Self-Hosting and Operation
A complete guide to running LockMyCal on your own infrastructure, in the cloud and on home servers.
Note
LockMyCal is gentle on system resources and runs reliably even on minimalist VPS machines with 1 vCPU and 1 GB of RAM.
What's in this section?
- Docker & Docker Compose – Deployment using the official Docker containers.
- Cloudron installation – One-click deployment for the Cloudron platform.
- Railway deployment – Lightning-fast cloud deployment on the Railway platform.
- Environment variables (.env reference) – A complete catalog of all configuration parameters.
- Reverse Proxy & SSL certificates – Configuring Caddy, Nginx, Traefik and Apache with WebSocket support.
- Backup and data recovery – PostgreSQL dumps, file recovery and emergency plans.
- System updates (Upgrades) – A safe procedure for updating containers and automatic migrations.
- Data-at-rest encryption – AES-256-GCM encryption of credentials (a custom implementation).
- Bot protection – Google reCAPTCHA v3 or Cloudflare Turnstile for registration and bookings.
- Outbound HTTP Proxy – Routing traffic in corporate networks and firewalls.
Installation via Docker Compose
Install LockMyCal with Docker Compose: system requirements, .env configuration, docker-compose.yml, first start, managing the admin and an Nginx proxy.
Installation on Cloudron
Install LockMyCal on Cloudron: managed PostgreSQL and backups, automatic SSL certificates, one-click updates and sign-in through the Cloudron user directory.
Deploying on Railway
Deploy LockMyCal on Railway step by step: a project from the GitHub repository, PostgreSQL database, environment variables and a custom domain.
Complete Environment Variables Overview (.env reference)
Complete LockMyCal environment variable reference (.env): app, PostgreSQL, email, calendars and OAuth, SSO, bot protection, networking and alerts.
Reverse Proxy Configuration (Nginx, Caddy, Traefik, Apache)
Reverse proxy for LockMyCal: ready-made Caddy, Nginx, Traefik and Apache configs with HTTPS, WebSocket support for LiveView and correct client IPs.
Backup and Data Recovery (Backup & Restore)
Back up and restore LockMyCal: PostgreSQL dumps with pg_dump, a daily cron script, backing up the encryption keys in .env, and disaster recovery.
Updating LockMyCal to a New Version
Upgrade LockMyCal to a new version with Docker Compose: database backup, building the image, restart, health check, rollback and breaking changes.
Data-at-Rest Encryption
Data-at-rest encryption in LockMyCal: OAuth tokens and CalDAV passwords encrypted with AES-256-GCM, generating DATA_ENCRYPTION_KEY and migrating from SECRET_KEY_BASE.
Bot Protection (reCAPTCHA v3 and Cloudflare Turnstile)
Protect LockMyCal booking and sign-up forms from bots: invisible reCAPTCHA v3 or Cloudflare Turnstile, getting keys, configuration and outage behaviour.
Configuring an Outbound HTTP Proxy (Firewall Egress)
Outbound HTTP proxy for LockMyCal in locked-down corporate networks: routing Google, Microsoft, Stripe and webhook calls, authenticated proxies and custom CA certificates.