[{"data":1,"prerenderedAt":120},["ShallowReactive",2],{"seo-verification":3,"blog-self-host-logto-vps-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"id":7,"slug":8,"title":9,"excerpt":10,"readTime":11,"views":12,"isPinned":13,"publishedAt":14,"category":15,"categories":21,"featuredImage":23,"bgImage":24,"posterImage":25,"relatedSolution":26,"intro":29,"sections":30,"ctaTitle":66,"ctaBody":67,"ctaButton":68,"ctaUrl":69,"relatedPosts":70},226,"self-host-logto-vps","Self-host Logto on a VPS: your own authentication layer","Deploy Logto on your ServOrbit VPS and replace a hosted auth service: OIDC, social login, MFA and SDKs for 20+ frameworks.",5,0,false,"2026-08-05T00:00:00+00:00",{"id":16,"name":17,"slug":18,"color":19,"icon":20},4,"Development","developpement","bg-warning\u002F10 text-warning","dev",[22],{"id":16,"name":17,"slug":18,"color":19,"icon":20},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fself-host-logto-vps-poster.svg",{"categorySlug":27,"appSlug":28},"cybersecurity","logto","Hosted authentication services bill per monthly active user, and they hold your users' login data on their servers. Logto is the open-source alternative: a full OIDC\u002FOAuth 2.0 authentication platform you deploy on your own VPS and own completely. One Docker Compose file, two containers (Logto and PostgreSQL 17), and your applications get production-grade user authentication — registration, social login, MFA, role-based access control — with no per-seat cost.",[31,35,38,41,51,54,57,60,63],{"type":32,"title":33,"body":34},"h2","What Logto actually is — and what it is not","Logto is an **auth SDK platform**: you integrate it into your application's code via a 15-line SDK snippet, and it handles the complete user lifecycle on your own server. This is different from the two other authentication tools in the ServOrbit catalogue:\n\n- **Authelia** adds MFA and SSO *in front of* existing apps via forward auth, without changing their code — it protects apps that have no login at all.\n- **Authentik** is a full identity provider for centralising SSO across your self-hosted tools (Grafana, Gitea, Nextcloud).\n- **Logto** replaces Auth0 or Clerk: you call its SDK from your React, Python, or Go application, and it manages user accounts, sessions, social connectors, and tokens.\n\nIf you're building a product where users create accounts, Logto is the right tool.",{"type":32,"title":36,"body":37},"Prerequisites","You need a ServOrbit VPS with at least **2 GB RAM** — Logto (Node.js) and PostgreSQL 17 share the same instance. Docker and Docker Compose are pre-installed on all ServOrbit VPS plans. You also need a domain name (or subdomain) pointed to your VPS: Logto bakes the public domain into every OIDC token it issues, so the domain must be set before the first deployment and cannot be changed without resetting all user data.",{"type":32,"title":39,"body":40},"How Logto works in production","Logto starts two containers: `db` (PostgreSQL 17 for users, apps, sessions, audit logs) and `logto` (Node.js serving the OIDC endpoint on port 3001 and the admin console on port 3002). The nginx reverse proxy on your VPS forwards HTTPS traffic on your domain to port 3001 — that's the endpoint your applications authenticate against. Port 3002 (admin console) is bound to localhost only and is accessible only via SSH tunnel, which keeps your user database management off the public internet.",{"type":42,"title":43,"items":44},"ul","What Logto provides out of the box",[45,46,47,48,49,50],"**OIDC\u002FOAuth 2.0 compliant tokens** — signed JWTs that any standard library (passport.js, python-jose, go-oidc) can verify without custom code.","**Social login connectors** — enable Google, GitHub, Apple, Microsoft, Discord and 30+ providers from the admin console in one click; each requires a 5-minute OAuth App setup on the provider side.","**Passwordless authentication** — send magic links (email) or OTP codes (SMS via Twilio, SendGrid, Mailgun) without maintaining a separate notification service.","**MFA** — TOTP (Google Authenticator, Authy), WebAuthn\u002FFIDO2 hardware keys, and backup codes, enforced by policy from the admin console.","**Role-based access control** — define roles and permissions in the console; receive them as `scope` claims in the JWT and enforce them in your API with a single middleware line.","**SDKs for 20+ frameworks** — React, Next.js, Vue, Angular, React Native, Flutter, Python, FastAPI, Go, PHP, Laravel, .NET, Java, Spring Boot and more.",{"type":32,"title":52,"body":53},"One-click deploy with ServOrbit","Go to your ServOrbit dashboard → Marketplace → Security → Logto → Deploy. Choose the VPS size (2 GB RAM minimum), assign a domain, and click Deploy. ServOrbit provisions the VPS, configures the nginx vhost for your domain, generates the database credentials and the `SECRET_VAULT_KEK` (AES-256 key for encrypted field storage), and starts the two-container stack. The OIDC discovery document is live at `https:\u002F\u002Fyour-domain\u002F.well-known\u002Fopenid-configuration` within 60 seconds.",{"type":32,"title":55,"body":56},"First-run admin setup via SSH tunnel","The admin console listens on port 3002, bound to localhost for security. Open an SSH tunnel from your machine with `ssh -L 3002:127.0.0.1:3002 root@your-vps-ip`.\n\nThen open `http:\u002F\u002Flocalhost:3002\u002Fconsole` in your browser. The first-run wizard asks for your admin email and password, then takes you to the dashboard. This is a one-time setup — afterwards you only open the tunnel to manage applications or users.",{"type":32,"title":58,"body":59},"Integrating Logto into a Next.js application","Install the SDK with `npm install @logto\u002Fnext`, then create a `logto.ts` that exports a `new LogtoClient({ … })` configured with `endpoint` (your Logto instance URL), `appId` and `appSecret` (from the Logto admin console), `baseUrl` (your application URL), `cookieSecret` and `cookieSecure`.\n\nTo protect a route, call `getLogtoContext({ getAccessToken: true })` imported from `@logto\u002Fnext\u002Fserver-component`: it returns `isAuthenticated` and the user's `claims`. If `isAuthenticated` is false, redirect to `\u002Fapi\u002Flogto\u002Fsign-in`; otherwise render the page from the claims you received.\n\nThat is the whole integration: fifteen lines of configuration, one import, one guard.",{"type":32,"title":61,"body":62},"Enabling Google social login","In the Google Cloud Console, create an OAuth 2.0 Client ID (Web application type). Set the authorised redirect URI to `https:\u002F\u002Fyour-logto-domain.com\u002Fcallback\u002Fgoogle`. Copy the Client ID and Client Secret.\n\nIn the Logto admin console → Connectors → Social connectors → Google → Enable. Paste your Client ID and Secret, save. Google now appears as a sign-in option on your Logto sign-in page automatically — no code changes needed in your application.",{"type":32,"title":64,"body":65},"Backup strategy","Logto stores all its state in the `logto_db` PostgreSQL volume. Back it up with a `pg_dump` cron job or mount the volume to a Backrest instance (also in the ServOrbit marketplace) for automated, deduplicated, encrypted backups to S3, Backblaze B2 or SFTP. Losing the `logto_db` volume means losing all user accounts, application configurations, and audit logs — back it up before any VPS migration.","Your auth layer, on your own VPS","Deploy Logto on a ServOrbit VPS — own your users' authentication data, drop per-user billing, and integrate with SDKs for React, Next.js, Python, Go, Flutter and more.","Deploy Logto","\u002Fmarketplace\u002Fcybersecurity\u002Flogto",[71,91,108],{"id":72,"slug":73,"title":74,"excerpt":75,"readTime":76,"views":77,"isPinned":13,"publishedAt":78,"category":79,"categories":85,"featuredImage":23,"bgImage":24,"posterImage":87,"relatedSolution":88},111,"sso-authentik-vps","Centralizing authentication with Authentik on VPS","Centralize the authentication of all your apps with self-hosted Authentik on a VPS: SSO, MFA and forward auth in Docker Compose.",3,707,"2026-03-01T00:00:00+00:00",{"id":80,"name":81,"slug":82,"color":83,"icon":84},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[86],{"id":80,"name":81,"slug":82,"color":83,"icon":84},"\u002Fblog\u002Fcovers\u002Fsso-authentik-vps-poster.svg",{"categorySlug":89,"appSlug":90},"securite","authentik",{"id":92,"slug":93,"title":94,"excerpt":95,"readTime":16,"views":12,"isPinned":13,"publishedAt":96,"category":97,"categories":103,"featuredImage":23,"bgImage":24,"posterImage":105,"relatedSolution":106},160,"self-host-infisical-vps","How to Self-Host Infisical on a VPS","Deploy Infisical on your VPS — an open-source secrets manager that centralises API keys, env vars and certificates in a self-hosted vault with SDK integrations, webhooks and audit logs.","2026-07-02T00:00:00+00:00",{"id":98,"name":99,"slug":100,"color":101,"icon":102},7,"Self-hosting","self-hosting","bg-indigo-500\u002F10 text-indigo-400","cloud",[104],{"id":98,"name":99,"slug":100,"color":101,"icon":102},"\u002Fblog\u002Fcovers\u002Fself-host-infisical-vps-poster.svg",{"categorySlug":27,"appSlug":107},"infisical",{"id":109,"slug":110,"title":111,"excerpt":112,"readTime":76,"views":12,"isPinned":13,"publishedAt":113,"category":114,"categories":115,"featuredImage":23,"bgImage":24,"posterImage":117,"relatedSolution":118},131,"deploy-vaultwarden-vps","Self-Host Your Password Manager: Deploy Vaultwarden on VPS","Self-host Vaultwarden on a VPS to get unlimited Bitwarden-compatible password management, team vaults and TOTP at a fixed monthly cost — under 50 MB RAM.","2026-06-24T00:00:00+00:00",{"id":80,"name":81,"slug":82,"color":83,"icon":84},[116],{"id":80,"name":81,"slug":82,"color":83,"icon":84},"\u002Fblog\u002Fcovers\u002Fdeploy-vaultwarden-vps-poster.svg",{"categorySlug":84,"appSlug":119},"vaultwarden",1785971748037]