Caddy Recommended

Caddy is the default choice for a public hub. It terminates HTTPS, redirects HTTP to HTTPS, and manages public certificates automatically when the hostname and network meet Caddy's HTTPS requirements.

Requirements

• Docker Engine and Docker Compose v2;
• a public DNS name resolving to this server; and
• inbound TCP 80 and 443.

Prepare the host with Debian or Ubuntu, Fedora, Alpine, AWS, Google Cloud, or DigitalOcean.

Install

sudo mkdir -p /opt/bearicorn
sudo chown "$USER":"$USER" /opt/bearicorn
cd /opt/bearicorn
git clone https://github.com/bybearicorn/monorepo.git
cd monorepo/deploy/compose
cp .env.caddy .env

Generate two independent secrets:

openssl rand -hex 32
openssl rand -hex 16

Edit .env:

Variable	Required value
JWT_SECRET	The 64-character value from the first command
DB_PASSWORD	The 32-character value from the second command
CADDY_SITE_ADDRESS	The hub hostname, such as chat.example.com
TZ	Optional IANA timezone; default UTC

Do not change CADDY_HTTP_PORT or CADDY_HTTPS_PORT; they are internal container listener ports matched by the Compose file.

DANGER

Do not deploy the placeholder secrets. Do not commit .env.

Start the stack

docker compose --env-file .env -f docker-compose.caddy.yml up --build -d
docker compose --env-file .env -f docker-compose.caddy.yml ps

Open the configured HTTPS hostname. Requests to the raw server IP do not match the configured site address.

Verify HTTPS

curl -I https://chat.example.com
docker compose --env-file .env -f docker-compose.caddy.yml logs --tail=100 caddy

If certificate issuance fails, verify DNS and public reachability on both ports before restarting Caddy.

Next steps

• Environment variables
• Back up and restore
• Update Bearicorn
• Troubleshoot containers