Wiki contents
Wiki / Configuration
Configuration

Networking and HTTPS

Connect from your local network or through a reverse proxy.

Local network

The application listens on port 2567 by default. On the server itself, open http://localhost:2567. On another device, use http://SERVER-LAN-IP:2567.

Allow this port only on the networks you intend to use. PostgreSQL and Redis should stay private.

Internet access

Put the app behind a reverse proxy that terminates HTTPS. Configure the proxy to forward WebSocket connections as well as normal HTTP requests. Use the app's internal address and port 2567 as the upstream.

Set TRUST_PROXY_HOPS to the exact number of proxies between users and the app. Its default, 0, ignores forwarded client addresses. Do not expose a direct path to the app that bypasses the proxy while trusting forwarded addresses. For the bundled Compose deployment, add the environment override; setting this key only in .env does not pass it into the container.

Use your proxy's documentation for its TLS certificate and WebSocket settings. Open Tabletop does not configure firewall rules, DNS, or certificates for you.

Asset-package uploads

If administrators import large asset packages, allow an appropriately sized request body on /asset-packages in your reverse proxy. The application transfer ceiling is 544 MiB, with up to 512 MiB of original files. A smaller proxy limit can reject an upload before the app sees it. Leave enough temporary disk space for the transfer.

If email recovery is enabled, set PUBLIC_ORIGIN to the public app origin, for example https://tabletop.example.com. Use an origin without a path, credentials, query, or fragment. HTTPS is required except for localhost development.

The marketing website and wiki can use a separate hostname. PUBLIC_ORIGIN must identify the running game app, not this documentation site.

Troubleshooting connections

If the lobby loads but the table will not connect, check WebSocket forwarding and proxy logs. If local access works but remote access does not, check DNS, certificates, firewall rules, and the proxy upstream. See Troubleshooting.

Sources checked: README.md, server/redis-config.js, docs/RELEASING.md. Reviewed September 29, 2026 against the working source. Published releases may differ; check the changelog for your version.