How to Deploy Plane on a VPS

#Install Plane (Community Edition)

Create a working directory and download the official setup script. Upstream's instructions use the latest release asset; this guide pins v1.4.2, the release the catalog was verified with. The script's default stable channel looks the latest version up through the GitHub API, and that lookup broke against GitHub's current compact JSON output, so the pin also avoids that:

copymkdir -p ~/plane-selfhost && cd ~/plane-selfhost
curl -fsSL -o setup.sh https://github.com/makeplane/plane/releases/download/v1.4.2/setup.sh
chmod +x setup.sh
sed -i 's/^export APP_RELEASE=stable$/export APP_RELEASE=v1.4.2/' setup.sh

Run the install action. It creates plane-app/ with the release's docker-compose.yaml and a plane.env file of settings, and checks that the images exist for your CPU architecture:

copycd ~/plane-selfhost
[ -f plane-app/plane.env ] || ./setup.sh install
ls plane-app

#Configure plane.env

Before the first start, change four groups of settings in plane-app/plane.env:

• Ports: move the bundled proxy off 80/443 (LISTEN_HTTP_PORT, LISTEN_HTTPS_PORT) so Caddy can own them.
• URLs: WEB_URL and CORS_ALLOWED_ORIGINS must be your public HTTPS URL. Plane builds redirects, emails and API responses from WEB_URL.
• Secrets: SECRET_KEY and LIVE_SERVER_SECRET_KEY ship as change-this-key-on-deployment. Replace them.
• MinIO: AWS_SECRET_ACCESS_KEY is also the MinIO root password, and it ships as secret-key.

copycd ~/plane-selfhost/plane-app
sed -i \
  -e 's|^LISTEN_HTTP_PORT=.*|LISTEN_HTTP_PORT=8080|' \
  -e 's|^LISTEN_HTTPS_PORT=.*|LISTEN_HTTPS_PORT=8443|' \
  -e 's|^APP_DOMAIN=.*|APP_DOMAIN=plane.example.com|' \
  -e 's|^WEB_URL=.*|WEB_URL=https://plane.example.com|' \
  -e 's|^CORS_ALLOWED_ORIGINS=.*|CORS_ALLOWED_ORIGINS=https://plane.example.com|' \
  plane.env
if grep -q '^SECRET_KEY=change-this-key-on-deployment' plane.env; then
  sed -i \
    -e "s|^SECRET_KEY=.*|SECRET_KEY=$(openssl rand -hex 32)|" \
    -e "s|^LIVE_SERVER_SECRET_KEY=.*|LIVE_SERVER_SECRET_KEY=$(openssl rand -hex 32)|" \
    -e "s|^AWS_SECRET_ACCESS_KEY=.*|AWS_SECRET_ACCESS_KEY=$(openssl rand -hex 24)|" \
    plane.env
fi
chmod 600 plane.env
grep -E '^(LISTEN_HTTP_PORT|LISTEN_HTTPS_PORT|WEB_URL|CORS_ALLOWED_ORIGINS)=' plane.env

Replace plane.example.com with your domain. The Postgres and RabbitMQ passwords stay at their defaults here: those services are only reachable on the stack's internal Docker network, and the compose file's default DATABASE_URL and AMQP_URL are built from those same defaults — change them only together.

#Start it

copycd ~/plane-selfhost
./setup.sh start
timeout 600 bash -c 'until [ "$(curl -so /dev/null -w "%{http_code}" http://127.0.0.1:8080/)" = "200" ]; do sleep 5; done'
curl -so /dev/null -w 'HTTP %{http_code}\n' http://127.0.0.1:8080/god-mode/
docker compose -f plane-app/docker-compose.yaml --env-file plane-app/plane.env ps --format '{{.Service}}\t{{.Status}}'

The first start pulls every image and runs the database migrations in a one-off migrator container, so it takes a few minutes. The migrator exits when it finishes, so it drops out of the list; everything else should be up.

#HTTPS + domain

Point an A record for plane.example.com at the server's public IP, wait for it to resolve, then put Caddy in front of the bundled proxy on port 8080:

plane.example.com {
    reverse_proxy 127.0.0.1:8080
}

The bundled proxy already routes /api, /auth, /god-mode, /spaces, /live and the uploads bucket to the right containers, so one upstream is all Caddy needs, and Caddy passes the WebSocket upgrade the live-collaboration server uses without extra configuration.

Two alternatives upstream documents, if you'd rather not run a second proxy:

• The bundled proxy can request its own Let's Encrypt certificate. Set SITE_ADDRESS to the bare domain, CERT_EMAIL to your email and WEB_URL to the https:// URL, and leave the listen ports on 80/443.
• Or remove the bundled proxy service and route each path to its container yourself — more work, and only worth it if you already run a proxy on the Docker network.

#First login and the instance admin

Open https://plane.example.com/god-mode/ first. That is the instance admin panel, and the first account you create there becomes the instance admin. Do it right after the first start. From there you control:

• Sign-up: whether anyone can create an account, or only invited users.
• Authentication: email/password, magic links, and Google, GitHub or GitLab OAuth.
• Email (SMTP): needed for invitations and magic links.

Then open the main URL, create a workspace, and invite your team.

#Backups

Plane's data lives in Postgres (everything except files), MinIO (uploads) and, less critically, Redis and RabbitMQ. The setup script's backup action copies all four volumes into plane-app/backup/<timestamp>/, and upstream provides a matching restore.sh:

copycd ~/plane-selfhost
./setup.sh backup
ls plane-app/backup/

That action copies Postgres's data directory while the database is running. For a transactionally consistent copy of the part that matters most, take a logical dump as well. The database container sets PGHOST, so pg_dump connects over TCP and needs the password from the container's own environment:

copycd ~/plane-selfhost/plane-app
mkdir -p backup
set -o pipefail
docker compose --env-file plane.env exec -T plane-db sh -c 'PGPASSWORD="$POSTGRES_PASSWORD" pg_dump -U "$POSTGRES_USER" "$POSTGRES_DB"' | gzip > backup/plane-db-$(date +%F).sql.gz
ls -lh backup/*.sql.gz

Copy the backup folder and plane.env off the server — upstream calls out backing up plane.env separately, because it holds the secrets.

#Upgrades

Back up first. The setup script's upgrade action stops the stack, downloads the newer compose file and plane.env template, and carries your existing settings over. It asks for confirmation, so run it interactively:

copycd ~/plane-selfhost
./setup.sh upgrade
./setup.sh start

Because setup.sh itself is pinned to v1.4.2 here, download the newer release's setup.sh and set its APP_RELEASE line to that version before you upgrade, the same way you installed it. Read Plane's release notes before jumping several versions.

#Troubleshooting

The migrator container exited with an error. Read its logs with docker compose -f plane-app/docker-compose.yaml --env-file plane-app/plane.env logs migrator. A database that wasn't ready is the usual cause; ./setup.sh restart re-runs it.

The page loads but API calls fail with CORS errors. WEB_URL and CORS_ALLOWED_ORIGINS don't match the URL in your browser. Fix both in plane.env and run ./setup.sh restart.

Uploads fail. Uploads go through the bundled proxy to MinIO. The default FILE_SIZE_LIMIT is 5 MB (5242880 bytes); raise it in plane.env if you need larger files.

Port 80 or 443 already in use. Something else, often a host Caddy or nginx, holds the port. That is why this guide moves the bundled proxy to 8080/8443.

#Verification + next steps

You're done when you can: load https://plane.example.com over a valid certificate, sign in to /god-mode/ as the instance admin, restrict sign-ups, create a workspace and a project, upload an attachment to a work item, and find last night's backup off the server.

From there: configure SMTP, connect Google or GitHub sign-in, and consider moving Postgres and uploads to managed services, which upstream recommends for production. For something much lighter, Vikunja and Leantime run in a fraction of the memory. For hosting options, see Best VPS for Docker.