Self-Hosting Intlayer

Intlayer can run entirely on your own infrastructure. No Intlayer Cloud account required. A single command boots a production-ready stack:

One command installs everything:

curl -fsSL https://intlayer.org/install.sh | sh

The installer downloads a docker-compose.yml and a .env, auto-generates the required secrets, and starts all containers with docker compose up -d.

The only external dependency is MongoDB: the backend connects to a MongoDB Atlas cluster, which you provide. Everything else runs inside the container.

Table of Contents

Architecture

                ┌─────────────────────────────┐
 browser ──────▶ │  app  (TanStack Start)  :3000│ ──┐
                └─────────────────────────────┘   │ VITE_BACKEND_URL
                ┌─────────────────────────────┐   │
                │  backend (Fastify/Bun)  :3100│ ◀─┘
                └──────────────┬──────────────┘
          ┌──────────┬─────────┼──────────┬───────────┐
          ▼          ▼         ▼          ▼           ▼
     mongo:27017  redis:6379  minio:9000  mailpit:1025  Chromium
     (1-node RS)             (S3 API)     (SMTP)        (in-image)
                             minio:9001   mailpit:8025
                             (console)    (web UI)

Chromium (used for Puppeteer screenshot generation) is bundled inside the backend image. No separate container is needed.

Prerequisites

• Docker ≥ 24 and Docker Compose ≥ v2. If either is missing, the installer prints the install link and exits.
• Ports 3000, 3100, 8025, 9000, and 9001 available on the host.
• A Linux or macOS host (or WSL2 on Windows).

Everything else — Bun, Redis, MinIO, Chromium — ships inside the image.

Quick start

1. Run the installer

curl -fsSL https://intlayer.org/install.sh | sh

It verifies Docker is installed and running, writes ./intlayer.env with BETTER_AUTH_SECRET and S3_SECRET_ACCESS_KEY already generated, and pulls the image. It does not start the container — the backend cannot boot without your database credentials.

Re-running the installer is safe: an existing intlayer.env is never overwritten, so it doubles as the upgrade path.

2. Fill in your credentials

Open intlayer.env and complete the values marked TODO:

DB_ID=<atlas-user>
DB_MDP=<atlas-password>
DB_CLUSTER=<cluster>.xxxxx.mongodb.net
RESEND_API_KEY=<your-resend-key>

The file also carries commented-out blocks for the optional features — SMTP mailer, OPENAI_API_KEY, and the OAuth providers. Uncomment what you need.

The file is read by docker run --env-file, which does not strip quotes and treats everything after = as the value. Write bare values, and keep comments on their own lines.

3. Start the container

This is the command the installer prints when it finishes:

docker run -d --name intlayer \
  --restart unless-stopped \
  -p 3000:3000 \
  -p 3100:3100 \
  -p 9000:9000 \
  -p 9001:9001 \
  -v intlayer-data:/data \
  --env-file ./intlayer.env \
  ghcr.io/aymericzip/intlayer-selfhost:latest

Then open http://localhost:3000. First boot initialises the datastores, so give it a minute.

The dashboard is served on localhost. See Limitations — custom domains are not supported by the published image.

Installer settings

The installer reads a few environment variables. Because it is piped into sh, pass them to the shell rather than to curl:

curl -fsSL https://intlayer.org/install.sh | INTLAYER_ENV_FILE=./config/intlayer.env sh

The four port variables only change the host side of the mapping printed in the docker run command. The published image has http://localhost:3000, http://localhost:3100 and http://localhost:9000 compiled into the dashboard bundle at build time, so remapping them leaves the browser pointing at the old ports. Keep the defaults unless you are building your own image — see Limitations.

Quick start

What the installer does:

1. Checks that docker and docker compose are present.
2. Downloads docker-compose.yml and .env.example into ./intlayer/.
3. If no .env exists, copies the example and generates random secrets for BETTER_AUTH_SECRET, S3_ACCESS_KEY_ID, and S3_SECRET_ACCESS_KEY via openssl rand.
4. Runs docker compose pull + docker compose up -d.
5. Prints the URLs: dashboard :3000, API :3100, email UI :8025, MinIO console :9001.

After the stack is up, open http://localhost:3000 and create your first account.

Services

MinIO port 9000 must be reachable by the browser because uploaded assets (avatars, screenshots) are loaded directly from S3_PUBLIC_URL=http://localhost:9000/intlayer.

Environment variables

Required

Required (auto-generated or prompted)

Optional (features degrade gracefully when absent)

Global mailer

By default, all transactional emails are sent through Resend using RESEND_API_KEY. Self-hosted deployments can instead route every email — including non-organisation emails such as password resets and magic links — through a global mailer configured with environment variables.

Set MAIL_PROVIDER to activate it. When unset, the default Resend mailer is used.

Precedence: an organisation's own mailer (configured from the Organisation dashboard) takes priority over the global mailer, which in turn takes priority over the default Resend key.

Connecting your Intlayer project

Once the stack is running, point your project at the self-hosted backend and dashboard instead of intlayer.org.

Project configuration

import type { IntlayerConfig } from "intlayer";

const config: IntlayerConfig = {
  editor: {
    clientId: process.env.INTLAYER_CLIENT_ID,
    clientSecret: process.env.INTLAYER_CLIENT_SECRET,

    /**
     * URL of the self-hosted CMS dashboard.
     * Default: https://app.intlayer.org
     */
    cmsURL: process.env.INTLAYER_CMS_URL, // e.g. http://localhost:3000

    /**
     * URL of the self-hosted backend API.
     * Default: https://back.intlayer.org
     */
    backendURL: process.env.INTLAYER_BACKEND_URL, // e.g. http://localhost:3100
  },
};

export default config;

Set the environment variables in your project's .env:

INTLAYER_CMS_URL=http://localhost:3000
INTLAYER_BACKEND_URL=http://localhost:3100
INTLAYER_CLIENT_ID=<your-client-id>
INTLAYER_CLIENT_SECRET=<your-client-secret>

Create access credentials in your self-hosted dashboard under Projects → Access keys at http://localhost:3000/projects.

@intlayer/api SDK

When using the @intlayer/api SDK programmatically, pass backendURL explicitly:

import { createIntlayerCMS } from "@intlayer/api";
import { dictionaryEndpoint } from "@intlayer/api/dictionary";

const cms = createIntlayerCMS({
  editor: {
    clientId: process.env.INTLAYER_CLIENT_ID,
    clientSecret: process.env.INTLAYER_CLIENT_SECRET,
    backendURL: process.env.INTLAYER_BACKEND_URL, // http://localhost:3100
  },
});

const { data: dictionaries } = await dictionaryEndpoint(cms).getDictionaries();

Upgrading

This pulls the latest images and restarts containers with docker compose pull && docker compose up -d. Existing volumes (mongo-data, redis-data, minio-data) are preserved — no data loss.

docker compose pull
docker compose up -d

Backup and restore

All persistent data lives in three named Docker volumes.

Backup

docker run --rm \
  -v intlayer_mongo-data:/data \
  -v "$(pwd)":/backup \
  busybox tar czf /backup/mongo-data.tar.gz /data

docker run --rm \
  -v intlayer_redis-data:/data \
  -v "$(pwd)":/backup \
  busybox tar czf /backup/redis-data.tar.gz /data

docker run --rm \
  -v intlayer_minio-data:/data \
  -v "$(pwd)":/backup \
  busybox tar czf /backup/minio-data.tar.gz /data

Restore

docker run --rm \
  -v intlayer_mongo-data:/data \
  -v "$(pwd)":/backup \
  busybox tar xzf /backup/mongo-data.tar.gz -C /

# Repeat for redis-data and minio-data

Limitations

• MongoDB must be external (Atlas). The backend connects only over mongodb+srv:// (built from DB_ID / DB_MDP / DB_CLUSTER), so a plain mongodb://host:27017 — including the container's own bundled mongod — cannot be used. Provide a MongoDB Atlas cluster.
• No custom domain. All browser-facing VITE_* URLs are inlined into the app at build time, and the published image ships with localhost values. The dashboard must be accessed at http://localhost:3000; serving it on a public domain would require rebuilding the image with the target URLs baked in and is not supported out of the box.
• Email requires a working mailer. First-run setup enforces email verification, so either RESEND_API_KEY or a global SMTP mailer (MAIL_PROVIDER=smtp + MAIL_SMTP_*) must be configured. After the first admin signs in, each organisation can also configure its own SMTP or Resend mailer from the dashboard.

Troubleshooting

Backend crash-loops on first start

MongoDB and Redis must be healthy before the backend starts. The compose file uses depends_on with condition: service_healthy. If you see repeated backend restarts, check that the mongo and redis healthchecks pass:

docker compose ps
docker compose logs mongo
docker compose logs redis

Look for MongoDB connection error near the top of the log.

Dashboard cannot reach the API

Verify that VITE_BACKEND_URL matches the URL where the backend is reachable from the browser (not the Docker network). If you changed the backend port or added a reverse proxy, rebuild the dashboard image:

MinIO bucket missing

If the minio-init one-shot service didn't run (or ran before MinIO was ready), create the bucket manually:

docker compose run --rm minio-init

Useful links

• Intlayer CMS documentation
• Configuration reference
• CMS SDK — @intlayer/api
• Docker Image (aymercizip/intlayer-selfhost)