> ## Documentation Index
> Fetch the complete documentation index at: https://docs.levelrail.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Self-host Tinyauth with Docker

> A small login screen and forward-auth server that protects other apps behind your reverse proxy with username and password or OAuth. Runs on SQLite in one container. Users are set with a bcrypt hash in the install form.

A small login screen and forward-auth server that protects other apps behind your reverse proxy with username and password or OAuth. Runs on SQLite in one container. Users are set with a bcrypt hash in the install form.

This page describes the Levelrail template for Tinyauth (Security). It deploys the services below as one Docker Compose app on your own server. Project site: [https://tinyauth.app/docs/getting-started](https://tinyauth.app/docs/getting-started).

Recommended memory: about 64 MiB.

## Services, ports and volumes

| Service | Image | Container ports | Volumes |
| - | - | - | - |
| `tinyauth` | `ghcr.io/tinyauthapp/tinyauth:v5.2.0` | 3000 | `data -> /data` |

## Environment variables

| Service | Variable | Value |
| - | - | - |
| `tinyauth` | `TINYAUTH_ANALYTICS_ENABLED` | Preset in the template |
| `tinyauth` | `TINYAUTH_APPURL` | Preset in the template |
| `tinyauth` | `TINYAUTH_AUTH_SECURECOOKIE` | Preset in the template |
| `tinyauth` | `TINYAUTH_AUTH_USERS` | You must provide |

Passwords and keys marked as generated are created for you when the app is deployed and stored as secrets. Values are not shown here.

## Security and requirements

Level: **Standard**.

What this template needs:

* You must provide one or more secrets before it can deploy (`tinyauth`): TINYAUTH\_AUTH\_USERS.
* Stores data in named volumes (`tinyauth`): data.

What Levelrail adds around it:

* Automatic HTTPS and an ingress shield in front of every domain.
* Secrets are generated, stored encrypted and masked in logs and the UI.
* Named volumes can be backed up and restored.
* Deploys are gated on the health check before traffic switches.
* One-step rollback to the previous revision.
* Exposure report shows what is reachable from outside.
* Host firewall rules managed for published ports.

> [!WARNING]
>
> This template needs configuration before it can deploy. Open it in the dashboard, set each variable marked "You must provide" in the Compose body, then deploy.

## Deploy Tinyauth with Levelrail

In the dashboard, open **Apps**, choose **New app**, then **Browse templates**, and select Tinyauth. Review the Compose body and deploy.

With the CLI:

```bash theme={"dark"}
levelrail-cli templates get tinyauth --output json | jq -r .compose > tinyauth.compose.yaml
# edit tinyauth.compose.yaml to set the variables you must provide
levelrail-cli apps deploy-compose my-tinyauth --file tinyauth.compose.yaml
```

See the [service template catalog](https://docs.levelrail.com/templates-and-registry.md) for how templates work, and [Getting started](https://docs.levelrail.com/getting-started.md) if you have not installed Levelrail yet.

## More Security templates

* [2FAuth](https://docs.levelrail.com/self-host/2fauth.md)
* [Authelia](https://docs.levelrail.com/self-host/authelia.md)
* [authentik](https://docs.levelrail.com/self-host/authentik.md)
* [Cap](https://docs.levelrail.com/self-host/cap-captcha.md)
* [Cryptgeon](https://docs.levelrail.com/self-host/cryptgeon.md)

All templates are listed in the [self-host gallery](https://docs.levelrail.com/self-host.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.