Docker

make docker   # build from source, start, print the URL once healthy
make logs     # follow the logs
make down     # stop

Docker Compose reads .env, where PORT and ADDRESS choose where the container is published, and mounts redlib.toml read-only. ./data is mounted at /data and keeps the instance settings (overrides.toml), the database chosen at setup (auth-database.json) and the SQLite accounts file. Back it up, and keep it private: a PostgreSQL URL saved there contains its password.

Without make: cp redlib.example.toml redlib.toml && docker compose up -d --build.

Behind a reverse proxy

If the proxy runs on the same host, set ADDRESS=127.0.0.1 in .env so only it can reach the container. Terminate HTTPS at the proxy, since setup and sign-in need it. The proxy must pass the original Host header through, because sign-in forms check their origin against it.

Then open the instance and finish the first-run installer before it's public.