Self-Hosting

Prerequisites

• Docker and Docker Compose
• Tailscale installed and connected on the host machine
• A machine accessible to your Tailnet peers (e.g. Raspberry Pi 5, a home server, VPS with Tailscale)

Quick Start with Docker Compose

1. Clone the repository:

git clone https://github.com/crnobog69/zlikord.git
cd zlikord

2. Copy the example environment file:

cp .env.example .env

3. Edit .env with your settings:

API_ADDR=:8787
JWT_SECRET=your-secret-key-here
DATABASE_URL=postgres://zlikord:zlikord@db:5432/zlikord?sslmode=disable

4. Start the stack:

docker compose up -d

The API will be available at http://<your-tailscale-ip>:8787.

Environment Variables

Variable	Description	Default
API_ADDR	Server listen address	:8787
JWT_SECRET	Secret key for signing JWT tokens	(required)
DATABASE_URL	PostgreSQL connection string	(empty = in-memory store)
MESSAGE_ENCRYPTION_KEY	32-byte base64/hex key for at-rest message encryption	(optional)
SEN_CDN_SERVER_API	Sen CDN API key for avatar uploads	(optional)
MESSAGE_RATE_BURST	Max messages in rate limit bucket	5
MESSAGE_RATE_REFILL_PER_SEC	Tokens refilled per second	1

Without Docker

You can also run the server directly:

cd server
go build -o bin/zlikord-api ./cmd/api
./bin/zlikord-api

When DATABASE_URL is empty, the server uses an in-memory store — useful for testing, but data is lost on restart.

Database

Zlikord uses PostgreSQL. Migrations are applied automatically on startup when DATABASE_URL is set.

To run PostgreSQL separately:

docker run -d \
  --name zlikord-db \
  -e POSTGRES_USER=zlikord \
  -e POSTGRES_PASSWORD=zlikord \
  -e POSTGRES_DB=zlikord \
  -p 5432:5432 \
  postgres:17

Tailscale Setup

Zlikord is intended to be accessed only within your Tailnet. There is no need to expose ports publicly.

1. Install Tailscale on the host machine.
2. Run tailscale up and authenticate.
3. Note your Tailscale IP (tailscale ip -4).
4. Share that IP with your group — clients connect to http://<tailscale-ip>:8787.

For additional security, use Tailscale ACLs to restrict which devices can reach the server.