Self-hosting Deeperguard
Deeperguard runs as a Python app behind Gunicorn with optional TLS termination. This guide covers LAN homelab installs and WAN exposure.
Quick paths
| Goal | Start here |
|---|---|
| Proxmox LXC (homelab) | deploy/create-deeperguard-lxc.sh → deploy/bootstrap.sh → deploy/install-services.sh |
| Update running server | deploy/deploy-deeperguard.sh (set NOTES_HOST) |
| Public HTTPS (Cloudflare) | deploy/setup-cloudflare-tunnel.sh + deploy/PRODUCTION.md |
| iPhone / LAN HTTPS trust | Open http://<host>/ once → install /ca.crt |
First boot checklist
- Copy
deploy/deeperguard.env.example→/opt/deeperguard/config/deeperguard.env - Set
NOTES_ADMIN_EMAILSto the email you will register with - Set
NOTES_PUBLIC_HOST/NOTES_PUBLIC_URLfor passkeys and PWA - Run
deploy/fetch-ocr-assets.sh(client OCR for document search) - Run
deploy/install-services.shandsystemctl restart deeperguard deeperguard-tls - Register at
/register, then open/adminto manage users
Health & monitoring
GET /api/health— build, database size, OCR mode, readiness checks- Admin dashboard → Server — disk, database, search index size
- Post-deploy smoke:
deploy/verify-notes.sh,deploy/verify-zk-privacy.sh
Configuration reference
See deploy/deeperguard.env.example for SMTP, quotas, registration policy (NOTES_ALLOW_REGISTER), OCR, and session lifetime.
Backups
Daily encrypted vault backups run via cron (deploy/cron/deeperguard-backup). Pro users can also enable email and pCloud backups in app Settings.
Troubleshooting
| Symptom | Fix |
|---|---|
| iPhone cannot unlock offline | Enable Remember password in Settings → Security; trust HTTPS cert |
| Document search empty | Wait for Indexing… badge to clear; run Settings → Advanced → Re-OCR |
| Passkeys fail | Use https://www.deeperguard.com/ hostname or set NOTES_PUBLIC_HOST |
| Admin 403 | Add your email to NOTES_ADMIN_EMAILS and restart |