0.0
FLASK_PORT=8768
DATABASE_PATH=/data/glaze.db
SECRET_KEY=<32+ random bytes, e.g. openssl rand -hex 32>

Reverse proxy

The default compose app publishes port `8768`. You can put any trusted reverse proxy in front of it, or use the bundled nginx profiles.

HTTP-only nginx, useful behind a separate TLS terminator:

OPENGLAZE_HTTP_PORT=8080 docker compose --profile prod up -d
curl http://localhost:8080/health

Bundled TLS nginx expects PEM files at `./certs/fullchain.pem` and `./certs/privkey.pem`:

mkdir -p certs
# Copy your CA-issued certificate/key into certs/, then:
OPENGLAZE_HTTP_PORT=80 OPENGLAZE_HTTPS_PORT=443 docker compose --profile tls up -d
curl https://openglaze.kyanitelabs.tech/health

For local TLS smoke tests only, you can generate a temporary self-signed certificate:

mkdir -p certs
openssl req -x509 -nodes -newkey rsa:2048 \
  -keyout certs/privkey.pem \
  -out certs/fullchain.pem \
  -subj '/CN=localhost' -days 1
OPENGLAZE_HTTP_PORT=18080 OPENGLAZE_HTTPS_PORT=18443 docker compose --profile tls up -d
curl -k https://localhost:18443/health

For Caddy, a minimal external proxy is:

openglaze.kyanitelabs.tech {
  reverse_proxy localhost:8768
}

Backups

Inside a manual checkout:

DATABASE_PATH=glaze.db UPLOAD_DIR=frontend/uploads scripts/backup.sh

Inside Docker:

docker compose exec openglaze sh -lc 'DATABASE_PATH=/data/glaze.db UPLOAD_DIR=/app/frontend/uploads scripts/backup.sh'

For production, also snapshot Docker volumes:

Updates

git pull
docker compose down
docker compose up -d --build
curl http://localhost:8768/health

Security checklist

Current limits