Skip to main content

Operating your instance

Day-two care: keeping it current, keeping copies of your data, and the three things that most often go wrong.

Updating​

docker compose pull && docker compose up -d

It pulls any newer images and recreates the containers; database migrations run automatically when the api container starts.

Backups​

Your data lives in bind-mounted folders under one data root (COBBLR_DATA_ROOT, ./data by default): Postgres, uploaded files, installed modules, and Caddy certs. Copy that whole tree and you have a complete backup. If you pointed COBBLR_DATA_ROOT at a data disk or a NAS mount, back that path up instead. For a database-only dump:

docker compose exec db pg_dumpall -U cobblr | gzip > cobblr-backup-$(date +%F).sql.gz

Workspace-level backups (restorable snapshots of one workspace, and off-box destinations like Google Drive) are covered in Backup and export.

Troubleshooting​

  • A device can't reach it (Tailscale). First confirm that device is signed into the same tailnet. What to check next depends on which Tailscale setup you chose. On the own-hostname setup (COBBLR_TLS_MODE=tsnet), the bundled proxy is the tailnet node: check docker compose logs caddy for the one-time approval link on a first run, and confirm the node still shows as authorized in the admin console (a tsnet node signs itself out after about six months unless you disable its key expiry). On the server's-own-name setup, tailscale serve status on the box should show the app on 127.0.0.1:8088; reaching it from off the tailnet needs tailscale funnel, not serve.
  • Phone can't reach the DuckDNS or Cloudflare name, laptop can. Some routers and Pi-hole setups block public names that resolve to private IPs ("DNS rebind protection"). Add an exception for the name, or add a local DNS entry mapping it to the LAN IP. This only applies to the internet-facing paths; Tailscale doesn't use public DNS at all.
  • Certificate didn't issue (DuckDNS or Cloudflare). Check docker compose logs caddy. The usual causes: a wrong DUCKDNS_TOKEN or CLOUDFLARE_API_TOKEN, or the box has no outbound internet to answer the ACME challenge. (COBBLR_ACME_EMAIL is optional and safe to leave blank; the proxy drops it when empty.) Certificates are cached under ./data/caddy once issued, so this is a first-run problem, not a recurring one.
  • Locked out: signup is closed and nobody can get in. Closed signup plus no operator is recoverable, because you own the box: everything is one .env edit away. No accounts at all? Set PUBLIC_SIGNUP_ENABLED=true, run docker compose up -d, register, then close it again. Have an account but no /admin? Put that account's email in SUPERADMIN_EMAILS and docker compose up -d; the operator check reads the list live, so the existing account is blessed retroactively. Once you're the operator, add people through signup invites instead of reopening signup.
  • Camera still blocked. Confirm the address bar shows https:// with no warning. On the offline CA option, the certificate must be trusted, not just installed; on iOS that's the extra toggle under Certificate Trust Settings.