Self-Hosting Intlayer

Intlayer can run on your own infrastructure, no Intlayer Cloud account required. Three setups are available, all driven by the same installer (install.sh, install.ps1 on Windows, or npx intlayer init infra):

Table of Contents

Published images and packages

All three images are built from the same docker/selfhost/Dockerfile and published on every release. The Compose stack also pulls the official mongo:8, redis:8-alpine and quay.io/minio/minio images.

Setup

The installer asks which setup you want, checks the prerequisites (offering to install Docker), writes the environment file with the secrets already generated, and pulls the images. It never starts anything on its own: the Docker modes need a mailer first, so it ends by printing the command to run. Re-running it is safe: an existing environment file is never overwritten, which makes it the upgrade path too.

curl -fsSL https://intlayer.org/install.sh | sh -s -- --mode desktop

$env:INTLAYER_MODE = "desktop"; irm https://intlayer.org/install.ps1 | iex

npx intlayer init infra --mode desktop

                ┌─────────────────────────────┐
 browser ──────▶ │  app  (TanStack Start)  :3000│ ──┐
 (localhost)    └─────────────────────────────┘   │ VITE_BACKEND_URL (baked at build)
                ┌─────────────────────────────┐   │
                │  backend (Fastify/Bun)  :3100│ ◀─┘
                └──────────────┬──────────────┘
          ┌──────────┬─────────┼──────────────┐
          ▼          ▼         ▼               ▼
      mongo:27017  redis:6379  minio:9000   Chromium
      /data/mongo  /data/redis /data/minio  (in-image)
      (1-node RS)              minio:9001

curl -fsSL https://intlayer.org/install.sh | sh -s -- --mode docker

$env:INTLAYER_MODE = "docker"; irm https://intlayer.org/install.ps1 | iex

npx intlayer init infra --mode docker

# Option A: Resend
RESEND_API_KEY=<your-resend-key>

# Option B: SMTP (takes over from Resend as soon as MAIL_SMTP_HOST is set)
MAIL_SMTP_HOST=smtp.example.com
MAIL_SMTP_PORT=587
MAIL_SMTP_USER=<user>
MAIL_SMTP_PASSWORD=<password>
MAIL_FROM=Intlayer <no-reply@example.com>

docker run -d --name intlayer \
  --restart unless-stopped \
  -p 3000:3000 -p 3100:3100 -p 9000:9000 -p 9001:9001 \
  -v intlayer-data:/data \
  --env-file ./intlayer.env \
  intlayer/cms-all:latest

docker run -d --name intlayer `
  --restart unless-stopped `
  -p 3000:3000 -p 3100:3100 -p 9000:9000 -p 9001:9001 `
  -v intlayer-data:/data `
  --env-file ./intlayer.env `
  intlayer/cms-all:latest

# Backup (stop the container first so MongoDB's files are consistent)
docker stop intlayer
docker run --rm -v intlayer-data:/data -v "$(pwd)":/backup busybox tar czf /backup/intlayer-data.tar.gz /data
docker start intlayer

# Restore
docker run --rm -v intlayer-data:/data -v "$(pwd)":/backup busybox tar xzf /backup/intlayer-data.tar.gz -C /

                ┌───────────────────┐
 browser ──────▶ │  app        :3000 │ ── SSR ──▶ http://backend:3100
 (localhost)    └───────────────────┘
                ┌───────────────────┐
 browser ──────▶ │  backend    :3100 │
 (localhost)    └─────────┬─────────┘
          ┌───────────────┼───────────────┐
          ▼               ▼               ▼
     mongo:27017     redis:6379      minio:9000 ◀── browser (assets)
     (1-node RS)                     minio:9001

curl -fsSL https://intlayer.org/install.sh | sh -s -- --mode compose

mkdir intlayer && cd intlayer
curl -fsSLO https://raw.githubusercontent.com/aymericzip/intlayer/main/docker/selfhost/docker-compose.yml
curl -fsSL  https://raw.githubusercontent.com/aymericzip/intlayer/main/docker/selfhost/.env.template -o .env
# fill in BETTER_AUTH_SECRET and S3_SECRET_ACCESS_KEY (openssl rand -hex 32)

$env:INTLAYER_MODE = "compose"; irm https://intlayer.org/install.ps1 | iex

mkdir intlayer; cd intlayer
irm https://raw.githubusercontent.com/aymericzip/intlayer/main/docker/selfhost/docker-compose.yml -OutFile docker-compose.yml
irm https://raw.githubusercontent.com/aymericzip/intlayer/main/docker/selfhost/.env.template -OutFile .env
# fill in BETTER_AUTH_SECRET and S3_SECRET_ACCESS_KEY

npx intlayer init infra --mode compose

cd intlayer && docker compose up -d

services:
  backend:
    environment:
      MONGODB_URI: mongodb+srv://user:password@cluster0.xxxxx.mongodb.net/intlayer
      REDIS_URL: rediss://default:password@redis.example.com:6380
      S3_ENDPOINT: https://s3.eu-west-1.amazonaws.com
      S3_PUBLIC_URL: https://intlayer-assets.s3.eu-west-1.amazonaws.com

cd docker/selfhost
docker compose -f docker-compose.yml -f docker-compose.build.yml up -d --build

# Backup one volume (repeat for intlayer_redis-data and intlayer_minio-data)
docker compose stop
docker run --rm -v intlayer_mongo-data:/data -v "$(pwd)":/backup busybox tar czf /backup/mongo-data.tar.gz /data
docker compose start

# Upgrade, volumes are kept
docker compose pull && docker compose up -d

Installer settings

Without --mode (or INTLAYER_MODE), the installer shows a menu: desktop, docker (all-in-one) or compose. It also reads a few environment variables. Because it is piped into the shell, pass them to the shell rather than to curl:

curl -fsSL https://intlayer.org/install.sh | INTLAYER_COMPOSE_DIR=./cms sh -s -- --mode compose

$env:INTLAYER_MODE = "compose"; $env:INTLAYER_COMPOSE_DIR = ".\cms"; irm https://intlayer.org/install.ps1 | iex

The port variables only change the host side of the mapping. The published images have http://localhost:3000, http://localhost:3100 and http://localhost:9000 compiled into the dashboard bundle, so remapping them leaves the browser pointing at the old ports. Keep the defaults unless you build your own images, see Limitations.

First-run setup

On a fresh instance (empty database), opening the dashboard redirects you to the /init page:

1. Create the first account. Because the users collection is empty, this account is automatically promoted to super admin.
2. A verification email is sent through Resend or your SMTP relay. Email verification is mandatory, this is why a mailer must be configured before you start.
3. Click the link in the email, then sign in.

Once an admin exists, /init redirects to the standard sign-in page.

Environment variables

Both Docker modes read the same file (intlayer.env for the container, .env for Compose), generated from docker/selfhost/.env.template.

Required

Fixed by the deployment

These are set by the image (all-in-one) or by the compose file, and only need overriding for a non-standard topology. DOMAIN, APP_URL, BACKEND_URL and S3_PUBLIC_URL are the exception: set in the env file, they take precedence in both modes (see Custom domain).

The Compose app service additionally receives INTLAYER_BACKEND_INTERNAL_URL=http://backend:3100: the browser reaches the API on localhost:3100, but server-side rendering runs inside the Compose network and must use the service name.

Custom domain

The backend reads its public URLs at runtime, but the dashboard has them compiled in: the published intlayer/cms-frontend and intlayer/cms-all images only work on http://localhost:3000. Serving Intlayer on your own domain therefore takes two things, both prepared by the installer when you answer the domain question:

1. Four variables in the env file, read by the backend (cookies, email links, OAuth callbacks, asset URLs) and used as build args by docker-compose.build.yml:

   intlayer.env

   Copy content

   Copy code

   Copy the code to the clipboard

   DOMAIN=example.org                          # cookie domain, parent of the hosts below
   APP_URL=https://cms.example.org
   BACKEND_URL=https://back.example.org
   S3_PUBLIC_URL=https://s3.example.org/intlayer
   

2. A dashboard image built with those URLs. Docker builds it straight from the repository, no checkout needed:

   sh

   Copy content

   Copy code

   Copy the code to the clipboard

   # Docker Compose: the override reads the build args from .env
   docker compose -f docker-compose.yml -f docker-compose.build.yml up -d --build
   
   # All-in-one
   docker build -f docker/selfhost/Dockerfile \
     --build-arg VITE_DOMAIN=example.org \
     --build-arg VITE_SITE_URL=https://cms.example.org \
     --build-arg VITE_IDE_URL=https://cms.example.org \
     --build-arg VITE_BACKEND_URL=https://back.example.org \
     -t intlayer/cms-all:custom \
     https://github.com/aymericzip/intlayer.git#main
   

Then put a reverse proxy with TLS in front of the container: cms.example.org → port 3000, back.example.org → 3100, s3.example.org → 9000. The three hosts must share the DOMAIN suffix, since the session cookie is scoped to it.

Optional (features degrade gracefully when absent)

Global mailer

Every transactional email, including non-organization emails such as password resets and magic links, goes through one of two global transports:

• Resend, using RESEND_API_KEY.
• SMTP, using the MAIL_SMTP_* variables. As soon as MAIL_SMTP_HOST is set, SMTP is used and RESEND_API_KEY is ignored.

MAIL_PROVIDER is only needed to force one transport when both are configured (for instance MAIL_PROVIDER=resend to keep Resend while an SMTP host is present).

Precedence: an organization's own mailer (configured from the Organization dashboard) takes priority over the global mailer, which in turn takes priority over the default Resend key.

Connecting your Intlayer project

Once the stack is running, point your project at the self-hosted backend and dashboard instead of intlayer.org.

Project configuration

import type { IntlayerConfig } from "intlayer";

const config: IntlayerConfig = {
  editor: {
    clientId: process.env.INTLAYER_CLIENT_ID,
    clientSecret: process.env.INTLAYER_CLIENT_SECRET,

    /**
     * URL of the self-hosted CMS dashboard.
     * Default: https://app.intlayer.org
     */
    cmsURL: process.env.INTLAYER_CMS_URL, // e.g. http://localhost:3000

    /**
     * URL of the self-hosted backend API.
     * Default: https://back.intlayer.org
     */
    backendURL: process.env.INTLAYER_BACKEND_URL, // e.g. http://localhost:3100
  },
};

export default config;

Set the environment variables in your project's .env:

INTLAYER_CMS_URL=http://localhost:3000
INTLAYER_BACKEND_URL=http://localhost:3100
INTLAYER_CLIENT_ID=<your-client-id>
INTLAYER_CLIENT_SECRET=<your-client-secret>

Create access credentials in your self-hosted dashboard under Projects → Access keys at http://localhost:3000/projects.

@intlayer/api SDK

When using the @intlayer/api SDK programmatically, pass backendURL explicitly:

import { createIntlayerCMS } from "@intlayer/api";
import { dictionaryEndpoint } from "@intlayer/api/dictionary";

const cms = createIntlayerCMS({
  editor: {
    clientId: process.env.INTLAYER_CLIENT_ID,
    clientSecret: process.env.INTLAYER_CLIENT_SECRET,
    backendURL: process.env.INTLAYER_BACKEND_URL, // http://localhost:3100
  },
});

const { data: dictionaries } = await dictionaryEndpoint(cms).getDictionaries();

Limitations

• A custom domain means a rebuild. All browser-facing VITE_* URLs are inlined into the dashboard at build time, and the published images (and the desktop app) ship with localhost / Intlayer Cloud values. Out of the box the dashboard must be accessed at http://localhost:3000, the API at :3100 and MinIO at :9000; remapping the host ports has the same effect. The installer wires everything for a rebuild from the repository when you give it a domain (see Custom domain), but the build itself takes several minutes. Pointing the desktop app at a self-hosted backend is not supported.
• Email requires a working mailer. First-run setup enforces email verification, so either RESEND_API_KEY or an SMTP relay (MAIL_SMTP_*) must be configured. After the first admin signs in, each organization can also configure its own SMTP or Resend mailer from the dashboard.
• The desktop app needs Node.js on the machine to start its embedded server.
• No documentation assistant. The AI doc assistant of intlayer.org (/api/ai/ask, /api/search/doc) relies on ~130 MB of pre-computed documentation embeddings that the self-host images do not ship; those two routes are not registered in self-hosted mode. The dashboard's own AI features (translation, audit, autocomplete, chat) are unaffected and only need OPENAI_API_KEY.

Useful links

• Intlayer CMS documentation
• Configuration reference
• CMS SDK: @intlayer/api
• Desktop app releases
• Docker Hub: intlayer/cms-all, intlayer/cms-frontend, intlayer/cms-backend, mirrored on GHCR under ghcr.io/aymericzip/intlayer/
• docker/selfhost/: Dockerfile, docker-compose.yml and .env.template