Self-Hosting

Run your own LynxPrompt instance with full control over data, features, and branding. A single Docker Compose file gets you started in minutes.

Quick Start

The fastest way to get LynxPrompt running is with the provided docker-compose.selfhost.yml.

1

Create an environment file

# .env
NEXTAUTH_SECRET=$(openssl rand -base64 32)
ADMIN_EMAIL=you@example.com
APP_URL=https://lynxprompt.yourcompany.com
2

Start the services

docker compose -f docker-compose.selfhost.yml up -d
3

Open the app

Navigate to http://localhost:3000 (or your configured APP_URL). The first user matching ADMIN_EMAIL is automatically promoted to superadmin.

Requirements: Docker Engine 24+ and Docker Compose v2. The default compose file uses a single PostgreSQL instance and exposes port 3000.

Environment Variables

All configuration is done through environment variables. Only NEXTAUTH_SECRET is strictly required.

Core

VariableDefaultDescription
NEXTAUTH_SECRETSession encryption key. Required. Generate with openssl rand -base64 32
APP_URLhttp://localhost:3000Public URL of the instance (used for callbacks, emails, and CLI)
NEXTAUTH_URLsame as APP_URLNextAuth callback URL. Usually the same as APP_URL
SUPERADMIN_EMAILEmail auto-promoted to superadmin on first sign-in
NODE_ENVproductionSet to production for self-hosted deployments

Database

VariableDefaultDescription
DATABASE_URL_APPMain application database (blueprints, marketplace)
DATABASE_URL_USERSUser accounts, sessions, authentication
DATABASE_URL_BLOGBlog content (when ENABLE_BLOG is on)
DATABASE_URL_SUPPORTSupport forum data (when ENABLE_SUPPORT_FORUM is on)

Authentication

VariableDefaultDescription
ENABLE_EMAIL_AUTHtrueMagic link email sign-in (requires SMTP)
ENABLE_PASSKEYStrueWebAuthn passkey sign-in
ENABLE_GITHUB_OAUTHfalseGitHub OAuth (requires GITHUB_ID + GITHUB_SECRET)
ENABLE_GOOGLE_OAUTHfalseGoogle OAuth (requires GOOGLE_CLIENT_ID + GOOGLE_CLIENT_SECRET)
ENABLE_SSOfalseEnterprise SSO (SAML, OIDC, LDAP)
ENABLE_USER_REGISTRATIONtrueAllow new user registration. Set to false for invite-only
ENABLE_TURNSTILEfalseCloudflare Turnstile CAPTCHA on sign-up

AI Features

VariableDefaultDescription
ENABLE_AIfalseEnable AI editing & wizard assistant
ANTHROPIC_API_KEYAnthropic API key (required when ENABLE_AI is true)
AI_MODELclaude-3-5-haiku-latestAnthropic model to use for AI features

Marketplace

VariableDefaultDescription
ENABLE_STRIPEfalseEnable paid blueprint purchases (requires Stripe keys)

Federation

VariableDefaultDescription
ENABLE_FEDERATIONfalseJoin the federated network to share and discover blueprints across instances
FEDERATION_REGISTRY_URLURL of the federation registry to connect to (provided by the network operator)

Branding & Content

VariableDefaultDescription
APP_NAMELynxPromptApplication name shown in UI, emails, and metadata
APP_LOGO_URLURL to a custom logo image
CONTACT_EMAILDisplayed as contact email in the UI
STATUS_PAGE_URLLink to your status page (e.g., Upptime, Kuma)
ENABLE_BLOGfalseEnable the built-in blog
ENABLE_SUPPORT_FORUMfalseEnable the support forum
UMAMI_SCRIPT_URLUmami analytics script URL (self-hosted analytics)

Authentication Configuration

Out of the box, LynxPrompt supports passkeys and email magic links. Add OAuth providers or lock down registration as needed.

Passkeys (default: on)

WebAuthn passkeys work immediately with no extra configuration. Requires HTTPS in production for browser WebAuthn APIs.

Email Magic Links (default: on)

Requires an SMTP server. Set EMAIL_SERVER and EMAIL_FROM in your environment. Without SMTP, disable with ENABLE_EMAIL_AUTH=false.

GitHub OAuth

Set ENABLE_GITHUB_OAUTH=true, GITHUB_ID, and GITHUB_SECRET. Create an OAuth App at GitHub → Settings → Developer settings → OAuth Apps. Set the callback URL to {APP_URL}/api/auth/callback/github.

Google OAuth

Set ENABLE_GOOGLE_OAUTH=true, GOOGLE_CLIENT_ID, and GOOGLE_CLIENT_SECRET. Configure in Google Cloud Console with redirect URI {APP_URL}/api/auth/callback/google.

Invite-Only Mode

Set ENABLE_USER_REGISTRATION=false to prevent new sign-ups. Existing users can still sign in. Admins can invite users via the admin panel.

AI Features Setup

AI-powered blueprint editing and wizard assistance are opt-in.

1

Get an Anthropic API Key

Sign up at console.anthropic.com and create an API key.

2

Set environment variables

ENABLE_AI=true
ANTHROPIC_API_KEY=sk-ant-...
AI_MODEL=claude-3-5-haiku-latest  # optional
3

Restart the container

AI buttons will appear automatically in the UI for all users.

Cost note: AI requests are billed by Anthropic to your API key. LynxPrompt does not add any surcharge. Monitor usage at the Anthropic dashboard.

Custom Branding

White-label LynxPrompt for your organization.

APP_NAME=MyCompany Prompts
APP_LOGO_URL=https://cdn.mycompany.com/logo.svg
CONTACT_EMAIL=support@mycompany.com
STATUS_PAGE_URL=https://status.mycompany.com

The app name is used throughout the UI, in page titles, email templates, and OpenGraph metadata. The logo replaces the default LynxPrompt logo in the header and email templates.

Database Architecture

LynxPrompt uses four Prisma clients, each with its own connection string. This allows flexible deployment topologies.

Single Database (recommended)

Point all four DATABASE_URL_* variables to the same PostgreSQL database. This is the default in docker-compose.selfhost.yml and is the simplest setup.

DATABASE_URL_APP=postgresql://...
DATABASE_URL_USERS=postgresql://...   # same
DATABASE_URL_BLOG=postgresql://...    # same
DATABASE_URL_SUPPORT=postgresql://... # same

Multi-Database

For larger deployments, split databases by concern. Each client connects to a separate database or server, allowing independent scaling and backup strategies.

DATABASE_URL_APP=postgresql://app-db/lynx
DATABASE_URL_USERS=postgresql://auth-db/users
DATABASE_URL_BLOG=postgresql://blog-db/blog
DATABASE_URL_SUPPORT=postgresql://sup-db/forum

CLI for Self-Hosted Instances

The LynxPrompt CLI works with self-hosted instances. After installing the CLI, point it to your instance:

lynxp config set-url https://lynxprompt.yourcompany.com
lynxp login

This stores the API URL locally. All subsequent CLI commands (push, pull, sync) will target your self-hosted instance instead of the public service.

Reverse Proxy & WAF

LynxPrompt works behind any reverse proxy (Nginx, Caddy, Traefik). However, if you use Cloudflare as a reverse proxy, there is an important caveat for the API.

Cloudflare WAF & Blueprint Content

Cloudflare's platform-level security layer inspects request bodies and blocks patterns that resemble OS command injection (e.g. ssh user@host, /etc/passwd). Since blueprints often contain infrastructure code, shell commands, and server configurations, these legitimate API calls can trigger HTTP 403 errors.

This protection is applied at Cloudflare's edge before configurable WAF rulesets run, and cannot be disabled via WAF exceptions or skip rules on any plan.

Recommended workaround:

Create a separate DNS record for API traffic that bypasses Cloudflare's proxy (DNS-only / grey cloud):

# Cloudflare DNS records:
#
# lynxprompt.yourcompany.com  →  A  your-ip  (Proxied, orange cloud)
# api.lynxprompt.yourcompany.com  →  A  your-ip  (DNS only, grey cloud)
#
# Then configure your reverse proxy to serve both domains,
# pointing to the same LynxPrompt backend.
#
# The CLI defaults to https://api.lynxprompt.com for the
# public instance. For self-hosted, point the CLI:
lynxp config set-url https://api.lynxprompt.yourcompany.com

The main domain keeps Cloudflare's CDN, DDoS protection, and caching for the web UI. The API subdomain routes directly to your origin, where your reverse proxy handles TLS and rate limiting.

Not using Cloudflare? No action needed. Reverse proxies like Nginx, Caddy, and Traefik do not inspect request bodies by default and work out of the box.

Federation

Federation connects independent LynxPrompt instances into a shared network. Users on any federated instance can discover and download blueprints published on other instances.

1

Enable federation

ENABLE_FEDERATION=true
FEDERATION_REGISTRY_URL=https://registry.lynxprompt.com
2

Restart the container

Your instance will register with the federation registry and begin syncing the blueprint index.

3

Browse federated blueprints

Blueprints from other instances appear alongside local ones in the browse page, tagged with their origin instance.

Note: Federation is optional. Without it, your instance works as a fully standalone platform with its own local blueprint library.

Health Check

LynxPrompt exposes a health endpoint for monitoring and orchestration:

GET /api/health

# Healthy response (200):
{"status":"ok","db":"connected"}

# Unhealthy response (503):
{"status":"error","db":"disconnected"}

Use this endpoint in Docker health checks, Kubernetes liveness probes, or external monitoring tools like Uptime Kuma.

# Docker Compose healthcheck example
healthcheck:
  test: ["CMD", "curl", "-f", "http://localhost:3000/api/health"]
  interval: 30s
  timeout: 5s
  retries: 3

Next Steps