Deploy VOTPort at your facility
The deployment model and first steps for operating your licensed VOTPort instance.
On this page
Requirements
VOTPort runs as a container behind a TLS-terminating reverse proxy. You need Docker with Compose, a public HTTPS address, persistent storage, and the release supplied for your commercial deployment.
The container runs as user ID 1000. Its persistent directories must satisfy VOTPort's ownership and filesystem safety checks.
Persistent storage
Keep three separate responsibilities in view:
| Location | Contents |
|---|---|
/data |
Database, cookie secret, receipt and native-transfer identity keys |
/received |
Files received through requests |
/outbound |
Files and project folders available for delivery |
Back up all three. Automatic database and identity archives do not include your received and outbound content volumes.
Configure the instance
Set VOTPORT_PUBLIC_URL to the deployment's HTTPS address. Configure VOTPORT_ADMIN_PASSWORD with at least 12 characters, or use VOTPORT_ADMIN_PASSWORD_HASH with an Argon2 PHC string.
Use the exact released image reference and digest supplied for your deployment. Avoid floating tags. Keep that image reference with the matching database and volume backups.
Reverse proxy
Bind the container's HTTP port to loopback and point Caddy or your chosen TLS proxy at it. A typical Caddy site is:
drop.example.com {
reverse_proxy 127.0.0.1:8321
}
Match the upstream port to your Compose mapping. Configure trusted proxy ranges to match your actual proxy rather than trusting arbitrary forwarded addresses.
Network shares
Network filesystems have different safety and durability behavior. Qualified Linux SMB3/CIFS and NFSv4 support direct receiving with Balanced receipts and server-acknowledged durability. Qualification requires the storage administrator’s confirmation and successful filesystem checks; it does not certify appliance power-loss behavior.
Follow direct NAS receiving to qualify the receiving mount and its server guarantees. The outbound library retains its separate filesystem checks and Fast receipts for existing files.
Native transfers
Native QUIC listeners are separate UDP services. They do not pass through a normal HTTP reverse proxy. Leave them disabled until their public address, firewall rules, certificates, and identity pinning are configured.
Operations
Configure identity-provider sign-in, quotas, retention, notifications, monitoring, and backups before onboarding users. Test restoration with a matching release and verify that file-volume backups are included.
Follow the installation procedure, then review storage, backup and restore, upgrades, and monitoring. The configuration reference lists environment defaults; native transfers covers the optional QUIC listeners.