Web dashboard for your domain portfolio, server inventory, and reverse proxy (Caddy / Traefik)
Libraries, tools, and inspirations: see THANKS.md.
cp .env.sample .env # BETTER_AUTH_SECRET, DATABASE_URL bun install && cd frontend && npm install && cd .. bun run db:migrate && bun run build && bun run start
Production Deployment:
curl -fsSL https://raw.githubusercontent.com/zhravan/proxydeck/main/scripts/bootstrap.sh | bashOr clone and run: git clone https://github.com/zhravan/proxydeck.git && cd proxydeck && ./scripts/install.sh
Set BETTER_AUTH_SECRET in .env. Either set DATABASE_URL (your Postgres; no Postgres container) or leave unset and use bundled Postgres (script will prompt for POSTGRES_PASSWORD and run docker compose --profile db up -d).
Prebuilt multi-architecture images are published to ghcr.io/zhravan/proxydeck for linux/amd64 and linux/arm64.
See Docker image deployment for pull commands, a complete Docker Compose example with bundled PostgreSQL, version pinning, and CI/CD publishing behavior.
Click to view .env variable definitions
| Variable | Meaning |
|---|---|
DATABASE_URL |
PostgreSQL connection string (optional: omit to use bundled Postgres with --profile db) |
POSTGRES_PASSWORD |
Used when running bundled Postgres (docker compose --profile db) |
BETTER_AUTH_SECRET |
Auth signing secret (e.g. openssl rand -base64 32) |
BETTER_AUTH_URL |
App base URL (default http://localhost:3000) |
PORT |
Server port (default 3000) |
CADDY_ADMIN |
Caddy admin API (optional) |
TRAEFIK_API_URL |
Traefik API URL (optional) |
TRAEFIK_DYNAMIC_CONFIG |
Traefik dynamic config path (optional) |
PROXY_LOG_FILE |
Proxy log file path (optional) |
Domain detail pages support an on-demand public check. The refresh endpoint runs the existing DNS, TLS, registration and host enrichment pipeline and stores an append-only snapshot for troubleshooting.
POST /api/domains/:id/checksruns a refresh for a domain owned by the signed-in user.GET /api/domains/:id/checks?limit=20returns recent snapshots. The limit defaults to 20 and is capped at 100.- Refreshes are session-authenticated, rate-limited to one check per domain per minute and 24 checks per user per minute (per application process).
- Snapshots are retained in
domain_check_runs; deleting a domain cascades to its snapshots. The latest snapshot is also reflected in the existingdomains.enrichmentfield for compatibility. - Run
bun run db:migratebefore starting an upgraded deployment.
The first version checks the domain’s DNS records, TLS certificate and existing registration/host enrichment. It does not run a separate HTTP status probe yet; scheduled portfolio-wide checks and webhook notifications are tracked separately.