Self-hosting Meilisearch on an Ubuntu VPS is a practical production setup when you need control over data, networking, and operating cost. The reliable pattern is: prepare a supported Ubuntu server with persistent storage, install Meilisearch either as a native binary or in Docker, run it in production mode with a private master key, bind it to localhost, place Nginx in front for HTTPS, and manage the process with systemd. Backups, monitoring, and capacity planning then determine whether the deployment remains dependable as your index grows.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What a production Meilisearch VPS needs
A development process that answers requests on port 7700 is not automatically a production service. A production deployment must survive reboots, keep its data on storage that persists when the process or container is replaced, prevent unauthorised API access, and expose only the HTTPS interface you intend clients to use.
As an Amazon Associate I earn from qualifying purchases.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchMeilisearch’s production guidance describes the difference succinctly: “Running a Meilisearch instance on your own machine is easy. Going to production is a different job: you need it running as a service that survives reboots, sitting behind a reverse proxy, reachable over HTTPS on your own domain, and protected by an API key.”
Prerequisites
- A current, supported Ubuntu release on a VPS, with SSH access using a key pair.
- A non-root administrative account with sudo privileges.
- A writable filesystem reserved for Meilisearch data and enough free space for the index, temporary indexing work, and growth.
- A DNS name you control if the service will be reached from outside the VPS.
- A firewall policy that permits SSH and, once configured, only the public web ports you actually need.
- A backup destination outside the VPS, plus a tested restoration procedure.
Check the VPS architecture before downloading a binary. Meilisearch publishes Linux amd64 (x86_64) and aarch64 (arm64) builds that require glibc 2.35 or later. An incompatible architecture or older libc version will fail before configuration is even considered.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Choose an installation method
Both supported approaches work. Choose based on how your team upgrades and operates software rather than on a supposed performance difference that has not been established for your workload.
| Decision point | Native binary or APT with systemd | Docker with a persistent volume |
|---|---|---|
| Isolation | Runs directly on Ubuntu under a dedicated service account. | Packages the process and its runtime in a container. |
| Data location | A host directory passed as the database path. | A host directory or named volume mounted at /meili_data. |
| Upgrades | Replace the executable or install a new package, then restart and verify. | Pull a tested image tag, recreate the container, and retain the volume. |
| Rollback | Keep the previous executable and service configuration available. | Recreate the container with the previous image tag and the same volume. |
| Best fit | Operators who prefer Ubuntu services, journalctl, and host-level controls. | Teams already using Compose, image registries, and container monitoring. |
Do not choose a container merely because it is fashionable. A container without a persistent volume loses its index when the container is removed. Conversely, a native installation still needs disciplined ownership, permissions, upgrades, and service monitoring.
Prepare the Ubuntu VPS
- Connect with SSH. Use the provider’s public IP and your SSH key. Disable password authentication and direct root login after confirming that the administrative account works.
- Create a non-root administrator. Grant it sudo access and use that account for routine work. Reserve root for initial system administration.
- Apply security updates. Update the package index and install available security fixes before installing Meilisearch. Reboot if the kernel or another service requires it, then reconnect and verify that SSH still works.
- Inspect architecture and libc. Confirm whether the machine is x86_64 or arm64 and that its glibc meets the binary requirement. On an unfamiliar image, check the operating-system release and architecture before selecting a download.
- Create persistent storage. Pick a directory on durable disk for the index. Ensure the filesystem remains attached across reboots and is not an ephemeral container layer. Leave headroom for compaction, updates, and a second copy during backup or migration.
- Plan the network boundary. Decide whether only applications on this VPS will query Meilisearch (localhost binding) or whether a separate application host needs access through Nginx. The latter requires DNS, TLS, and a carefully restricted firewall rule.
Use a dedicated Unix account and directory ownership. The service should not write its database as root, and unrelated users should not be able to read files that contain the index or environment file holding the master key.
Install with Docker
The maintained image is getmeili/meilisearch. The essential Docker rule is to mount persistent storage at /meili_data and provide production settings as environment variables or an equivalent Compose configuration.
Docker run pattern
- Create a host directory for the data and assign it to the account or group used by the container. Verify that the directory is on persistent disk.
- Generate a long, random master key on a trusted administrative workstation or on the VPS without placing it in shell history. Store it in a root-readable environment file with restrictive permissions.
- Start the container with the data directory mounted to
/meili_data, production mode enabled, and the master key supplied through the supported environment variable. Publish port 7700 only to localhost when Nginx is on the same VPS. - Check the container logs and call the health endpoint locally. A healthy response confirms that the process is listening; it does not prove that authentication, indexing, TLS, or backups are correct.
A typical Compose file should pin a deliberate image tag rather than silently following an unreviewed latest build. Define the volume, environment variables, restart policy, and a localhost-only port mapping. Keep the Compose file free of the actual master key; reference a protected environment file or a secret mechanism instead.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Container-specific failure modes
- Index disappears after an upgrade: the container was recreated without the original volume, or the mount path was wrong. Stop, identify the original volume or host directory, and recreate the container with that exact mount.
- Permission denied on startup: the host directory is owned by an incompatible UID/GID. Correct ownership and mode rather than running the container as root.
- Remote clients cannot connect: port 7700 is intentionally bound to localhost. Use the Nginx HTTPS endpoint, or change the network design only after adding authentication and firewall restrictions.
Install the native binary or APT package
The native route uses the documented cURL binary or APT installation. Place the executable in a controlled location, create a dedicated data directory, and run it under systemd. A package-managed installation can simplify updates; a downloaded binary gives you explicit control over the exact release file.
Free tools Windows power users keep installed
One-click scans. No signup required.
Native installation sequence
- Confirm the Ubuntu architecture and glibc version.
- Download the matching Meilisearch release using the documented cURL method, or configure the supported APT source and install the package.
- Place the executable in a stable path such as
/usr/local/bin/meilisearch(or use the package’s path) and ensure it is executable. - Create a service account and a directory such as
/var/lib/meilisearchfor the database. Give the service account ownership of that directory. - Create a root-owned environment file containing production settings and the master key. Set permissions so only root and the service account can read it.
- Create the systemd unit described below, reload systemd, enable the service, and start it.
Keep the old executable and configuration available during an upgrade. Before replacing a running version, confirm that your backup can be restored and that the release’s compatibility notes do not require an intermediate step.
Enable production security and API authentication
Run Meilisearch in production mode and set a long, random master key. Treat that key like a database root credential: never commit it to a repository, paste it into browser code, or expose it in a client-side application. The launch option or environment variable must be supplied to the service process, not embedded in a public JavaScript bundle.
Once a master key is configured, all API endpoints except GET /health are protected. Applications should receive a narrowly scoped API key for the operations they need. A public search interface normally needs a search key restricted to the relevant indexes; indexing, document updates, key management, and task administration belong on a trusted backend.
Key roles
| Credential | Where it belongs | Use |
|---|---|---|
| Master key | Service environment and tightly controlled administration | Protects the instance and is used to create or manage API keys. Never send it to browsers. |
| Admin key | Backend jobs and operator tooling | Index creation, document updates, settings, task inspection, and key management. |
| Search key | Client-side search requests when necessary | Read-only search, ideally limited by index and other available restrictions. |
If a privileged key is exposed, revoke it and issue a replacement immediately. Rotating the master key is a planned maintenance operation: update the protected environment, restart the service, and update the backend credentials that depend on it.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Create a systemd service that survives reboots
For a native deployment, create /etc/systemd/system/meilisearch.service. The unit needs the executable path, the data path, production mode, the environment file, a dedicated user, and a restart policy. Adapt paths to your installation; do not copy a user or group name that does not exist on your VPS.
[Unit]
Description=Meilisearch search engine
After=network-online.target
Wants=network-online.target
[Service]
Type=simple
User=meilisearch
Group=meilisearch
EnvironmentFile=/etc/meilisearch.env
ExecStart=/usr/local/bin/meilisearch --db-path /var/lib/meilisearch --env production --http-addr 127.0.0.1:7700
Restart=on-failure
RestartSec=5
[Install]
WantedBy=multi-user.targetStore the master key and any other launch settings in /etc/meilisearch.env, make that file root-owned with restrictive permissions, and verify that the variable names match the release you installed. If your package supplies a different executable path or service account, use those values instead of creating a conflicting unit.
- Run
sudo systemctl daemon-reload. - Run
sudo systemctl enable meilisearchso it starts during boot. - Run
sudo systemctl start meilisearch. - Inspect
sudo systemctl status meilisearch. - Read recent logs with
sudo journalctl -u meilisearch -e, then follow them withsudo journalctl -u meilisearch -fwhile testing.
After a reboot, verify both that systemd started the service and that the data directory still contains the expected index. A service marked enabled but failing at boot is not an availability plan; monitor the exit status and logs.
Bind locally, then add Nginx and HTTPS
When the application and Meilisearch share one VPS, bind Meilisearch to 127.0.0.1:7700. This prevents direct internet access to the raw API. Nginx becomes the controlled public entry point and can terminate TLS, record access logs, and apply request policies before proxying to localhost.
DNS and firewall sequence
- Create an A or AAAA record for a dedicated search hostname that points to the VPS address.
- Wait for the record to resolve correctly from outside the server.
- Allow SSH only from the administration networks you need, if your provider firewall supports source restrictions.
- Allow TCP 80 temporarily for certificate validation and TCP 443 for HTTPS. Keep TCP 7700 closed to the internet.
- Install Nginx and configure a server block for the search hostname that proxies to
http://127.0.0.1:7700. - Obtain a TLS certificate through your certificate authority, enable automatic renewal, and test renewal before the first certificate expires.
- Redirect HTTP to HTTPS after certificate issuance, while retaining whatever port-80 behavior your certificate renewal method requires.
Nginx proxy considerations
Forward the original host and client information, use HTTP/1.1, and allow request bodies large enough for your documented indexing batches. Avoid adding a permissive cross-origin policy by default. If a browser application on another origin must search, configure only that origin and only the methods and headers it needs.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Test from the VPS with a request to the local health endpoint, then test the public hostname over HTTPS. Confirm that an unauthenticated request to a protected API receives an authentication error, while the health check behaves as expected. Never use a successful health response as proof that a privileged API is publicly safe.
Backups, restoration, and day-to-day operation
The Meilisearch data directory is the critical state. Back it up to storage outside the VPS and retain versions that match your recovery objectives. The documentation establishes the need for persistent writable storage, but it does not prescribe a universal schedule; choose one based on how much indexing work you can afford to repeat and how quickly the service must recover.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsA workable backup policy
- Define a recovery point objective: the maximum acceptable amount of indexing work to recreate after a failure.
- Capture backups while the service is in a consistent state according to the release’s backup guidance; do not assume copying live files is always sufficient.
- Encrypt off-host copies and restrict access to the operators who need restoration privileges.
- Keep at least one copy separate from the VPS provider account or region so a provider incident cannot remove both primary and backup.
- Perform a restoration test in an isolated environment. Verify index counts, representative searches, settings, and API authentication before declaring the backup usable.
Monitor the signals that matter
- Disk capacity and inode usage, including temporary headroom during indexing and compaction.
- Systemd service state, restart counts, and journal errors.
- Health endpoint availability from the local host and through the HTTPS proxy.
- Indexing task failures, queue growth, and unusually long task durations.
- Query latency and error rates at Nginx and in the application.
- TLS certificate expiry and renewal failures.
How large should the VPS be?
There is no defensible universal RAM or CPU number for Meilisearch. Capacity depends on document count, field sizes, searchable and filterable attributes, update frequency, concurrent queries, ranking settings, and the amount of temporary work required while indexes are built or compacted. A tiny catalog and a frequently reindexed game library can have very different resource profiles.
A measurement-based sizing process
- Estimate the current and one-year document count, average document size, and largest batch update.
- List attributes used for search, filtering, sorting, and faceting; these affect index structures and memory pressure.
- Replay representative indexing and query traffic on a staging VPS with the same storage class.
- Measure peak memory, CPU, disk throughput, free disk space, task duration, and p95/p99 query latency.
- Add operational headroom for compaction, backups, OS updates, and growth rather than sizing to the observed minimum.
- Choose storage with predictable durability and performance, then repeat the test after each major schema or traffic change.
Increase resources when tasks fail for memory or disk reasons, latency rises during indexing, or free space falls below your safety margin. Do not treat a provider’s smallest plan as a benchmark; select a plan from measurements and recovery requirements.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Native service, Docker, or managed hosting?
A single VPS provides control over region, network policy, disk, and upgrade timing, but you own patching, monitoring, backups, and recovery. Docker improves repeatability and rollback when your team already operates containers, but it does not remove the need for persistent storage or host security. A native service integrates directly with Ubuntu’s process manager and logs, at the cost of managing binaries and package changes.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Managed Meilisearch Cloud removes much of the server maintenance and may simplify scaling and support. Self-hosting remains attractive when data residency, private networking, predictable infrastructure cost, or custom operational controls matter more than minimizing administration. Compare the options on control, maintenance burden, backup responsibility, network integration, regional availability, and total cost for your measured workload.
Recommended Free Tools
If you compare VPS providers, evaluate persistent-disk durability, snapshots, region, bandwidth limits, support, recovery tooling, and the terms that apply to any referral arrangement. A provider name alone says nothing about whether its storage and recovery model fit your search index.
Troubleshooting checklist
The service will not start
- Read
journalctl -u meilisearchfor the first error, not only the final systemd status line. - Check the executable path, architecture, glibc compatibility, and execute permission.
- Confirm that the data directory exists, is writable by the service account, and is mounted after boot.
- Validate the environment file syntax and ensure the master key variable is present.
Requests return authentication errors
- Confirm that production mode and the master key are active in the running process, not merely present in an unused shell file.
- Use the correct key type for the endpoint. A search key cannot perform administrative operations.
- Check Nginx headers and proxy configuration if local requests work but HTTPS requests fail.
HTTPS works but searches fail remotely
- Verify DNS resolves to the intended VPS address and that the certificate covers the hostname.
- Check that Nginx proxies to localhost port 7700 and that the systemd service is listening there.
- Review firewall rules for ports 80 and 443 while keeping 7700 private.
- Inspect Nginx error logs and Meilisearch task logs for rejected payloads or failed indexing.
Performance degrades after adding an index
- Check free disk and memory during indexing, not only when the server is idle.
- Review newly searchable, filterable, or sortable fields and their effect on index size.
- Measure query latency and task duration with representative traffic before changing the VPS plan.
- Confirm that backups, scans, or unrelated jobs are not competing for the same disk throughput.
Upgrade and rollback discipline
Before an upgrade, record the current Meilisearch version, image or package source, service configuration, data path, and backup location. Read the release notes for compatibility or migration requirements. Test the new version against a restored copy of production data when the index is important enough to justify a rollback plan.
For Docker, pull the selected image, stop the old container cleanly, recreate it with the unchanged persistent volume, and verify health, authentication, representative searches, and indexing tasks. For a native install, keep the previous executable, replace the binary or package, restart systemd, and retain the prior file until validation is complete. If validation fails, stop the service, restore the previous executable or image, and use the same data directory only when the release documentation confirms it is safe; otherwise restore the tested backup to a separate path.
Production go-live checklist
- Supported Ubuntu release, correct CPU architecture, and current security updates.
- SSH-key access through a non-root administrative account.
- Persistent Meilisearch data directory with correct ownership and free-space alerts.
- Production mode enabled with a long, private master key.
- Scoped search key for clients; master and administrative keys kept on the backend.
- Systemd enabled, starting successfully after reboot, with logs reviewed.
- Meilisearch bound to localhost unless a documented private-network exception is required.
- DNS, Nginx reverse proxy, HTTPS certificate renewal, and firewall rules tested.
- Off-host backup created, encrypted, and restored successfully in a separate environment.
- Monitoring for health, tasks, latency, disk, memory, certificate expiry, and service restarts.
- Measured capacity plan and a written upgrade and rollback procedure.
Frequently Asked Questions
Can I expose port 7700 directly to the internet?
It is safer to bind Meilisearch to 127.0.0.1 and expose only Nginx over HTTPS. Direct exposure bypasses the reverse proxy’s TLS, logging, and network controls and is unnecessary when the application runs on the same VPS.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Is a Docker volume really required?
Yes. The index must live on persistent storage mounted at /meili_data. A container’s writable layer is disposable, so recreating the container without the volume can remove the database.
What should a browser-based search page receive?
Give it only a narrowly scoped search key. Keep the master key and administrative key in backend services and never place either credential in browser JavaScript.
How do I know whether the VPS is large enough?
Replay representative indexing and query traffic, then measure peak memory, CPU, disk throughput, free space, task duration, and tail latency with headroom for growth and maintenance. There is no universal RAM or CPU size.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →
