Docs · DialCatz

Install DialCatz Den

Run your team's own DialCatz server — on Dokploy from Git, with Docker Compose, or with one docker run.

DialCatz Den is the self-hosted team server for DialCatz. Each team runs its own: it keeps the team’s shared collections and environments and knows who is who. It is one small container — a Go binary with the admin panel inside, SQLite by default or PostgreSQL, about 30 MB, distroless and non-root. The source is at github.com/catzoidhub/DialCatz-Den.

How it works, in short:

  • No accounts for members. The admin creates members and sends each of their devices a one-time invite link. Opening it in DialCatz trades the code for that device’s own token, kept in the system’s secret store. Revoke a device and only that device is locked out.
  • Secrets stay local. Environments sync variable names only; every member fills in the values on their own computer.
  • Live. A teammate’s change shows up within a second, with who is looking at which request.

What you need

  • A server with Docker (or a Dokploy instance).
  • A domain name for the Den, for example dialcatz.your-domain.com, with HTTPS. DialCatz refuses plain http:// except for local addresses, and passkeys need a real domain.

The repository builds itself — no registry needed.

  1. Dokploy → your project → Create Service → Compose.
  2. Provider Git (or GitHub): https://github.com/catzoidhub/DialCatz-Den.git, branch main, compose path ./docker-compose.yml (SQLite) — or ./docker-compose.postgres.yml (with its own PostgreSQL).
  3. Environment: DIALCATZ_PUBLIC_URL=https://dialcatz.your-domain.com (and POSTGRES_PASSWORD for the PostgreSQL file).
  4. Domains: host dialcatz.your-domain.com, service dialcatz, container port 8080, HTTPS on (Let’s Encrypt). Behind Cloudflare, use SSL Full (strict).
  5. Deploy, then open the domain: the first visit creates the admin account — do it right away.

Dokploy’s other way, Application → Git → Build type Dockerfile, works too: the same repository, the Dockerfile at the root, port 8080, and a volume mounted at /data.

Docker Compose, anywhere

git clone https://github.com/catzoidhub/DialCatz-Den.git && cd DialCatz-Den
cp .env.example .env    # set DIALCATZ_PUBLIC_URL
docker compose -f docker-compose.yml -f docker-compose.local.yml up -d --build

Put a reverse proxy with HTTPS (Caddy, Traefik, nginx) in front of port 8080.

One docker run

docker run -d --name dialcatz-den -p 8080:8080 -v dialcatz:/data \
  -e DIALCATZ_PUBLIC_URL=https://dialcatz.your-domain.com \
  ghcr.io/catzoidhub/dialcatz-den

The ready image is published for every release tag (amd64 and arm64).

Configuration

Variable Default
DIALCATZ_PUBLIC_URL http://localhost:8080 The address members use; it goes into invite links. https:// turns on secure cookies.
DATABASE_URL SQLite at /data/dialcatz.db Or postgres://user:pass@host:5432/db for PostgreSQL.
DIALCATZ_SECRET_KEY generated into /data/secret.key Encrypts the admins’ two-step secrets. Keep it: changing it means setting up two-step sign-in again.
DIALCATZ_DATA_DIR /data The SQLite file and the generated key. Keep it on a volume.
DIALCATZ_ADDR :8080 Listen address inside the container.
DIALCATZ_GOOGLE_CLIENT_ID / _SECRET Optional “Sign in with Google” for admins.
DIALCATZ_GITHUB_CLIENT_ID / _SECRET Optional “Sign in with GitHub” for admins.

Admins and sign-in

  • The first admin is created on the first visit. More admins: Admins → Invite an admin makes a one-time link, valid 48 hours; the person chooses their own password. The last admin can never be removed.
  • Two-step sign-in: Your account → Two-step sign-in — any authenticator app, plus ten one-time recovery codes.
  • Passkeys: Your account → Passkeys → Add a passkey — Touch ID, Face ID, Windows Hello, a phone or a security key. They are bound to the Den’s domain; after moving the server to another domain, add them again.
  • Google / GitHub (optional, your own OAuth app): signs in only an admin who already exists with the same verified email; it never creates admins. Redirect URLs:
    • Google: https://dialcatz.your-domain.com/api/admin/oauth/google/callback
    • GitHub: https://dialcatz.your-domain.com/api/admin/oauth/github/callback

Add your team

  1. In the admin panel, create a member for each person (name, email, role).
  2. For each of their devices, make an invite link (choose which workspaces it may see) and send it to them.
  3. They open it on that device: DialCatz asks them to confirm the server’s address, then connects. No password.

Lost a laptop? Revoke that device’s token in the panel; the person’s other devices keep working.

Updating

On Dokploy, press Deploy again (or turn on Auto Deploy so every push to the branch redeploys). Migrations run at start and your data stays in the dialcatz-data volume. Pin a release by deploying a tag (v0.2.0) instead of main.

Backups

  • SQLite: back up the dialcatz-data volume (/data/dialcatz.db, and secret.key with it).
  • PostgreSQL: back up the database, or use a Dokploy PostgreSQL database with its S3 backups and point DATABASE_URL at it.

Troubleshooting

  • Live updates stop or lag behind a proxy: the event stream is a long-lived text/event-stream response; the Den sends X-Accel-Buffering: no and a ping every 25 s, which Traefik, Caddy and nginx handle. Make sure your proxy does not buffer it, and run one instance — live state is held in memory.
  • “Not a DialCatz invite link”: the link must start with dialcatz://connect?server=…&code=…. Each link works once and expires; make a new one.
  • Passkey sign-in fails after a move: passkeys belong to the old domain; sign in with the password and add them again.
  • Health check: GET /api/health answers when the Den is up.

Last updated 2026-10-25

← PreviousUninstallNext →Privacy policy