Self-hosting a detached engine

When an engine is detached, Relote stops managing it but the container keeps running on your server. You now own it end-to-end — including how it's reached on the network. This guide takes you from a fresh hand-off to a working https:// address on your own domain.

You'll need the handoff bundle (the secrets revealed at detach — keep APP_KEY safe) and the ability to log into the server with your access pack (SSH key + sudo password).

What changed at detach

• The container is still running on the server, listening locally (by default on port 8000 inside the container).
• Relote's edge for the old …engines.… address has been removed, so that hostname no longer resolves to your engine.
• There's no TLS certificate or public route anymore — that's what you set up below.

1. Point a domain at the server

Create a DNS record for the hostname you want to use, pointing at the server's public IP:

Type   Name                 Value
A      ce.example.com       <your server's IPv4>
AAAA   ce.example.com       <your server's IPv6, if any>

Wait for it to resolve before requesting a certificate:

dig +short ce.example.com    # should print your server IP

2. Serve it over HTTPS with a reverse proxy

Put a reverse proxy in front of the container; it terminates TLS (with automatic Let's Encrypt certificates) and forwards to the engine. Pick one of the following.

Option A — Caddy (simplest; automatic TLS)

Install Caddy, then use this /etc/caddy/Caddyfile:

ce.example.com {
    reverse_proxy 127.0.0.1:8000
    encode gzip
}

sudo systemctl reload caddy

Caddy fetches and renews the certificate automatically on the first request — nothing else to do.

Option B — nginx + certbot

# /etc/nginx/sites-available/ce.example.com
server {
    server_name ce.example.com;
    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
    listen 80;
}

sudo ln -s /etc/nginx/sites-available/ce.example.com /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx
sudo certbot --nginx -d ce.example.com      # issues the cert + switches to 443

If the engine runs in an Incus/LXC container, replace 127.0.0.1:8000 with the container's address (e.g. lxc list shows its IP), or publish the container's port to the host.

3. Tell the engine its public URL

So links, callbacks and cookies use the right address, set the engine's URL in its .env (inside the container) to match:

APP_URL=https://ce.example.com

Then restart the engine's web/queue processes (or the container). Keep APP_KEY exactly as handed over — it decrypts all existing data; changing it makes the data unreadable.

4. Verify

curl -I https://ce.example.com/        # expect HTTP/2 200 (or a redirect to the login)

Open the address in a browser and sign in with the admin credentials from the handoff bundle. You're now fully self-hosting.

Ongoing responsibilities

Once detached, these are yours:

• TLS renewal — Caddy and certbot renew automatically; just don't remove them.
• Backups — Relote no longer backs the engine up. Your existing sealed backups stay in your storage and restore with the recovery key, but taking and testing new backups is now up to you.
• Updates & uptime — the detached version is frozen; there are no managed updates, monitoring, or SLA.

See also Backups & recovery and Server & engine access.