Production Setup: Reverse Proxy, HTTPS and LAN
Run imgcompress for the long term: ready-made compose files for your home network and for HTTPS behind Traefik, with safe defaults and log rotation.
DockerSecurity
Run imgcompress for the long term: ready-made compose files for your home network and for HTTPS behind Traefik, with safe defaults and log rotation.
The quick install is kept short on purpose. For a setup that runs for months, use one of the ready-made compose files. They add log rotation, health checks, safe shutdown and, for HTTPS, a reverse proxy.
Level: Advanced self-hosters
| File | Use it for | What it adds |
|---|---|---|
advanced.docker-compose.yaml | Home network | Safe defaults. Reachable from every device at home. |
proxied.docker-compose.yaml | Your own domain with HTTPS | Traefik reverse proxy, free Let's Encrypt certificate, security headers, upload size cap. |
homelab-traefik-ntfy/ | Home lab (Traefik + ntfy) | A great starting point for self-hosters: Traefik, ImgCompress and your own ntfy with .lan names (on release/v1.0.0). Swap NOTIFY_URL for any Apprise service. See Notify me when done. |
The home-lab folder is one approach I find simple — not perfect, but it works for me. Create imgcompress.lan, ntfy.lan and traefik.lan in your router's DNS pointing at the Docker host. The compose files are just for getting started: keep the layout, swap NOTIFY_URL for any Apprise service you like. Details: Notify me when done.
Full examples: docker/compose · compose README · .env.example. Settings live in one .env next to the file.
cp .env.example .env. The defaults work.docker compose -f advanced.docker-compose.yaml up -d.http://<your-machine-ip>:3001 from any device at home.The app has no login, so everyone on your network can use it. To allow only the machine itself, set IMGCOMPRESS_HOST=127.0.0.1 in .env.
I recommend this for anything beyond a quick test. proxied.docker-compose.yaml puts imgcompress behind Traefik.
Point a DNS record for your domain (like imgcompress.example.com) at the machine.
Create the Traefik dashboard login: htpasswd -nB admin.
Set three values in .env:
bashTRAEFIK_DOMAIN_NAME=imgcompress.example.com ACME_EMAIL=you@example.com TRAEFIK_AUTH_USERS=admin:$2y$10$... # output of step 2
Start it: docker compose -f proxied.docker-compose.yaml up -d.
Open https://your-domain. The certificate is issued on the first visit and takes a few seconds.
Good to know:
traefik-auth login to the app router (see the comments in the file).MAX_UPLOAD_SIZE_MB at or below that, or raise the limit in the file.PUBLIC_BASE_URL=https://your-domain.By default Let's Encrypt has to reach your domain on port 443 from the Internet. For a LAN-only setup with a real domain, switch to a DNS challenge. Names like imgcompress.lan can't get a public certificate: use your own CA, and add the name to your local DNS. Away from home, use a VPN like WireGuard or Tailscale.
imgcompress works fully without Internet, the AI features too. You can cut the container off completely. What still goes online, and how to stop it, is listed in Privacy & Safety.