Self-Hosting

Run Sylo on your own infrastructure. One command, fully self-contained.

Requirements

• A server with Docker installed (any cloud provider or bare metal)
• A domain name pointed to your server (for automatic TLS)

Quick start

git clone https://github.com/runplex/sylo.git
cd sylo/deploy
cp .env.example .env    # edit with your values
docker compose up -d

Your Sylo instance is now running at https://your-domain.com.

Configuration

Edit .env:

# Your domain — Caddy auto-provisions TLS via Let's Encrypt
DOMAIN=sylo.example.com

# Generate: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
ENCRYPTION_KEY=your-64-char-hex-key

# Generate: node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
BETTER_AUTH_SECRET=your-base64-secret

# Optional: Google OAuth for dashboard login
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=

What’s inside

docker compose up -d
  ├── caddy       — reverse proxy + auto TLS (Let's Encrypt)
  ├── sylo        — platform API + tunnel server + mitmproxy
  ├── postgres    — session store + audit log
  └── redis       — session cache (fast reads)

Ports

Port	Service	Purpose
80	Caddy	HTTP → HTTPS redirect
443	Caddy	Dashboard + API (TLS)
8443	Tunnel server	Tunnel connections (own TLS)

Port 8443 is exposed directly (not through Caddy) for the tunnel server.

Google OAuth setup

1. Go to Google Cloud Console
2. Create an OAuth 2.0 Client ID
3. Add https://your-domain.com/auth/callback/google as a redirect URI
4. Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET in .env

Data persistence

Volume	Stores
postgres-data	Sessions, audit logs, credentials, workspaces
redis-data	Session cache (rebuilds from Postgres on restart)
sylo-data	mitmproxy CA certificate
caddy-data	TLS certificates (Let’s Encrypt)

Updating

cd sylo
git pull
docker compose -f deploy/docker-compose.yml build sylo
docker compose -f deploy/docker-compose.yml up -d sylo

Backup & restore

# Backup
docker compose exec postgres pg_dump -U postgres sylo > backup.sql

# Restore
docker compose exec -T postgres psql -U postgres sylo < backup.sql

Using your instance

Point the SDK at your domain:

const sylo = new SyloClient({
  apiUrl: "https://sylo.example.com",
  developerSecret: "sylo_sk_...",
});

Sandboxes connect to sylo.example.com:8443 for tunnel mode.