Nomax self-hosted

Русская версия

Deploy Nomax (web app + relay) on any VPS with a single command. Optional HTTPS via Traefik and Let's Encrypt.

---

1. Quick start

Option A: Without HTTPS

1. Copy the config and open .env:

   cp .env.example .env
   nano .env

2. Disable Traefik: remove the line COMPOSE_PROFILES=traefik or set COMPOSE_PROFILES=.

3. Start:

   docker compose up -d

4. Done. Open in browser:

   • web app: http://server-IP:8080
   • relay: http://server-IP:4560

---

Option B: With HTTPS

1. Copy the config and open .env:

   cp .env.example .env
   nano .env   # or any editor

2. Fill in three fields:

   • ACME_EMAIL — your email (for Let's Encrypt)
   • CLIENT_HOST — web app domain (e.g. app.example.com)
   • RELAY_HOST — relay domain (e.g. relay.example.com)

3. Configure DNS: create A records for CLIENT_HOST and RELAY_HOST pointing to your VPS IP. Wait for DNS to propagate.

4. Start:

   docker compose up -d

5. Done. Open https://your-CLIENT_HOST in the browser.

---

2. Details

Requirements

Mode	Needed
Without Traefik (option A)	Docker, Docker Compose v2; ports 4560 and 8080 open
With Traefik (option B)	Docker, Docker Compose v2; domains with A records on VPS; ports 80 and 443 open

Environment variables

Variable	Description	Example
COMPOSE_PROFILES	Enable Traefik: traefik. Empty — no Traefik. This is a Compose variable, read from .env automatically	traefik
ACME_EMAIL	Email for Let's Encrypt (required with Traefik)	admin@example.com
CLIENT_HOST	Web app domain (for Traefik)	app.example.com
RELAY_HOST	Relay domain (for Traefik)	relay.example.com
CLIENT_PORT	Web app port on host (without Traefik)	8080
RELAY_PORT	Relay port on host (without Traefik)	4560
TRAEFIK_HTTP_PORT	Traefik HTTP port (if 80 is in use)	80
TRAEFIK_HTTPS_PORT	Traefik HTTPS port (if 443 is in use)	443

Do not commit .env (already in .gitignore).

How Traefik is disabled

The Traefik service in docker-compose.yml has profiles: [traefik]. Such services do not start until the profile is active. The COMPOSE_PROFILES variable sets active profiles: without traefik, Compose does not create the Traefik container — only relay and client start.

Ports and firewall

• With Traefik: external access — ports 80 and 443 only. Relay and client still listen on RELAY_PORT and CLIENT_PORT — useful for debugging; in production you can block them with a firewall.
• Without Traefik: access only via RELAY_PORT and CLIENT_PORT.

Let's Encrypt certificates

Certificates are stored in Docker volume traefik-acme. When changing domains or frequently recreating containers, respect Let's Encrypt rate limits. For testing you can use the staging server.