FAQ

Networking & Access

Does this work with Tailscale?

Yes. Any service can be restricted to Tailscale-only access. Traefik is set up for dual-stack IPv6 because Tailscale hands a client both an IPv4 and an IPv6 address — on an IPv4-only proxy the IPv6 connection arrives with the wrong source address and an IP allowlist rejects it. With the dual-stack default a tailnet client is seen with its own address over both. Traefik guide →

Do I need a Cloudflare account?

No. Cloudflare DNS-01 is what the Traefik installation uses, because it avoids exposing port 80 publicly, but per-domain certificates via the standard HTTP-01 challenge work with no Cloudflare account at all. Traefik guide — certificate strategy →

Security

How are services separated from each other?

Each application’s database and backend containers sit on an internal network of their own, with no route to the internet and none to another application. That part is genuine isolation. Where a backend service has to reach the outside — a worker that sends mail — it joins a second, outbound network of its own stack, and that stack’s guide says why. The web-facing container also joins its stack’s edge network, which only the proxy shares, so by default it reaches no other front end. A stack set to the shared proxy network is different: containers there reach each other directly on any port, without going through the proxy, and that choice is part of the threat model rather than outside it. Traefik reads the Docker socket through a filtering proxy instead of mounting it, and CrowdSec can be added on top. How far a compromise gets still depends on the container and the image it runs. How a server fits together →

Will my data be backed up automatically?

No. Backup is a separate setup step: Borgmatic is installed on the host, and the backup guide covers configuring it, dumping databases from running containers, and scheduling it. What to back up for a particular service is on that service’s page. Backup and restore →

Scope & evidence

How do I know whether a guide has actually been tested?

Each guide says so under its title: the date the stack last ran on a host, with the version that ran where the pin has moved since, and whether its data came back from a backup. A guide without that line has no host run behind it. A second line shows the pin, when upstream released it and whether upstream has released a newer version; a third, the findings the upstream images carry. There is no overall grade to interpret: the dates and the versions are the whole of it.

Is this safe to run in production today?

Read the two evidence lines on the guide for the service you want, and decide against your own tolerance. Two things apply everywhere regardless: only the applications marked with a restore in the catalogue have had their data restored from a backup, so for the rest recovery is yours to establish before you rely on it, and file paths and variable names can still change before the 1.0 milestone.

What can I actually deploy right now?

Traefik and CrowdSec for the server itself, Borgmatic for backups, and any application with a guide here — there are around thirty, listed under Applications. The repository ships more services than that, each with its own README, but a guide here is written only after the installation has been walked through. Applications →

Can I try a service without setting up a server?

Yes, for most stacks. They carry a second Compose file that runs the application on one machine, without a domain, TLS or a reverse proxy, and every guide whose stack has one starts with it under Try it locally. The block generates the secrets the stack needs, which ship empty, into that file. It is for trying the application out, not for running it: its values sit in a plain env file rather than in Docker Secrets.

Can I deploy only some services to a new server?

Yes. Check out a release of the repository on the server and start only the stacks you need — a stack that is not started is only files on disk. Keeping the Git checkout is what lets the server state which release it runs and move to the next one; a copied directory can answer neither.

What does it cost?

The Blueprint itself is free and Apache 2.0 licensed. You pay for your own server and domain; the self-hosted services it configures are predominantly open source too.