Manual Setup

Nothing to configure. After first boot, the login page shows a Create Admin Account form — the first account created there becomes Admin. Subsequent users are invited from Admin → Users.

1. Go to Entra admin center → App registrations → New.
2. Redirect URI (Web): https://yourdomain.com/auth/callback
3. API permissions: User.Read, optionally Mail.Send for email.
4. Certificates & secrets → New client secret. Copy it now.
5. Drop these into your .env:

AZURE_TENANT_ID=...
AZURE_CLIENT_ID=...
AZURE_CLIENT_SECRET=...
AZURE_REDIRECT_URI=https://yourdomain.com/auth/callback
AZURE_ALLOWED_ORIGINS=https://yourdomain.com

1. Open Google Cloud Console → APIs & Services → Credentials.
2. Create OAuth client ID → Web application.
3. Authorized redirect URI: https://yourdomain.com/auth/google/callback
4. Copy client ID and secret into .env:

GOOGLE_CLIENT_ID=...
GOOGLE_CLIENT_SECRET=...
GOOGLE_REDIRECT_URI=https://yourdomain.com/auth/google/callback

Add Mail.Send application permission to your Entra app, then grant admin consent. The only env var needed is the sender address:

MAIL_FROM=noreply@yourdomain.com

Enable Gmail API in your Google Cloud project. Add gmail.send scope. Sender + service-account JSON are configured in Admin → Authentication → Email.

Drop host, port, user, password into Admin → Authentication → Email. No env vars required.

# /etc/caddy/Caddyfile
yourdomain.com {
    reverse_proxy 127.0.0.1:8090
    request_body { max_size 50MB }
}

sudo systemctl reload caddy

# /etc/nginx/sites-available/resolvd
server {
    listen 80;
    server_name yourdomain.com;

    client_max_body_size 50M;
    location / {
        proxy_pass http://127.0.0.1:8090;
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

sudo ln -s /etc/nginx/sites-available/resolvd /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx
sudo certbot --nginx -d yourdomain.com

If your domain is already on Cloudflare with proxy enabled, generate an Origin Certificate in the Cloudflare dashboard (SSL/TLS → Origin Server) and use the ready-to-use config shipped with the repo at nginx/host-proxy.conf:

sudo cp nginx/host-proxy.conf /etc/nginx/sites-available/resolvd
# Drop your origin cert + key into /etc/nginx/cloudflare/
sudo ln -s /etc/nginx/sites-available/resolvd /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx

Set Cloudflare SSL/TLS mode to Full (strict).

cloudflared tunnel login
cloudflared tunnel create resolvd
cloudflared tunnel route dns resolvd yourdomain.com

Edit ~/.cloudflared/config.yml:

tunnel: <tunnel-uuid>
credentials-file: ~/.cloudflared/<uuid>.json
ingress:
  - hostname: yourdomain.com
    service: http://127.0.0.1:8090
  - service: http_status:404

cloudflared service install

Add labels to the nginx service in docker-compose.yml and put it on your Traefik network:

labels:
  - "traefik.enable=true"
  - "traefik.http.routers.resolvd.rule=Host(`yourdomain.com`)"
  - "traefik.http.routers.resolvd.entrypoints=websecure"
  - "traefik.http.routers.resolvd.tls.certresolver=letsencrypt"
  - "traefik.http.services.resolvd.loadbalancer.server.port=80"