Deployment & backups

Reverse proxy

TFsmith serves plain HTTP on port 8080 and expects to sit behind your reverse proxy (Nginx Proxy Manager, Traefik, Caddy, plain nginx) for TLS. Standard websocket support is not required.

Forwarded headers matter: the links in invite and password-reset emails are built from X-Forwarded-Host and X-Forwarded-Proto. Most proxies send these by default (NPM does); if your emailed links come out as http or an internal hostname, that is the proxy not forwarding them.

Volume ownership

The container runs as an unprivileged user (uid 10001 by default) and fixes volume ownership on boot. On systems where host paths must belong to a specific user (NAS appliances), set PUID/PGID to match - the entrypoint adopts them before dropping root.

Backups of TFsmith itself

Three things, backed up together: the Postgres database, the /data volume (encrypted tenant exports), and /secrets/master.key. The master key is the one you cannot re-create: without it the database's encrypted tokens and the stored exports are unrecoverable, and the app refuses to boot against data written with a different key. Losing everything EXCEPT the key is recoverable (reconnect tenants, refresh); losing the key is not.

Upgrades

Pull the new image and restart - schema migrations are automatic and additive. Check tfsmith.com/changelog for what changed; the running version is shown at the bottom of Settings.

Scheduled background work

TFsmith runs two small daily jobs: a license check-in (picks up renewals and added tenants) and maintenance (license expiry warning emails, expired invite/reset link cleanup). Neither touches your identity providers - tenant data moves only when someone clicks Refresh.