A Linux VPS
A small VPS is enough for a private Circle. Keep SSH access restricted and expose only the ports you actually need.
Self-hosting guide
Run Circlus on your server.
Prepare a VPS and domain, deploy the open-source Circlus server, enable HTTPS, then return to the app to create your first private Circle.
What must be ready before the app
The app needs a real HTTPS server address. Never send a server access key over plain HTTP.
A domain
Point a domain or subdomain to the VPS. The Circlus server resolves Circles using the incoming host name.
HTTPS
Put Caddy, Nginx, or another reverse proxy with a valid TLS certificate in front of the Circlus server.
Optional managed services
Background push notifications and reliable TURN relay require a separate managed-services request. The core server can run while approval is pending.
The technical source of truth is the server README. It contains current Docker, environment, reverse-proxy, update, and backup commands.
Server setup step by step
Docker Compose is the recommended production path. A manual Node.js and PostgreSQL setup remains available for advanced deployments.
Rent and secure a VPS
Create a Linux VPS, add SSH keys, install Docker and Docker Compose, and keep PostgreSQL off the public internet.
Point the domain to the VPS
Create the required DNS record and wait until it resolves to the public address of the server.
Deploy the Circlus server
Clone the open-source repository, copy the minimal environment file, set unique secrets, and start the Docker Compose stack.
Enable HTTPS
Configure the reverse proxy to preserve the original Host header, then verify that the public /health endpoint returns ok.
Generate a short-lived access key
Run the server-admin claim command from the README. Treat the generated token as a password and use it once.
Create the first Circle in the app
Open Circlus, connect the empty server using its HTTPS address and claim token, then create the owner identity and first Circle.
Set up operations
Arrange database and configuration backups, updates, monitoring, and managed push/TURN access if you need it.
Creating a server and creating a Circle are separate operations. The server starts empty; the first Circle is created from the Circlus app after HTTPS is working.
Managed push and TURN access
Messaging, identities, and direct peer-to-peer calls can work before approval. Managed access enables background push delivery and TURN relay for restrictive networks.
Request server credentials
The form creates server-to-service push and ICE credentials. Save the generated environment variables immediately and wait for approval.
The request contains your contact and server ID, but not direct push-provider or coturn secrets.
Save this in the server environment
The shared secrets are shown once. The request remains pending until Circlus approves the server ID.
Operational rules worth keeping
The Circle owner and the server administrator may be different people, but infrastructure still needs deliberate maintenance.
Use HTTPS only
Send access keys only over HTTPS. Plain HTTP is acceptable only for local development on a machine you control.
Keep claim tokens short-lived
Generate a fresh token, use it once, and let it expire or revoke it. Do not store it in notes or chats.
Keep backups
Back up PostgreSQL, the server environment, reverse-proxy configuration, and external attachment storage.
Update deliberately
Back up first, apply published migrations, and verify /health and the main client flows after an update.
The server is ready. What next?
Create the first Circle in the app, then use the owner guide for invitations and daily management. If this server will receive an existing Circle, follow the migration guide instead.