Run your own Optizen with Docker. Each install is private: its own data, password, and SSH keys.
There are no accounts on this site. Get Optizen from GitHub and run your own copy: you sign in to your own dashboard, on your own server.
Any Linux VPS with Docker and the Compose plugin works. Point a DNS A record for the domain you will use for Optizen at that server, and open ports 80 and 443. Caddy fetches the HTTPS certificate on first start.
# on the server docker --version docker compose version
Clone the repository onto the server and move into it.
git clone https://github.com/stephengade/optizen.git cd optizen
Docker Compose reads these values from a .env file in the repository root. Pick a dashboard hostname that is hard to guess. The session secret must be random and kept private: the API refuses to start with a missing or short one.
DOMAIN=ops.example.com [email protected] SESSION_SECRET=<output of: openssl rand -hex 32>
Put the private keys for the servers you want to manage in ./ssh. They are mounted read-only into the API container, so in the dashboard you enter paths like /app/ssh/id_ed25519. Keys protected by a passphrase are supported.
mkdir -p ssh cp ~/.ssh/id_ed25519 ssh/ chmod 600 ssh/*
This builds the web app and API and starts them behind Caddy. Your data is stored in ./data, encrypted with the master password you create next.
docker compose up -d --build
A fresh install prints a one-time setup code to the API log. Open https://<DOMAIN>, enter that code and choose your master password. Without the code nobody else can claim the instance, even if they find the page first. The code changes on every restart. There is no recovery if you lose the password.
docker compose logs server | grep "Setup code" # then open https://ops.example.com
Optizen backs up its data once a day to ./data/backups (Settings → Backups, where you can also download and restore). Those copies live on the same server, so download one now and then or sync the folder elsewhere. Secrets in a backup stay encrypted: keep the master password safe too.
The encryption key lives only in memory. After the API container restarts, sign in once before webhook deploys can run.
Never commit .env, ./ssh, or ./data. All three are already in .gitignore.
Want to work on Optizen itself instead? See Get started for local development.
Next: add your first server and project
Quick start