The most dependable setup for a small OpenProject installation on a Linux VPS is the official Docker Compose stack behind Nginx. Docker keeps OpenProject, its database, and supporting services isolated; Nginx owns the public IP, TLS certificate, and HTTP-to-HTTPS redirect. Set a permanent hostname, persist the assets directory, forward the original host and HTTPS headers, and keep SECRET_KEY_BASE stable. The procedure below covers installation, reverse-proxy configuration, upgrades, backups, sizing, and the failure modes that usually cause blank pages or SSL errors.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What the finished architecture looks like
Your VPS runs two layers:
- Nginx on the host: listens on ports 80 and 443, redirects HTTP to HTTPS, terminates TLS, and proxies requests to OpenProject.
- OpenProject in Docker Compose: runs the application and its supporting containers on a private Docker network. Publish only the local host port that Nginx needs (the documented example uses port 8080).
Users visit an FQDN such as openproject.example.com. DNS points that name to the VPS. Nginx receives the request, preserves the original host and client address, adds X-Forwarded-Proto: https, and sends it to OpenProject over the loopback interface. OpenProject’s current Docker image does not terminate SSL itself, so the edge proxy is not optional for a production HTTPS deployment.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Choose Docker Compose or the package installer
For a small or isolated VPS, Docker Compose is the recommended installation path. The official installation guidance positions Compose for smaller instances and Helm for larger installations. A package installation can be appropriate when your distribution is explicitly supported and you want services managed directly by the operating system, but package support is limited to listed distributions. The documentation specifically warns that packages are not built for newer releases such as Ubuntu 24.04.
| Decision factor | Docker Compose | Package installer |
|---|---|---|
| Best fit | Small installations, isolated services, or a VPS that already has Nginx or other software. | A supported Linux distribution where you prefer native service management. |
| Distribution coverage | Works wherever a supported Docker Engine and Compose plugin can run. | Limited to distributions and versions listed in the current package documentation; newer releases such as Ubuntu 24.04 are called out as unsupported. |
| Isolation | Application, database, and supporting components are separated into containers. | Processes and dependencies are installed on the host. |
| Reverse proxy | Nginx can remain on the host and proxy to a local mapped port. | The packaged process listens on 127.0.0.1:6000 by default, so Nginx proxies to that local listener. |
| Persistent data | Explicitly mount and back up assets and the database outside the container lifecycle. | Use the package’s host paths and service backup procedure. |
| Growth path | Good for a smaller VPS; move to a more scalable design when the workload outgrows one host. | Useful where the supported operating-system integration is more important than container isolation. |
If Nginx is already serving another site, Compose avoids replacing that web server. If your operating system is newer than the package support matrix, use Compose rather than forcing an unsupported package installation.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Prepare the VPS before installing OpenProject
Confirm the basic prerequisites
- A Linux VPS with a supported Docker Engine and Docker Compose plugin.
- Root or
sudoaccess for installing software, creating directories, and binding ports 80 and 443. - A DNS A (and, if applicable, AAAA) record for the public FQDN pointing to the VPS.
- Nginx installed on the host, with the ability to reload its configuration.
- A certificate and private key for the hostname. The certificate can be issued by your chosen certificate authority; Nginx only needs the resulting files and their correct permissions.
- Firewall rules allowing TCP 80 and 443 from the Internet. Keep the OpenProject container port private and reachable only from the local host or Docker network.
Plan storage and backups
There is no single official CPU, RAM, or disk baseline that fits every OpenProject deployment. Capacity depends on the number of users, attachment volume, database growth, and background jobs. Start with the current system-requirements guidance when selecting a VPS, then monitor memory, CPU, disk usage, and job queues after real users begin working. Reserve separate backup storage: a container image can be recreated, but your database and uploaded assets cannot be reconstructed from the image alone.
Install the official Docker Compose stack
1. Clone the stable Compose repository
From a directory where you keep service deployments, clone the stable branch. The documented command pins the deployment files to the stable/17 line:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →git clone https://github.com/opf/openproject-docker-compose.git --depth=1 --branch=stable/17 openproject
cd openprojectThe --depth=1 option retrieves the current tip of that branch without the full Git history. When you deliberately upgrade to a later stable branch, review the release notes and migration requirements before changing the branch.
2. Create and edit the environment file
cp .env.example .envOpen .env in an editor and set the values for your deployment. At minimum, use the public FQDN in OPENPROJECT_HOST__NAME. The double underscore in that variable name is intentional. If you configure collaborative features, set COLLABORATIVE_SERVER_URL to the URL those features use.
OPENPROJECT_HOST__NAME: the exact hostname users enter, without a protocol prefix.COLLABORATIVE_SERVER_URL: the collaboration service URL when that optional functionality is enabled; otherwise leave the example’s default behavior intact.SECRET_KEY_BASE: a long, unique secret stored like a password. Do not reuse it between installations or commit it to a public repository.- Asset path settings: if you keep the example
OPDATAmapping, create the matching host directory and apply the documented ownership before starting the stack.
3. Create the persistent assets directory
For the example OPDATA value, run:
sudo mkdir -p /var/openproject/assets
sudo chown 1000:1000 -R /var/openproject/assetsThe numeric owner matters because the container process expects UID 1000. If you choose a different host path, change the environment value and apply equivalent permissions. Verify that the directory remains present when containers are recreated; otherwise attachments and generated assets can disappear even though the application itself starts normally.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
4. Start the stack for the initial local check
The quick-start command uses HTTP only to let you verify that the containers come up before the reverse proxy is ready:
Free tools Windows power users keep installed
One-click scans. No signup required.
SECRET_KEY_BASE=<your-secret-key-base> OPENPROJECT_HTTPS=false docker compose up -d --build --pull alwaysReplace the placeholder with your unique secret. The command rebuilds as needed, pulls the current images, and starts the services in the background. Check container status and logs with your normal Docker Compose workflow, then test the mapped local port from the VPS. Do not expose this temporary HTTP mode to the public Internet longer than necessary.
5. Change bootstrap credentials immediately
The quick-start documentation’s printed or default admin credentials are bootstrap values, not production credentials. Sign in as soon as the application is reachable, change the administrator password, create individual user accounts, and remove any shared credentials from notes or shell history. Apply the least privilege needed for each project role.
6. Remove the insecure HTTPS override
Before production use, remove OPENPROJECT_HTTPS=false. OpenProject starts with HTTPS behavior enabled by default, while Nginx performs the actual TLS termination. Leaving the flag in place disables secure session cookies and is strongly discouraged for a public deployment. Restart the stack after editing .env so the containers receive the intended settings.
Configure Nginx as the TLS reverse proxy
Use the public hostname in both server blocks
Create an Nginx site configuration with one HTTP server that redirects and one HTTPS server that proxies. The following is the documented shape; substitute your real hostname, certificate paths, and mapped OpenProject port:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
server {
listen 80;
server_name openproject.example.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl;
server_name openproject.example.com;
ssl_certificate /etc/ssl/crt/server.crt;
ssl_certificate_key /etc/ssl/crt/server.key;
proxy_redirect off;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_pass http://127.0.0.1:8080;
}
}Use the actual certificate and key locations on your VPS. If your Compose file maps another host port, replace 8080 accordingly. For a package installation, proxy to http://127.0.0.1:6000, the packaged process’s default local listener.
Why each forwarded header matters
Hostlets OpenProject generate links for the configured FQDN instead of the internal container address.X-Real-IPsupplies the immediate client address.X-Forwarded-Forpreserves the proxy chain for logs and application auditing.X-Forwarded-Proto httpstells OpenProject that the browser used HTTPS even though Nginx may speak plain HTTP to the local container. The packaged installation also requires this header for correct HTTPS behavior.proxy_redirect offprevents Nginx from rewriting application redirects into an internal URL.
Validate and activate the site
- Save the configuration in the location used by your distribution and enable the site if your Nginx layout uses separate enabled-site links.
- Check syntax with
nginx -t. Fix every reported error before reloading. - Reload Nginx without stopping existing connections.
- Visit the HTTPS hostname in a browser and confirm that the certificate name, redirect, login page, and static assets all load from the public FQDN.
Keep port 8080 (or the equivalent mapped port) bound to loopback rather than the public interface. The public entry point should be Nginx on 443.
Understand OpenProject’s HTTPS settings
Two separate concerns are often confused:
- TLS termination: Nginx presents the certificate and encrypts the browser connection.
- Application URL and secure cookies: OpenProject must know its public hostname and that the original request scheme was HTTPS.
The Docker image does not use SSL by default. That is why a reverse proxy is required. During a local first start, OPENPROJECT_HTTPS=false can make an HTTP check possible, but it disables secure session cookies. Once Nginx is ready, remove the override and pass X-Forwarded-Proto https.
Troubleshoot the failures you are most likely to see
ERR_SSL_PROTOCOL_ERROR
- Confirm that Nginx is listening on 443 and that the certificate and key paths exist.
- Check that DNS points to this VPS, not an old address.
- Run
nginx -tand inspect the Nginx error log. - Verify that the browser is reaching Nginx, not the container’s plain-HTTP port.
- Ensure the HTTP server redirects to the HTTPS hostname and that the HTTPS server has the same
server_name.
Redirect loops or links that point to HTTP
Check OPENPROJECT_HOST__NAME, remove OPENPROJECT_HTTPS=false, and ensure Nginx sends X-Forwarded-Proto https. A missing or incorrect forwarded scheme makes the application believe every request is insecure and can produce repeated redirects.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsOpenProject shows an internal hostname or wrong port
Confirm the Host header and the public hostname variable. Nginx must proxy to the local mapped port, while OpenProject must generate URLs from the public FQDN. Do not set the hostname to localhost, a container name, or the VPS’s private address.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Attachments fail or vanish after a recreate
Inspect the OPDATA mapping and verify that the host directory exists and is owned by UID 1000. A container restart should not remove data from a correctly mounted host directory. Back up that directory independently of Docker image and container operations.
The application starts but users cannot stay logged in
Make sure SECRET_KEY_BASE is present and unchanged in the environment used by every application container. Treat it as a password. Changing it invalidates cookies, active sessions, and remembered two-factor-authentication tokens, so users must sign in again and re-establish remembered 2FA devices.
The proxy returns 502 Bad Gateway
- Check that the Compose containers are running and healthy.
- Confirm the Nginx
proxy_passport matches the host port actually published by Compose. - From the VPS, test the local listener rather than the public DNS name.
- Read both Nginx’s error log and the Compose service logs; a stopped application and a wrong port produce similar browser symptoms but require different fixes.
Backups, upgrades, and day-to-day operations
Back up both classes of persistent data
Maintain at least two independent backup sets:
- Database: use a consistent database dump procedure appropriate to the database service in your Compose stack.
- Assets: archive the persistent assets directory, including attachments and generated files.
Store copies outside the VPS and periodically test restoring them to a disposable environment. A backup that has never been restored is only an assumption. Keep the .env file, especially SECRET_KEY_BASE, in a protected secrets backup; without the same secret, restored sessions and remembered 2FA tokens will not remain valid.
Upgrade deliberately
- Read the OpenProject release notes and migration notes for the stable branch you intend to use.
- Take fresh database and asset backups.
- Record the current Compose repository branch, image versions, and environment file.
- Pull the desired stable branch or update the Compose files as documented.
- Recreate the stack with the Compose command appropriate to that release.
- Check logs, migrations, login, attachments, outbound mail, and collaborative features before declaring the upgrade complete.
Do not rotate SECRET_KEY_BASE as part of a routine upgrade. Rotate it only as a planned security action, with the understanding that every session and remembered 2FA token becomes invalid.
Monitor the host, not just the containers
Watch disk consumption from attachments and database growth, memory pressure, CPU saturation during background jobs, and Nginx certificate expiry. Set alerts before the filesystem reaches 100 percent; a full disk can stop database writes and prevent Nginx from renewing or loading certificates.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Plan VPS capacity from workload rather than a fixed recipe
The official material does not publish one universal VPS CPU/RAM/storage minimum. Estimate demand using:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall- Users and concurrency: more simultaneous sessions increase application and database memory use.
- Attachments: large files can exceed database growth and become the dominant storage cost.
- Background jobs: mail delivery, reminders, imports, and other asynchronous work need CPU and queue headroom.
- Database history: archived projects and audit data continue to consume disk even when active user counts are stable.
- Backups: reserve space for temporary dumps and retain copies off the VPS.
Start with the current OpenProject system-requirements page, choose a VPS with room for growth, and measure real usage. If the host repeatedly swaps, runs out of disk, or leaves background jobs delayed, resize before adding more projects. A single Compose host is appropriate for a smaller installation; larger installations should be evaluated for a more scalable architecture, including the Helm-based approach OpenProject recommends for larger deployments.
Package installation: when it is still reasonable
The package route remains viable only when the exact Linux distribution and version appear in the current supported package documentation. It can simplify integration with the host’s service manager, filesystem layout, and patching tools. It is a poor choice when the VPS is running a newer, unlisted release or already has software that conflicts with package-managed web services.
With a package installation, keep Nginx at the edge and proxy to the local process at 127.0.0.1:6000. The same public-hostname and forwarded-header principles apply: preserve Host, pass the client address headers, and set X-Forwarded-Proto https. Never expose the internal listener directly to the Internet.
Production checklist
- DNS resolves the public FQDN to the VPS.
- Nginx owns ports 80 and 443; the OpenProject port is private.
- The certificate covers the exact hostname and Nginx passes syntax validation.
OPENPROJECT_HOST__NAMEmatches the browser URL.SECRET_KEY_BASEis unique, protected, and stable.OPENPROJECT_HTTPS=falseis removed after the initial local check.- Nginx forwards
Host,X-Real-IP,X-Forwarded-For, andX-Forwarded-Proto https. - The persistent assets directory exists with UID 1000 ownership when using the example
OPDATAmapping. - Database and assets are backed up outside the container lifecycle, with restore tests.
- Administrator bootstrap credentials have been changed.
- CPU, memory, disk, certificate expiry, and background-job health are monitored.
The Bottom Line
For a small OpenProject deployment, run the stable Docker Compose stack on the VPS and place Nginx in front of it as the TLS terminator. Persist assets, protect a stable SECRET_KEY_BASE, forward the HTTPS and host headers, and keep the application port private. Use packages only on a supported distribution; move to a larger architecture when users, attachments, or background jobs exceed one host’s capacity.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
