Standard Self-Hosted Setup Guide

volumes:
  postgres_data: {}
  app_data: {}
  redis_data: {}

services:
  db:
    image: 'postgres:18.6'
    volumes:
      - postgres_data:/var/lib/postgresql
    env_file:
      - '.env'
    logging:
      driver: "json-file"
      options:
        max-file: "5"
        max-size: "10m"
    restart: unless-stopped

  redis:
    image: 'redis:latest'
    command: redis-server
    volumes:
      - redis_data:/var/lib/redis/data
    restart: unless-stopped

  app:
    image: hududocker/hudu:latest
    env_file:
      - '.env'
    volumes:
      - app_data:/var/www/hudu2/public/uploads/
      - app_data:/var/www/hudu2/uploads/
      - app_data:/var/lib/app/data
    depends_on:
      - db
      - redis
    logging:
      driver: "json-file"
      options:
        max-file: "5"
        max-size: "100m"
    restart: unless-stopped

  worker:
    depends_on:
      - db
      - redis
    image: hududocker/hudu:latest
    command: bundle exec sidekiq -C config/sidekiq.yml
    volumes:
      - app_data:/var/www/hudu2/public/uploads/
      - app_data:/var/www/hudu2/uploads/
      - '.:/app'
    env_file:
      - '.env'
    logging:
      driver: "json-file"
      options:
        max-file: "5"
        max-size: "100m"
    restart: unless-stopped

  nginx:
    image: nginx:1.31-alpine
    container_name: nginx
    restart: always
    ports:
      - 80:80
      - 443:443
    volumes:
      - /var/www/hudu2/config:/config:ro
      - /var/www/hudu2/config/nginx/site-confs:/etc/nginx/conf.d:ro
      - /var/www/hudu2/config/certbot-webroot:/var/www/certbot:ro
      - /var/www/hudu2/public:/var/www/hudu2/public:ro
    depends_on:
      - app

  certbot:
    image: certbot/certbot:v5.7.0
    container_name: certbot
    volumes:
      - /var/www/hudu2/config/etc/letsencrypt:/config/etc/letsencrypt
      - /var/www/hudu2/config/certbot-webroot:/var/www/certbot

server {
  listen 80 default_server;
  listen [::]:80 default_server;
  server_name _;

  location ^~ /.well-known/acme-challenge/ {
    root /var/www/certbot;
  }

  location / {
    return 301 https://$host$request_uri;
  }
}

server {
  server_name _;
  listen 443 ssl;
  listen [::]:443 ssl;
  http2 on;
  root   /var/www/hudu2/public;
  index  index.html;

  # CHANGE: replace docs.yourdomain.com with your actual domain on these 2 lines
  ssl_certificate /config/etc/letsencrypt/live/docs.yourdomain.com/fullchain.pem;
  ssl_certificate_key /config/etc/letsencrypt/live/docs.yourdomain.com/privkey.pem;

  location = /.well-known/oauth-authorization-server {
    limit_except GET { deny all; }
    client_max_body_size 1k;
    proxy_http_version 1.1;
    proxy_set_header Connection "";
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto https;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_pass http://app:3000;
  }

  location = /.well-known/oauth-protected-resource {
    limit_except GET { deny all; }
    client_max_body_size 1k;
    proxy_http_version 1.1;
    proxy_set_header Connection "";
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto https;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_pass http://app:3000;
  }

  location /mcp {
    proxy_read_timeout 3600s;
    proxy_send_timeout 3600s;
    proxy_buffering off;
    proxy_cache off;
    proxy_set_header Connection '';
    proxy_http_version 1.1;
    chunked_transfer_encoding off;
    gzip off;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto https;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_pass http://app:3000;
  }

  location ~ /\. {
    deny all;
  }

  location ~* ^.+\.(rb|log)$ {
    deny all;
  }

  location /cable {
    proxy_pass http://app:3000/cable;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_read_timeout 240s;
    proxy_send_timeout 240s;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_pass_request_headers on;
    proxy_buffering off;
    proxy_redirect off;
    break;
  }

  location / {
    try_files $uri @rails;
  }

  location @rails {
    client_body_buffer_size 128k;
    proxy_next_upstream error timeout invalid_header http_500 http_502 http_503;
    send_timeout 5m;
    proxy_read_timeout 240;
    proxy_send_timeout 240;
    proxy_connect_timeout 240;
    proxy_set_header Early-Data $ssl_early_data;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto https;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Ssl off;
    proxy_redirect http:// $scheme://;
    proxy_http_version 1.1;
    proxy_set_header Connection "";
    proxy_cache_bypass $cookie_session;
    proxy_no_cache $cookie_session;
    proxy_buffers 32 4k;
    proxy_headers_hash_bucket_size 128;
    proxy_headers_hash_max_size 1024;
    proxy_pass http://app:3000;
  }
}

include /config/nginx/proxy-confs/*.subdomain.conf;
proxy_cache_path cache/ keys_zone=auth_cache:10m;

No. The standard setup includes built-in SSL via nginx and certbot, so variables like DISABLE_SSL and BEHIND_TLS_PROXY are not required.

Use MAX_FILE_SIZE to set the upload limit in MB. For example, MAX_FILE_SIZE=250 sets the limit to 250 MB. The default is 100 MB.

Use the S3 variables when USE_LOCAL_FILESYSTEM is not set to true. Configure S3_ACCESS_KEY_ID, S3_SECRET_ACCESS_KEY, S3_BUCKET, S3_REGION, and optionally S3_ENDPOINT for providers like Wasabi or MinIO.

Use S3_FORCE_PATH_STYLE=true for MinIO or other S3-compatible providers that require path-style bucket access.

Use S3_REMOVE_ENCRYPTION_HEADER=true if your S3-compatible provider rejects AWS server-side encryption headers.

Use S3_TURN_OFF_VERIFY_PEER=true only for trusted endpoints where TLS verification must be skipped. This is not recommended for public or untrusted endpoints.

Use RATE_LIMIT_REQUESTS to adjust the per-IP request limit and LOGIN_THROTTLE_PERIOD_SECONDS to adjust the login throttle window.

This means the HTTPS config hasn't been applied yet, or nginx hasn't been reloaded since you swapped it in. Confirm the certificate exists:

ls /var/www/hudu2/config/etc/letsencrypt/live/

If your domain shows up there, navigate to the config folder and confirm default.conf matches the HTTPS version above with the correct ssl_certificate paths:

cd /var/www/hudu2/config/nginx/site-confs/

Then reload:

sudo docker compose exec nginx nginx -s reload

Check whether nginx is actually staying up, rather than restart-looping:

sudo docker compose ps

If the nginx container shows a very recent "Up" time relative to when it was created, it's crashing and restarting. Check why:

sudo docker compose logs nginx --tail=50

A common cause is default.conf missing entirely from /var/www/hudu2/config/nginx/site-confs/, or a syntax error in the HTTPS version referencing a certificate path that doesn't exist yet. Test the config before reloading:

sudo docker compose exec nginx nginx -t

This is almost always ports 80/443 not being reachable from the public internet, or the A record not resolving to this server yet. Re-run the port scanner tool linked above, and confirm your domain resolves to this server's public IP with:

dig +short docs.yourdomain.com

Compare what's served to what's on disk:

echo | openssl s_client -connect localhost:443 -servername docs.yourdomain.com 2>/dev/null | openssl x509 -enddate -noout
sudo openssl x509 -enddate -noout -in /var/www/hudu2/config/etc/letsencrypt/live/docs.yourdomain.com/fullchain.pem

If the served date is older, the reload step didn't run - test it manually with the -T flag.