> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bugspray.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Self-host the Node server

> Configure HTTPS, access control and private persistent storage.

Use an authorized checkout and the [documented Node/pnpm versions](https://docs.bugspray.io/quickstart.md). The supported path here is an operator-managed Node process behind your HTTPS proxy. Container packaging has a known prerequisite described below.

## Build the application

```sh theme={null}
pnpm install --frozen-lockfile
pnpm build
```

Build before production startup. Supply configuration through your shell or secret manager: Node startup does not automatically load `.env` files.

## Configure the production process

Set these deployment-owned values. The origin and directory below are synthetic examples; replace them with resources you control. Inject fresh secrets rather than putting their literal values into a script or shell history.

```sh theme={null}
export NODE_ENV=production
export HOST=127.0.0.1
export PORT=3737
export QA_SUITE_PUBLIC_URL=https://bugspray.example.com
export QA_SUITE_DATA_DIR=/absolute/private/bugspray-data
export BUGSPRAY_ENABLE_REPRO_EXECUTION=0
# Inject BUGSPRAY_ADMIN_PASSWORD and QA_SUITE_TOKEN from secret storage.
pnpm start
```

`BUGSPRAY_ADMIN_PASSWORD` must be at least 12 characters and `QA_SUITE_TOKEN` at least 32. Production requires an explicit HTTPS public origin and access control. Keep the data directory private and writable by the app's operating-system user. Configure your service manager to use the checkout as its working directory and restart the process deliberately.

## Put HTTPS in front

Configure an operator-owned reverse proxy for the exact public origin, forwarding to the loopback listener. Preserve the intended Host/origin relationship and support streaming MCP responses and uploads. Test unauthenticated UI access, successful sign-in, authorized API calls and rejected wrong-origin mutations. Do not disable Host/origin validation to make a proxy work.

The bootstrap REST token is for internal/legacy bridging. Administrator mutations require a signed-in UI session. Hosted OAuth/service-token semantics should not be assumed for an ordinary Node installation.

## Add only required capabilities

Leave provider variables unset until you deliberately configure [integrations](https://docs.bugspray.io/guides/integrations.md). Install Chromium and recording dependencies before browser use. Enable repro execution only after accepting the [trust model](https://github.com/SynclyUS/bugspray/blob/main/docs/trust-model.md).

## Compose is not ready as a copy-and-run path

The current Dockerfile dependency-install layer omits required `vendor/*.tgz` inputs. Fix and validate that packaging before building an image. Then use the existing `.env.production.example`, a private populated environment file and the repository's Compose definition behind your HTTPS proxy. Preserve its data volume; `down -v` destroys persistent data and is not an upgrade procedure.

Read the [existing deployment runbook](https://github.com/SynclyUS/bugspray/blob/main/docs/deployment.md) for container commands once that prerequisite is resolved. This guide does not certify a Linux container build or publish an image.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.