Advanced Deployment

Production deployment configs for reverse proxies, TLS, Kubernetes, and backups.

Running LinkBreeze in production? The examples/ directory in the repo ships battle-tested reference configs for the most common scenarios.

Which example do I need?

What you wantUse this
Automatic TLS, minimal configdocker-compose.caddy.yml
Automatic TLS with a dashboarddocker-compose.traefik.yml
Expose without opening portsdocker-compose.cloudflare-tunnel.yml
You already use Nginx + Certbotdocker-compose.nginx.yml
One-line TLS via sidecardocker-compose.https-portal.yml
Scheduled SQLite backupsdocker-compose.with-backup.yml
Running on Kuberneteskubernetes.yaml

Each file is self-contained with a header comment explaining required env vars and ports.

How to use them

git clone https://github.com/Manak-hash/LinkBreeze.git
cd LinkBreeze/examples

# Copy the config you need
cp docker-compose.caddy.yml ../docker-compose.override.yml
cd ..

# Edit the domain and env vars
nano docker-compose.override.yml

# Start
docker compose up -d

The root docker-compose.yml stays untouched for easy updates.

Reverse proxy specifics

For inline snippets (Caddyfile, Nginx config, Traefik labels, Cloudflare Tunnel command), see the Reverse Proxy page. The examples above package those snippets into complete, ready-to-run compose files that include LinkBreeze and the proxy together.

Kubernetes

For a full Deployment + Service + Ingress manifest, see Kubernetes.

Backups

For automated SQLite backup with retention and optional S3 sync, see Backups.

Common patterns

All examples share these conventions:

  • Named volume (linkbreeze-data) at /app/data for the SQLite database and uploads
  • Restart policy unless-stopped on every container
  • Health checks where applicable (HTTP GET to /api/health)
  • Secret management — examples show inline env vars for clarity, but in production use Docker secrets or an external vault

Security checklist

Before going live:

  1. Set SECRET_KEY to a strong random value (openssl rand -hex 32)
  2. Always terminate TLS — never expose port 80 directly
  3. Schedule backups if your data matters
  4. Monitor the releases page and update regularly