FAQ

Networking & Access

Does this work with Tailscale?

Yes. Any service can be restricted to Tailscale-only access. Traefik is set up for dual-stack IPv6 because Tailscale hands a client both an IPv4 and an IPv6 address — on an IPv4-only proxy the IPv6 connection arrives with the wrong source address and an IP allowlist rejects it. Traefik guide →

Do I need a Cloudflare account?

No. Cloudflare DNS-01 is what the Traefik installation uses, because it avoids exposing port 80 publicly, but per-domain certificates via the standard HTTP-01 challenge work with no Cloudflare account at all. Traefik guide — certificate strategy →

Security

How are services separated from each other?

Each application’s database and backend containers sit on an internal network of their own, with no route to the internet and none to another application. That part is genuine isolation. The web-facing container is different: it also joins the shared proxy network, and containers on a shared Docker network can reach each other directly on any port, so a compromised front end can address the other front ends without going through the proxy. That network is part of the threat model rather than outside it. Traefik reads the Docker socket through a filtering proxy instead of mounting it, and CrowdSec can be added on top. How far a compromise gets still depends on the container and the image it runs. How a server fits together →

Will my data be backed up automatically?

No. Backup is a separate setup step: Borgmatic is installed on the host, and the backup guide covers configuring it, dumping databases from running containers, and scheduling it. What to back up for a particular service is on that service’s page. Backup and restore →

Scope & evidence

How do I know whether a guide has actually been tested?

Each guide says so in one line under its title. Either it names a date and the exact version it was verified against, or it says no verification is recorded for the version it is written against. Underneath, a second line names what was not exercised — a restore, client sync, a specific integration. There is no overall grade to interpret: the date, the version and the named gap are the whole of it.

Is this safe to run in production today?

Read the two evidence lines on the guide for the service you want, and decide against your own tolerance. Two things apply everywhere regardless: only one application has had a restore performed from a backup, so for the rest recovery is yours to establish before you rely on it, and file paths and variable names can still change before the 1.0 milestone.

What can I actually deploy right now?

Traefik and CrowdSec for the server itself, Borgmatic for backups, and the applications that have a guide: Vaultwarden, Nextcloud, Invoice Ninja, Seafile Pro and OnlyOffice. The repository ships considerably more services, each with its own README, but a guide here is written only after the installation has been walked through. Applications →

Can I try a service without setting up a server?

Not by following these guides. Every one of them assumes a host with a domain and a reverse proxy in front, because that is the configuration they were written and checked against. A few stacks in the repository carry a second Compose file intended for localhost, but no guide here covers that path and none of the applications documented on this site has one.

Can I deploy only some services to a new server?

Yes — clone the repository once, then copy only the directories for the services you actually need to the target host. There is no dedicated deploy tool for this yet; copying the directories you need is the current path.

What does it cost?

The Blueprint itself is free and Apache 2.0 licensed. You pay for your own server and domain; the self-hosted services it configures are predominantly open source too.