Skip to content
Papliba
Get started

Get started / 6 MIN READ

Host in your organization

Operate the application, PostgreSQL, identity configuration, and backups on your organization’s infrastructure.

What runs on the server

Self-hosted includes the web interface, ASP.NET backend, PostgreSQL, and persistent application storage. The Docker Compose package adds a Caddy HTTPS proxy. Users open a browser; they do not need a runner on their laptops.

Azure results are processed by your organization’s server. This option meets an organization-controlled hosting requirement, but not a requirement that processing remain only on each developer’s laptop. Use Local for that requirement.

Prepare the installation

  • A server with Docker Compose and a DNS hostname pointing to it.
  • A Microsoft Entra confidential web app in the admitted tenant, with a Web redirect URI of https://<your-host>/signin-oidc.
  • Azure Service Management delegated user_impersonation permission and any consent required by your organization.
  • Separate strong PostgreSQL runtime and administrator passwords, persistent storage, and a backup plan.

Configure and launch

  1. Obtain the self-hosted release directory from your administrator. Copy its .env example to .env and supply the host, tenant, application registration, and database settings.
  2. Restrict .env to its owner. Run bash create-server-key.sh ./secrets and back up the generated private certificate securely.
  3. Run docker compose up -d --build from the release directory. The package uses the prebuilt Linux x64 application.
  4. Open https://<your-host>/app/, sign in, and connect Azure. Verify two real users have separate workspaces before onboarding others.

Operate and upgrade

Back up PostgreSQL, the full application-data volume, and the encryption certificate together. Losing the certificate or keys can make stored sessions and tokens unreadable. Retain the previous release and back up before upgrading.

One application replica is supported. Workspaces are private per user; shared organization workspaces, invitations, and automatic retention are not implemented. Schema initialization and runtime-role grants must be applied through the deployment process, including when upgrading Policy Validation.