Hanish's Garden

🌿 Self-hosting Rustpad behind Traefik

Properties1
tagshomelab

2 min read

Rustpad is a lightweight, real-time collaborative text editor — think a minimal shared scratchpad you can send someone a link to and type together. It runs in-memory by default; add SQLite and it persists pads for a set window. Deployed here behind Traefik.

There is no authentication — the URL is the password

Rustpad has no user auth. Anyone with a pad’s link can read and edit it. Pads can’t be listed (you must know the URL), but URLs leak — browser history, chat logs, shoulder-surfing. Never paste secrets, credentials, or private data into a Rustpad. Treat every pad as effectively public once shared.

docker-compose.yaml

# /srv/rustpad.example.com/docker-compose.yaml
name: rustpad-example-com
 
services:
  rustpad:
    image: ekzhang/rustpad
    container_name: rustpad.example.com
    restart: always
    mem_limit: 64M
 
    environment:
      - EXPIRY_DAYS=30                    # how long a pad persists after last edit
      - SQLITE_URI=/data/rustpad.sqlite   # enables persistence (omit = in-memory only)
 
    volumes:
      - ./data:/data
 
    labels:
      - com.centurylinklabs.watchtower.enable=true
      - traefik.enable=true
      - traefik.http.routers.rustpad.rule=Host(`rustpad.example.com`)
      - traefik.http.routers.rustpad.entrypoints=https
      - traefik.http.routers.rustpad.tls=true
      - traefik.http.routers.rustpad.tls.certresolver=lets-encrypt
      - traefik.http.services.rustpad.loadbalancer.server.port=3030

The only change from a bare label set is entrypoints=https (pins it to the TLS entrypoint); you already had the important loadbalancer.server.port=3030.

Notes & suggestions

  • Persistence: SQLITE_URI turns on the SQLite backend so pads survive restarts; EXPIRY_DAYS=30 prunes a pad 30 days after its last edit. Drop SQLITE_URI for a purely ephemeral, in-memory instance. The data lives in ./data/rustpad.sqlite — but since pads expire by design, backups are optional.
  • Want it private? Front it with the Traefik forward-auth (Google SSO) middleware. Tradeoff: that gates the whole instance, so every collaborator then needs an allowlisted Google account — which kills “send anyone a link.” Use SSO for a private team pad; leave it open for quick anonymous collaboration on throwaway content.
  • Use unguessable pad names if you leave it open — the pad name is the only thing standing between your text and anyone who types the URL.
  • Maintenance: Rustpad is stable but quietly maintained (last release early 2025). It works and is safe to run; just don’t expect frequent updates — so Watchtower rarely has anything to pull here.

Graph View

Backlinks