Self-Hosting OpenSEO: Docker vs. Cloudflare Deployment Options Explained

OpenSEO offers two self-hosting options—Docker for local sandboxing and Cloudflare Workers for production edge deployment—differing in authentication, scalability, database architecture, and operational complexity.

Both paths let you run the full Next.js/TanStack application on your own infrastructure without relying on managed SaaS. Choosing between them depends on whether you need a private development instance or a globally available, team-ready service with automatic backups.

Docker Self-Hosting: Local Container Deployment

The Docker option packages OpenSEO into a containerized stack that's ideal for personal experimentation, development, or isolated single-user deployments.

Architecture and Runtime

In docker-entrypoint.sh, the container initializes with environment-based configuration, including telemetry controls. The full application—Next.js frontend, TanStack server functions, and SQLite database—runs inside a single container on your host machine.

Authentication Model

Docker deployments use AUTH_MODE=local_noauth as documented in web/content/docs/self-hosting/docker.md. This creates a built-in admin user (admin@localhost) with no authentication checks. You must secure the container yourself using:

• A reverse proxy (nginx, Traefik)
• A private network or VPN
• Cloudflare Tunnel or similar

Configuration and Secrets

Environment variables live in a standard .env file. Required variables include:

• DATAFORSEO_API_KEY — for SEO data access
• OPENSEO_TELEMETRY_DISABLED=1 — to disable telemetry (defaults enabled)

The docker-entrypoint.sh script at line 10 processes these settings during container startup.

Quick Start with Docker Compose

# compose.yaml

services:
  openseo:
    image: ghcr.io/every-app/open-seo:latest
    env_file: .env
    ports:
      - "3000:3000"
    restart: unless-stopped

Deploy with:

docker compose up -d

Database and Scalability

SQLite is bundled with the container—sufficient for low-traffic, single-node workloads. Scaling requires manual orchestration: multiple containers behind a load balancer with shared storage or external database migration.

Cloudflare Self-Hosting: Edge Worker Deployment

The Cloudflare option transforms OpenSEO into a distributed edge application, suitable for production use with team access and global availability.

Architecture and Runtime

OpenSEO compiles to Cloudflare Workers using Wrangler. Core logic executes at the edge across Cloudflare's global network, with static assets served from the nearest data center. This is implemented in the repository's Wrangler configuration and edge adapter code.

Authentication Model

Cloudflare Access provides authentication automatically—no additional configuration needed. Identity-based access is enforced at the network edge before requests reach your application. This eliminates the security burden that Docker places on operators.

Configuration and Secrets

Secrets are managed two ways:

• .env.selfhost file for local Wrangler development
• Cloudflare Dashboard under Settings → Variables & Secrets for production

Both telemetry disable options work:

• OPENSEO_TELEMETRY_DISABLED=1
• DO_NOT_TRACK=1

Quick Start with Wrangler

# .env.selfhost

DATAFORSEO_API_KEY=your_key_here
OPENSEO_TELEMETRY_DISABLED=1

# Deploy to edge

wrangler deploy

Database and Scalability

Cloudflare D1 (or KV) provides managed, automatically backed-up storage that persists across deployments. This architecture delivers:

• Automatic global distribution without configuration
• High availability through Cloudflare's infrastructure
• Zero-downtime deployments via atomic Worker updates

Key Differences Between OpenSEO Self-Hosting Options

Factor	Docker (Local)	Cloudflare (Edge)
Best for	Personal sandbox, development	Production, team access, public services
Setup steps	docker compose up	Wrangler install, account config, wrangler deploy
Authentication	None built-in (local_noauth)	Cloudflare Access (automatic)
Database	Container SQLite	Cloudflare D1/KV (managed, backed up)
Scaling	Manual container orchestration	Automatic edge distribution
Configuration file	.env	.env.selfhost + Cloudflare Dashboard
Telemetry control	OPENSEO_TELEMETRY_DISABLED=1	OPENSEO_TELEMETRY_DISABLED=1 or DO_NOT_TRACK=1
Documentation	docs/SELF_HOSTING_DOCKER.md	docs/SELF_HOSTING_CLOUDFLARE.md

When to Choose Each OpenSEO Self-Hosting Option

Choose Docker when:

• You want a private, offline-capable instance
• You're developing or testing features locally
• You prefer minimal infrastructure and accept responsibility for security
• You need to customize the runtime environment heavily

Choose Cloudflare when:

• Your instance must be internet-accessible from multiple locations
• You want automatic backups without operational overhead
• Team members need shared access with managed identity
• You prioritize global performance and automatic scaling

Summary

• Docker runs the complete OpenSEO stack—Next.js, TanStack, and SQLite—in a single container with no built-in authentication, best for local development referenced in web/content/docs/self-hosting/docker.md.

• Cloudflare deploys OpenSEO as edge Workers with automatic authentication, managed D1 databases, and global distribution, configured via wrangler deploy per docs/SELF_HOSTING_CLOUDFLARE.md.

• Both options support telemetry opt-out through OPENSEO_TELEMETRY_DISABLED=1, set in .env for Docker or .env.selfhost/Dashboard for Cloudflare.

• Docker requires manual security hardening; Cloudflare provides identity gating through Cloudflare Access out of the box.

Frequently Asked Questions

Can I migrate from Docker to Cloudflare later?

Yes. Both deployments use the same core application code. You'll need to export your SQLite database and import it into Cloudflare D1, then reconfigure environment variables in the Cloudflare Dashboard. The data schema is compatible.

Is authentication mandatory for the Docker option?

No—Docker uses AUTH_MODE=local_noauth by default, creating an automatic admin user. This is convenient for local testing but requires you to implement external protection for any exposed deployment. The Docker documentation explicitly warns about this in web/content/docs/self-hosting/docker.md.

Does Cloudflare self-hosting cost money?

Cloudflare Workers, D1, and Access have generous free tiers. Small-team deployments typically run within free limits. Higher-traffic or multi-user instances may incur charges based on request volume, database operations, and seat licenses for Cloudflare Access.

Which option has better performance?

Cloudflare delivers lower latency for globally distributed users through edge execution. Docker performs well for single-region access on capable hardware but requires manual scaling and geographic distribution to match Cloudflare's network coverage.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}