Halloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsPC HealthRecommendedCrashes, freezes, slowdowns? Check your PC nowSpot repairable issues before they interrupt work.Check PCHalloween DealsAmazon USOctober picks are moving - compare before checkoutAmazon US: current deals, useful picks and tech finds.See Picks×
VGSOURCES
Get listed

CertbotPATCH 2026.10.15

How to Self-Host Fathom Lite Analytics on a Linux VPS

By VGSources Team 13 min read

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

You can run Fathom Lite on a Linux VPS with a release binary, a source build, or Docker. A production installation needs persistent application configuration and database storage, an administrator account, a public reverse proxy, HTTPS, and a service manager that starts Fathom again after a reboot. NGINX can expose the application at your domain while the Fathom process listens only on localhost; Certbot can obtain and renew a Let’s Encrypt certificate for that domain.

There is an important product distinction: Fathom Lite is the MIT-licensed, self-hosted predecessor to the current hosted Fathom Analytics service. The project describes Lite as no longer receiving new features and being maintained for bug fixes, a status you should re-check in the repository before deploying. Self-hosting gives you control over data location and infrastructure, but you also own updates, backups, monitoring, availability, and security.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What you are actually deploying

Fathom Lite is not the same operational product as hosted Fathom Analytics. The project’s comparison describes hosted Fathom as fully managed, while Lite is self-hosted: you run the server and apply updates yourself. Lite is an open-source, MIT-licensed previous version of Fathom Analytics, and its README says feature development has stopped while bug-fix maintenance continues. Because that statement can change, inspect the current repository and release notes before choosing it for a new installation.

The deployment has four layers:

  • Fathom application: the binary, source-built executable, or container.
  • State: the configuration, application secret, administrator credentials, and database.
  • Public edge: NGINX receives requests for your domain and proxies them to Fathom on a private listener.
  • Operations: systemd (or an equivalent supervisor), firewall rules, TLS renewal, backups, logs, and update testing.

Tracking does not begin merely because the server is running. You must create a site in the Fathom dashboard and put its tracking snippet on the pages you want to measure.

#1 Best Overall
CanaKit Raspberry Pi 5 Starter Kit PRO - Turbine Black (128GB Edition) (8GB RAM)
  • Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM)
  • Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
  • CanaKit Turbine Black Case for the Raspberry Pi 5
  • CanaKit Low Noise Bearing System Fan
  • Mega Heat Sink - Black Anodized

Choose a deployment method

Method What the documented process does Best fit Operational considerations
Release binary Downloads a platform release, extracts it to /usr/local/bin, makes it executable, verifies it with fathom --version, and starts it with fathom server. A conventional VPS installation with direct host control. You manage the executable, its working directory, permissions, service unit, and upgrades.
Build from source Uses Go and NPM, clones the project, runs make build, creates the required user, and starts ./fathom server. Operators who need a source build or want to inspect and control the build. Build-tool versions and source dependencies become part of your maintenance work.
Docker Builds an image with docker build -t fathom . or runs the published image with docker run -d -p 8080:8080 usefathom/fathom:latest. Hosts already standardized on containers. Persist the database and configuration outside the replaceable container. Do not treat the latest tag as an immutable production version; pin and review a known release.

Do not mix the examples blindly. A native process commonly listens on the port configured for your release, while the documented pre-built Docker example publishes container port 8080 on host port 8080. Pick one layout, record where its state lives, and make NGINX proxy to that exact local address.

Prepare the Linux VPS

Set the basic security boundary

Create a normal administrative account with sudo access, keep the operating system updated, and configure a firewall that exposes only SSH and the public web ports (80 and 443). The Fathom listener should not be reachable from the internet when NGINX is the public entry point. Bind it to localhost or otherwise restrict its port to local traffic.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Use a dedicated, non-root service account for Fathom. Its working directory must be writable by that account, because SQLite and other local state are relative to the application’s working directory unless you configure a different location. Keep the application secret and database outside any directory served as public web content.

Plan persistent storage

Allocate durable disk space for the database and configuration. A container replacement, binary upgrade, or source rebuild must not delete the database. For SQLite, the database is a file; for MySQL or PostgreSQL, the database is external but still needs its own backup and access controls. The production guide identifies SQLite as the default and points to configuration documentation for MySQL and PostgreSQL.

No universal disk size or backup interval is published in the installation material. Choose capacity from your traffic, retention, and log requirements, then monitor actual use. Establish a backup schedule, keep copies separate from the VPS, and perform restore tests; these are operator responsibilities rather than Fathom-enforced settings.

Install the release binary

The binary route minimizes build dependencies and gives you direct control over the host process. Use a release that matches the VPS operating system and CPU architecture.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  1. Download the appropriate release archive from the project’s current release page.
  2. Extract the executable and install it under /usr/local/bin.
  3. Make it executable, then verify that the shell can run it:
sudo chmod 0755 /usr/local/bin/fathom
fathom --version

The version check confirms that the executable is installed and runnable; it does not create the database or administrator account.

Rank #2
CanaKit Raspberry Pi 5 16GB Starter Kit PRO - Turbine Black (128GB Edition) (16GB RAM)
  • Includes Raspberry Pi 5 16GB with 2.4Ghz 64-bit quad-core CPU (16GB RAM)
  • Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
  • CanaKit Turbine Black Case for the Raspberry Pi 5
  • CanaKit Low Noise Bearing System Fan
  • Mega Heat Sink - Black Anodized

Create the working directory and configuration

Create a private working directory owned by the Fathom service account. Put the release’s .env file there. The documented example uses SQLite and includes settings for the server address, gzip, debug mode, database driver, database name, and a secret:

FATHOM_DATABASE_DRIVER='sqlite3'
FATHOM_DATABASE_NAME='fathom.db'

Use the exact variable names and syntax shown by the configuration reference for your release for the listener address, gzip/debug options, and application secret. Generate a long random secret on the VPS (for example, with the operating system’s cryptographic random utility), place it in the secret setting, and restrict the file so only the service account and administrators can read it. Do not put the secret in a public document, a web root, or a shell history that is shared with other users.

If you use MySQL or PostgreSQL instead of SQLite, configure the driver, connection details, and database name required by that version. Ensure the database server is reachable from the Fathom host and that its account has only the permissions the application needs.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Create the initial administrator

The first administrator account is a required setup step. The production guide and README use the release’s user-creation flow before starting the server. Run that command from the Fathom working directory, with the environment configuration loaded, and choose a unique, strong password. The precise command can vary by release, so use the current project documentation rather than copying an old command from a different version.

Start a foreground test

Run the server interactively before adding systemd:

fathom server

Watch the output for configuration, database, or permission errors. From the VPS, test the local listener with a command-line HTTP client against the address and port you configured. Stop the foreground process only after you have confirmed that it starts cleanly; the systemd unit will later run the same fathom server command.

Build Fathom Lite from source

A source build is useful when your operating policy requires reproducible builds or when you need to inspect the code. The README lists Go and NPM as prerequisites. Install versions supported by the current repository, then:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #3
CanaKit Raspberry Pi 5 Essentials Starter Kit (4GB RAM)
  • CanaKit Raspberry Pi 5 Essentials Starter Kit
  1. Clone the Fathom Lite repository using the clone URL shown in its current README.
  2. Change into the cloned directory.
  3. Run the project build target:
make build

Complete the optional configuration steps documented for that checkout, create the required user account, and start the resulting executable:

./fathom server

Keep the source tree, build toolchain, and generated executable in a controlled location. If you later rebuild, test the new executable with a copy or staging database before replacing the production binary. Preserve the existing configuration and database; a rebuild is not a reason to initialize a new instance.

Run Fathom with Docker

Use the documented image

The README documents this basic container run:

docker run -d -p 8080:8080 usefathom/fathom:latest

This is a packaging example, not a complete production data plan. The container is disposable; the database file and configuration must be mounted on persistent storage or moved to an external database. Otherwise, removing or recreating the container can remove the analytics history and settings.

Build a local image

From a checked-out source tree, build the image with:

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
docker build -t fathom .

For production, record the source revision or image digest you deployed. Review image age, release notes, and configuration changes before updating. Avoid silently pulling a moving latest tag during an automated restart.

Make the container restartable

Use a restart policy or a container orchestrator so a host reboot does not leave the application stopped. Whichever method you choose, verify that the persistent volume is mounted before the application starts and that the container can reach its database. If NGINX proxies to host port 8080, keep that port bound to localhost rather than publishing it on every network interface.

Put NGINX in front of Fathom

NGINX provides the stable public endpoint while Fathom remains on a private local address. Create a server block for your domain and proxy requests to the listener used by your installation. The production guide’s example forwards the client and host information that applications commonly need:

Rank #4
SANOOV Raspberry Pi 5 4GB Kit, 4GB RAM Single Board Computer with Active Cooler and ABS Case, Complete Raspberry Pi 5 Starter Kit for IoT Robotics Retro Gaming
  • All-in-One Complete Kit: This SANOOV RPi 5 bundle comes with Raspberry Pi 5 4GB RAM single board, active cooler, durable ABS case and screwdriver. No extra parts needed, ready to use right out of the box for beginners and hobbyists
  • Powerful Single Board Computer: Equipped with 4GB RAM and high-performance processor, delivers fast running speed for 4K playback, AI projects, programming and daily computing tasks. SANOOV for raspberry pi 5 4GB is equipped with broadcom 64 quad-core Arm Cortex A76 processor with gigabit ethernet and upgraded with IEEE 802.11ac Wi-Fi, Bluetooth 5.0 dual-band 2.4Ghz and 5Ghz and Power Over Ethernet (POE). Upgrading delivers 2-3 x speed vs Pi 4, redefining the experience
  • Efficient Active Cooler: Effectively lowers operating temperature and prevents performance throttling. Runs quietly even under long-time heavy load, ensures stable operation all day long. SANOOV RPi 5 4GB kit offer an active cooler, which combines an aluminium heatsink with a high-performance PWM fan. Active cooler is fully compatible with the Pi OS, which can effectively reduce the temperature of RPi5 and ensure its good performance during long-term high load operation
  • Sturdy ABS Protective Case: Well-fitted for Raspberry Pi 5 board, can be secured with 4 screws to effectively protect the Pi 5 motherboard from damage, reserves full access to all ports and buttons. SANOOV uses ABS material to produce the case, which has a softer texture and feel. Meanwhile, SANOOV case adopts a layered design for easy disassembly and installation. (Tip: The Case cannot install M.2 HAT Add on Board and Solid State Drive!)
  • Wide Application & Full Compatibility: Seamlessly compatible with official OS and mainstream peripheral accessories for Raspberry Pi 5. Whether you are a beginner, student, electronics hobbyist or professional developer, this all-in-one kit meets your diverse needs. It excels in IoT projects, robotics design, retro gaming devices, home media servers and other DIY creations. Backed by a large global community, you can easily find guides, technical support and shared projects online
server {
    listen 80;
    server_name my-fathom-site.com;

    location / {
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $host;
        proxy_pass http://127.0.0.1:9000;
    }
}

Use the actual local port configured for your Fathom process. If you are using the documented Docker mapping, that may be host port 8080 instead of 9000. Do not expose both a public Fathom port and NGINX unless you deliberately need that arrangement.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  1. Place the server block in the NGINX configuration directory used by your Linux distribution.
  2. Enable the site according to that distribution’s convention.
  3. Validate the complete configuration:
sudo nginx -t
  1. Reload NGINX only after the test succeeds:
sudo systemctl reload nginx

Point the domain’s DNS record at the VPS before requesting a certificate. If the local service works but the domain does not, check DNS, the firewall, the NGINX server name, and the proxy port separately.

Add HTTPS with Certbot

Once the domain resolves to the VPS and NGINX serves it over HTTP, install Certbot using your distribution’s supported package method. The documented certificate command is:

sudo certbot --nginx -d my-fathom-site.com

Certbot can obtain a Let’s Encrypt certificate and update the NGINX configuration. Follow its prompts for the email address, terms, and HTTP-to-HTTPS redirect. Test the HTTPS URL in a browser and verify that the certificate covers the exact hostname you use for the dashboard and tracking script.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Certificate issuance is not the same as certificate operations. Confirm that automatic renewal is enabled by the Certbot package, inspect renewal logs, and perform a dry-run renewal test where supported. If renewal fails, fix DNS, port 80 reachability, or NGINX configuration before the existing certificate expires.

Make the service start after reboot

For a native installation, use a systemd unit that runs as the dedicated service account, starts in the directory containing the configuration and SQLite file, and always attempts to restart after a crash. A representative unit is:

[Unit]
Description=Fathom Lite analytics
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=fathom
Group=fathom
WorkingDirectory=/var/lib/fathom
ExecStart=/usr/local/bin/fathom server
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target

The exact paths must match your installation. If the database file is in the working directory, make sure fathom can read and write it. Keep the environment file private and load it using the mechanism supported by your release and distribution; do not make it world-readable merely to simplify startup.

Best Value
RasTech Raspberry Pi 5 8GB Kit with Active Cooler and Pi5 Case
  • 【What you Get】You will get 1*Pi 5 8GB Single Board,1*RasTech Case,1*Active Cooler,1*Screwdriver,1*Installation instructions,12-month free warranty, lifetime service, 24-hour prompt and friendly response.
  • 【More Connectors】There are two USB 3.0 ports(5Gbps simultaneously) and two USB 2.0 ports, which triple total bandwidth ,support any combination of up to two cameras or displays. Peak SD card performance is doubled through support for the SDR104 high-speed mode. It provides a smooth desktop experience for you. Offer Gigabit Ethernet and a PCIe interface, along with dual-band Wi-Fi and Bluetooth 5.0/BLE wireless capability. The RasTech Pi 5 Kit use the new 27W 5.1V 5A USB-C power connector.
  • 【 Support Dual 4Kp60 Display 】Each of the two microHDMI sockets can control a 4K display at 60 Hertz, now support HDR, offering super HD video for media streaming projects. RPi 5 is the first RPi model that comes with a PCI Express port (PCIe 2.0 x1 with 500 MB/s) to attach SSDs (requires separate M.2 HAT).
  • 【 Excellent Chips And Applications】Pi 5 is a full-size Pi computer using silicon built in-house at Pi. The RP1 “southbridge” provides the bulk of the I/O capabilities for Pi 5. Pi 5 is more friendly and convenient in the development of Internet of Things, Web development, machine identification, automatic control and other electronic equipment applications and network.
  • 【 Faster CPU, Better GPU 】 Pi 5 features a Broadcom BCM2712 64-bit quad-core Arm Cortex-A76 processor running at 2.4GHz, it delivers a 2–3× increase in CPU performance relative to RaspberryPi 4. The 800MHz VideoCore VII GPU is compatible to OpenGL ES 3.1 and Vulkan 1.2, substantial uplift in graphics performance. Pi 5 Offers lightning-fast CPU speed, a PCI Express interface, a Real Time Clock (RTC) and a power button and runs significantly cooler than Pi 4.

After saving the unit, run:

sudo systemctl daemon-reload
sudo systemctl enable fathom
sudo systemctl start fathom

Check status and recent logs:

sudo systemctl status fathom
sudo journalctl -u fathom -n 100 --no-pager

Test recovery explicitly: restart the service, confirm the dashboard responds through NGINX, and schedule a controlled reboot during a maintenance window. A green systemd status is not proof that tracking works; it only proves that the process is running.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Create a site and install tracking

Sign in to the Fathom dashboard, create a site for the domain you want to measure, and copy the generated tracking snippet. Put the script in the tracked website’s header, on every page where visits should count. The support guidance identifies the site header as the intended location.

Open the public website in a separate browser session and watch the dashboard’s real-time visitor count. A real-time visit is the quickest practical check that the snippet is loading and reporting to your instance. If the count stays empty, inspect the browser developer tools for blocked requests, JavaScript errors, incorrect site configuration, and mixed-content warnings.

Account for a content-security policy

If the tracked site sends a Content-Security-Policy header, its script-src and img-src directives must permit the host name of your Fathom instance, as noted in the project README. Add only the specific Fathom origin you use, then retest the page. A CSP violation in the browser console explains why a correctly copied snippet can still produce no data.

Troubleshoot the common failure points

Symptom Likely check Correction
The service exits immediately. Read journalctl -u fathom and run the same command in the foreground. Fix malformed configuration, missing environment values, database permissions, or an incompatible executable.
NGINX returns 502 Bad Gateway. Confirm Fathom is running and listening on the address and port in proxy_pass. Correct the port, start the service, and ensure the local firewall rules allow the loopback connection.
The dashboard works locally but not by domain. Check DNS, ports 80/443, the NGINX server name, and the VPS firewall. Point DNS to the VPS, allow the public web ports, and reload the validated NGINX configuration.
HTTPS issuance fails. Verify that the domain resolves publicly and that HTTP reaches NGINX. Fix DNS or port 80 reachability, then rerun Certbot.
Data disappears after a container update. Inspect volume mounts and the database path. Move the database and configuration to persistent storage or an external database before recreating the container.
The dashboard has no live visitors. Open the page with developer tools and inspect the network and console. Confirm the snippet is in the header, the site was created in the correct instance, and CSP allows the Fathom host.

Backups, updates, and ongoing security

Back up the database and configuration as a matched set. For SQLite, stop writes or use a backup method that produces a consistent copy; simply copying a live file can produce an unusable backup. For MySQL or PostgreSQL, use the database engine’s supported dump or snapshot process. Encrypt backups, restrict access, and keep at least one copy away from the VPS.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Before an update, record the current binary or image version, back up the database, read the release notes, and test the upgrade in a separate environment when possible. The project’s older installation guide is dated 14 March 2019, so commands and paths in that guide may not match current releases. Treat the current repository documentation as authoritative for release-specific changes.

Monitor disk usage, database growth, NGINX errors, Fathom logs, certificate expiry, and failed systemd restarts. Apply operating-system security updates, keep SSH restricted, and review administrator accounts periodically. Self-hosting does not remove privacy or legal obligations: server geography and GDPR questions depend on your users, organization, and jurisdiction. The vendor’s older comparison article is not a regulator ruling; obtain current legal advice for your circumstances.

Self-hosted versus hosted Fathom

Self-hosting is attractive when you need control over where data and infrastructure run, already operate Linux services, or want to modify and package the open-source application yourself. It is a poor fit when you cannot provide reliable backups, patching, monitoring, incident response, and certificate maintenance.

Responsibility Fathom Lite on your VPS Hosted Fathom
Server, operating system, firewall You provide and secure them. The provider manages the service infrastructure.
Application updates You review releases and deploy them. Managed as part of the hosted service.
Database durability You choose storage and perform backups and restores. Handled within the provider’s service operations.
Public endpoint and TLS You configure NGINX, DNS, Certbot, and renewals. The hosted service supplies the endpoint and its certificate workflow.
Cost profile VPS, storage, administration time, and recovery work are yours; no universal total is established by the installation documentation. A subscription trades infrastructure work for a managed service.

The vendor’s comparison notes that self-hosting can cost more than a hosted solution once infrastructure and maintenance are included. Make the decision on total operating effort, not merely the monthly VPS price. A managed service removes much of the availability and update burden; a VPS gives you direct operational control but makes every outage, failed renewal, and missing backup your responsibility.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Production launch checklist

  • Confirm that the Lite maintenance status and current release documentation still meet your requirements.
  • Choose binary, source, or Docker and record the exact version or image digest.
  • Create a non-root service account and a private, persistent working directory.
  • Set the database driver and name, application secret, and server settings from the current configuration reference.
  • Create the initial administrator and verify a foreground start.
  • Put NGINX in front of Fathom, validate with nginx -t, and reload.
  • Issue HTTPS with Certbot and verify renewal.
  • Enable and start systemd, inspect logs, and test restart and reboot recovery.
  • Create the tracked site and install its header snippet.
  • Allow the Fathom host in script-src and img-src if CSP is enabled.
  • Confirm a real-time visit appears in the dashboard.
  • Document backups, restore tests, update review, disk monitoring, and incident contacts.

When each item is complete, you have more than a running process: you have a recoverable analytics service with a controlled public entry point and a tested tracking path.

Quick Recap

Bestseller No. 1
CanaKit Raspberry Pi 5 Starter Kit PRO - Turbine Black (128GB Edition) (8GB RAM)
CanaKit Raspberry Pi 5 Starter Kit PRO - Turbine Black (128GB Edition) (8GB RAM)
Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM); CanaKit Turbine Black Case for the Raspberry Pi 5
$259.95
Bestseller No. 2
CanaKit Raspberry Pi 5 16GB Starter Kit PRO - Turbine Black (128GB Edition) (16GB RAM)
CanaKit Raspberry Pi 5 16GB Starter Kit PRO - Turbine Black (128GB Edition) (16GB RAM)
Includes Raspberry Pi 5 16GB with 2.4Ghz 64-bit quad-core CPU (16GB RAM); CanaKit Turbine Black Case for the Raspberry Pi 5
Bestseller No. 3
CanaKit Raspberry Pi 5 Essentials Starter Kit (4GB RAM)
CanaKit Raspberry Pi 5 Essentials Starter Kit (4GB RAM)
CanaKit Raspberry Pi 5 Essentials Starter Kit
$189.99

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

CertbotDockerFathom LiteLinux VPSNGINXself-hostingsystemdweb analytics

Leave a reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Recommended PC Tool
Recommended PC Tool
Crashes, No Sound, or Screen Glitches?Free driver scan
PC Slower Than It Used to Be?Free scan - under a minute

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.