Skip to main content
A Docker Compose server answers only on localhost by default. To let other computers reach it, set four variables in .env and run Docker Compose again. Browsers and Computers then reach everything through port 3000. Opening the server has a cost. Everyone on that network can reach it. Replace the public development secrets, put HTTPS in front of port 3000, and keep every other port private. This page covers the four variables, the secrets, the HTTPS proxy, the other ports, and the limits for voice. It applies to the Docker Compose install in Docker Compose. To serve several computers, use Docker Compose rather than the installer.
Plain HTTP exposes the Computer installer, the agent connection, and sign-in cookies to anyone on the network. Put HTTPS in front of port 3000 before other people use the server.

​
Set the four variables

Four variables open the server to your network. Replace 192.168.1.10 with this computer’s address.
1

Generate a private secret seed

Run this command and copy the output:
2

Edit .env

Set these variables in the .env file of your checkout:
3

Apply the change

Each variable has one job:

​
Replace the public development secrets

Replace both public secrets before anyone else uses the server. The .env.example file ships a public seed and a public encryption key, so Docker Compose works on localhost without setup. Everyone has these values. The server refuses to start with the public seed once WEB_PUBLIC_ORIGIN is not localhost, 127.0.0.1, or ::1. Replace both values yourself:
  • LINGER_SECRET_SEED protects every link between services.
  • TEAMHUB_SECRET_ENCRYPTION_KEY encrypts API keys that people save in Linger.
Generate each value with openssl rand -base64 32. Keep both in the ignored .env file or your secret store, never in Git. Anyone who holds either value can impersonate a service or read saved keys.

​
Put HTTPS in front of port 3000

Use an HTTPS reverse proxy in front of port 3000 for any shared server. The Computer installer, the gateway WebSocket, and sign-in cookies all travel over that port. With the proxy in place, set WEB_PUBLIC_ORIGIN to the HTTPS address. Set AGENT_RUNNER_PUBLIC_GATEWAY_URL to the matching wss:// address. Add the proxy’s address range to TEAMHUB_TRUSTED_PROXIES, so the server trusts the client address that the proxy forwards.

​
Keep the other ports private

Only the Web port needs to be reachable from other computers. The root docker-compose.yml publishes PostgreSQL, the server API, and the Node services on 127.0.0.1 only. Keep it that way. Change the PostgreSQL password from the development default before you open the server. The default user and password are both simplexai. The development server from pnpm dev is for one developer on one machine. It binds to 127.0.0.1. Do not expose it to a network.

​
Can other computers use voice?

Not without more setup, and the public sources do not document all of it. Browsers allow the microphone only on localhost or HTTPS, so voice from another computer needs the HTTPS proxy first. Voice audio also does not travel through port 3000. Browsers connect to the LiveKit server at LIVEKIT_URL, which defaults to ws://127.0.0.1:17880. The root docker-compose.yml publishes the LiveKit ports on 127.0.0.1 only. Test a real recording from another computer before you rely on it. Enable voice covers the voice keys.

​
Keep learning

Enable voice

Add the voice keys and use the microphone over HTTPS.

Computer permissions

Connect a Computer to the server and control its agents.

Troubleshooting

Fix Computers that cannot connect.

Environment variables

See every variable Linger reads.