Self-hosting Cobblr

Run Cobblr on your own machine, on your own network, with nothing but Docker. No subscription, and nothing you have to sign up for to use it.

The path:

1. Check what you need below: a Docker box on your LAN.
2. Install: two files and docker compose up, with a five-minute HTTP fast path you upgrade in place, or Tailscale from the start.
3. Operating covers updates and backups.

The end state is a working instance you can open from your phone, camera included.

What you need

• A machine on your LAN with Docker and Docker Compose. Linux, a Mac, a NAS, a mini PC, a Raspberry Pi (4/5, 64-bit), or an old laptop all work.
• The box's LAN IP (for example 192.168.1.50). Give it a DHCP reservation so it doesn't change out from under you.

That's the whole list. No repo to clone and nothing to compile: Install is two files and docker compose up.

Notably not on the list: an email server. Sending email is optional, and with nothing configured, password login works as normal and invites become copy-the-link.

How much machine

• For yourself or a household: a Raspberry Pi 4 or 5 with 4GB or more is plenty. Put Postgres on a USB SSD, not a microSD card, which is slow and wears out (a cheap SATA SSD in a USB 3.0 UASP adapter is a good example).
• For a busy instance with many active workspaces and users: a used mini PC (an Intel NUC, a Beelink) or a refurbished small-form-factor desktop with 8 to 16GB and an SSD is the sweet spot, more headroom for less money.

Why the hardware bar is low

At runtime Cobblr is light: a Node API, Postgres, and a proxy, with no local AI compute (AI and embeddings run on the provider you connect, not the box). The images are prebuilt (multi-arch, so a Pi pulls the arm64 build), so there's no on-device compile: the first run just pulls and starts.

A real, multi-tenant instance

What you run is the full thing, not a stripped-down single-user build: a production-level, multi-tenant server.

• One box can host many user accounts, each with their own isolated workspaces.
• Every workspace keeps its own database, walled off from the others.
• Run it just for yourself, or open it up to a household, a makerspace, or a business, all doing their own thing.

You are the operator

Running the instance makes you its operator, a super-admin who sits above every workspace. To become the operator:

1. Put your email in SUPERADMIN_EMAILS in .env.
2. Register your account normally. Nobody gets there by signing up. It is your email on the box that unlocks it.

From the operator console at /admin you can see and manage every workspace and every user on the instance:

• Check its health and adjust instance-wide settings.
• Mint sign-up invites, or remove a workspace outright.
• View-as mode: see a workspace as one of its users sees it, read-only unless you flip the write toggle, with a loud banner while you're in it.
• A product-metrics dashboard over the instance.

This tier is about running the server, so it's separate from the per-workspace roles (owner, admin, and the rest), which keep working exactly as they do inside each workspace.

The one gotcha: HTTPS for the camera

To scan from your phone you need HTTPS: browsers only let a web app use the camera (barcode scanning, photos) in a secure context, meaning HTTPS or localhost. A plain http://192.168.x.x LAN address is not secure, so the camera is silently blocked. No app-side flag changes this. It's a browser rule.

We recommend Tailscale. It gives Cobblr a real, auto-renewed ts.net certificate, handles the name and the routing itself, and forwards nothing to the internet.

Option	Nothing exposed to the internet	Trusted certificate	Per-device setup
Tailscale (recommended)	yes	yes, automatic	install the app once
Offline CA (tls internal)	yes	self-signed, trust it once	install a certificate
Cloudflare	no, you forward a port	yes	none

Install offers both speeds: a five-minute HTTP fast path you upgrade in place, or Tailscale from the start.

Why HTTPS is awkward on a home box, and why Tailscale wins

A public certificate authority will not issue a certificate for a private IP, and a public name can't reach your box unless you either open a port to the internet or run your own local DNS. That is the real constraint, and it's why the options trade off differently.

Tailscale sidesteps the whole problem in one move. In the easiest setup the bundled proxy joins your tailnet on its own, so the box needs no Tailscale install. You install the app on each phone or laptop you browse from, sign them into the same tailnet, and approve the box once from a one-time link the proxy prints (or hand it a reusable auth key for a fully headless join). After that the same URL works whether you're at home or across the country, with nothing exposed and no certificate to install by hand. For a tool you reach from your own devices, that is the entire HTTPS story, and it doubles as secure remote access. Nothing else here is both private and this simple.

The others exist for cases Tailscale doesn't fit. Cloudflare is the internet-facing path: it points a name you own at your box so anyone can reach it, which means forwarding a port, so you disable signup and rely on login. The offline CA is the no-network, no-Tailscale fallback: it works fully local but you trust its certificate on each device by hand.