What it takes to self-host Fluxer

Can you self-host Fluxer?

Yes, you can self-host Fluxer, and the official way is one tool called rexctl. Fluxer is a Discord-style chat and voice app, released under the AGPL-3.0-or-later licence. Its operator guide says rexctl installs Fluxer on one machine and keeps it running. Self-hosting is free, and the software needs no licence key. The Operator Pass is an optional one-time purchase. It changes nothing on your own instance.

The machine is the easy part: 64-bit, with at least 4 GB of memory. Most of the work happens outside the machine. You need a domain with an A record, and five ports open in every firewall between the internet and the server. Voice calls also need a plan for the callers that the bundled voice server cannot reach directly.

Everything below comes from docs.fluxer.com and fluxer.com, read on 2026-11-08. On that day the release resolver gave out rexctl version 2026.1108.42846 for Linux on amd64. Fluxer publishes several builds a day, so your version will be newer. After the install, rexctl version prints the rexctl and Fluxer versions you actually got.

Which install path: rexctl, Docker Compose or Kubernetes?

The docs describe three ways to run Fluxer. Pick the one that matches what already runs your servers.

• rexctl is the main path for one machine. On Linux it installs Docker if Docker is missing. It checks your DNS record before it requests a certificate, and it sizes Fluxer to the machine. It also handles upgrades and backups.
• Docker Compose is for platforms that run compose stacks for you, such as Portainer, TrueNAS or Unraid, where you cannot run rexctl. Each Fluxer release ships a compose bundle with every image pinned to that release. To upgrade, you unpack the new bundle over the old folder (it replaces every file except .env) and run docker compose up -d. You back up the Docker volumes yourself. Keep .env safe, because the database, search and push keys in it cannot change once Fluxer has started.
• Kubernetes uses the Helm chart in deploy/helm/fluxer in the GitHub repository. You install it from a git clone, because there is no Helm repository or OCI registry for it. It needs Kubernetes 1.29 or newer, Helm 3 or 4, and a default StorageClass with ReadWriteOnce volumes. It requests about 1 CPU and 4.5 GB of memory, with limits near 19 GB.

Two other install paths show up in searches. Vultr's guide downloads a docker-compose.yml from one fixed commit of the repository (3b1eb567...), and it states no Fluxer version. Use the release bundle instead, because it matches a real release. There is also a fluxer-server Snap. Ken VanDine publishes it, not the Fluxer project, and the official docs do not mention it. On 2026-11-08 it was only on the candidate channel (version 2026.1104.180331, updated 5 November 2026). Its own listing warns that it could break and change often.

How big a server does Fluxer need?

The operator guide asks for a 64-bit Linux, macOS or Windows machine with at least 4 GB of memory. The fluxer.com/selfhost page gives the full minimum: a 64-bit Intel, AMD or Arm machine with at least 2 CPU cores, 4 GB of memory and 20 GB of free disk space. rexctl checks free disk space before it installs. Each time Fluxer starts, rexctl sizes it to the memory and CPUs it finds. On Linux, rexctl works with Docker or Podman. On macOS and Windows you need Docker Desktop.

Vultr's guide asks for more: at least 4 CPU cores and 8 GB of RAM, run as a non-root user with sudo. That is Vultr's number, not Fluxer's, and the Vultr page does not explain it. Treat 2 cores and 4 GB as the floor the project documents. Add more once you have watched real load on your own box.

Check a fresh VPS before you start:

uname -m
nproc
free -h
df -h /

uname -m should print x86_64 or aarch64. nproc should print 2 or more. The Mem: line of free -h should show about 4 GB or more, and df -h / should show at least 20 GB under Avail.

Point a domain at the server

Fluxer needs a domain or subdomain with an A record that points at the server's public IPv4 address. rexctl checks that record before it requests a TLS (transport layer security) certificate. Create the record first, and wait until it resolves.

getent ahostsv4 chat.example.com
ip -4 addr show scope global

The first command should print the public address of your server. On most VPS plans the second command shows that same address on the network interface. Some providers put the public address on a NAT (network address translation) gateway instead. In that case, compare against the address in the provider's panel.

Voice over IPv6 has extra rules. It needs Docker 27 or newer, Docker must not run in rootless mode, and the voice server needs a hostname with an AAAA record. A bare IPv6 address does not work as a voice endpoint.

Which ports does Fluxer need open?

Open TCP 80, 443 and 7881, and UDP 443 and 7882. Ports 80 and 443 carry the web traffic. TCP 7881 and UDP 7882 belong to the bundled voice server. UDP 7882 carries call media in the normal case. TCP 7881 carries media for networks that block UDP. Call media goes straight to these two ports and never through a reverse proxy, which is why they must be reachable even when the website sits behind Caddy or nginx.

There are two firewalls, and rexctl manages only one of them. It can open the ports in the machine's own firewall, ufw or firewalld, and that option is on by default. Your hosting provider's network firewall is a separate control in the provider's panel. You must open the same ports there yourself, because nothing on the server can change it. On a home network, forward the same ports from your router.

To open the local side by hand on Ubuntu with ufw:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 443/udp
sudo ufw allow 7881/tcp
sudo ufw allow 7882/udp
sudo ufw status

If ufw is active, sudo ufw status lists all five rules with ALLOW. If it prints Status: inactive, ufw is not filtering anything yet, so only the provider's firewall stands in the way. The ufw firewall basics for a VPS guide shows how to turn it on without locking yourself out of SSH.

Each extra voice server you add takes the next free TCP and UDP pair, counting up from 7881 and 7882. Open each new pair in both firewalls too.

Install Fluxer with rexctl

The install is a script piped into sh. Read the script before you run it:

curl -fsSL https://fluxer.dev/install.sh -o install.sh
less install.sh
sh install.sh

The script does not pin a version. It asks a release resolver at fluxer.dev/rexctl/release.json for the latest build for your OS and CPU. It downloads the tarball from the URL it gets back, and it checks the SHA-256 sum before it extracts it. The checksum comes from the same resolver as the download URL. So it catches a corrupt download, but it would not catch a compromise of fluxer.dev itself. The script supports Linux and macOS on amd64 and arm64. It also has --dry-run and --check modes, which you will see while you read it. Run as root, it puts rexctl in /usr/local/bin and the instance folder in /opt/fluxer. Run as a normal user, it uses ~/.local/bin and ~/fluxer.

The one-line form from the docs does the same thing:

curl -fsSL https://fluxer.dev/install.sh | sh

rexctl then asks its questions. When it finishes, it prints your instance's address. One question is where to create the admin account. Here in the terminal creates it during the install. In my browser prints a setup token, and the instance asks for that token the first time you open the address. If you lose the token, print it again, and record the versions you got:

rexctl setup token
rexctl version

Now open the printed address. Your browser should show Fluxer over HTTPS and ask for the token, or show the sign-in page if you made the admin in the terminal. After the admin account exists, users open the same address in a browser or add it in the apps. In the desktop app they pick Add another instance. In the mobile app they tap Change on the sign-in screen and enter the instance URL.

Behind your own reverse proxy. If Caddy or nginx already holds ports 80 and 443, install like this:

curl -fsSL https://fluxer.dev/install.sh | sh -s -- install --behind-proxy --bind 127.0.0.1:8080

Fluxer then listens on 127.0.0.1:8080, and your proxy forwards the site to it. The plain installer also offers this mode when it finds ports 80 or 443 in use. A Caddy reverse proxy on a VPS can terminate HTTPS in front of it. Voice still needs TCP 7881 and UDP 7882 open directly, because call media skips the proxy.

Do Fluxer voice calls need a TURN server?

A Fluxer instance comes with one bundled LiveKit voice server on the same machine. LiveKit is the media server that carries the calls. A call always stays on one server. You can add more servers with rexctl voice add, or join a voice server on another machine with a token. A second voice server on the same machine shares that machine's CPU, so it adds no capacity. Put extra voice servers on other machines.

TURN (traversal using relays around NAT) is a relay. It forwards call media for callers who cannot reach a voice server directly. rexctl does not install or run one. With a public IP and all five ports open, the bundled voice server works without TURN. You need your own TURN server in these cases:

• Networks that allow only HTTPS on port 443. Those callers need TURN over TLS on port 443, which rexctl does not set up.
• Callers with only IPv4 who must reach a voice server that has only IPv6.

Instances served only through a tunnel also need TURN. The section on running without a public IP covers that case.

A network that blocks UDP is not on this list. That is the job of TCP 7881.

You set TURN servers in FLUXER_LIVEKIT_TURN_SERVERS. It takes a JSON array of objects. Each object has a protocol (udp, tcp or tls) and a host (a hostname or an IPv4 address). Credentials are either a secret, or a username with a credential. The default is [], which means clients get no TURN server. A value the API cannot read stops the API from starting, so rexctl config set refuses such a value.

What breaks if you run Fluxer over plain HTTP?

Browsers turn off these web-app features on a plain-HTTP instance:

• passkeys
• microphone, camera and screen sharing (users can still join voice channels and listen)
• end-to-end encrypted calls
• notifications and push
• opening the web app offline, and installing it

Signing up, signing in, messages, uploads and the admin panel all still work. FLUXER_PUBLIC_SCHEME defaults to https. If you set it to http, also set FLUXER_PUBLIC_PORT, usually to 80. For a normal public instance, keep HTTPS. A chat app where nobody can speak is a poor trade for skipping a certificate.

Can you self-host Fluxer without a public IP?

Yes. The docs give three routes.

A tunnel. Behind CGNAT (carrier-grade NAT), or anywhere you cannot forward ports, use a tunnel such as Cloudflare Tunnel. Install with --behind-proxy and point the tunnel at http://127.0.0.1:8080. In this mode rexctl warns instead of stopping when the DNS lookup fails. The Cloudflare Tunnel guide for serving a site with no open ports covers the tunnel side. Calls do not pass through a tunnel. They need a TURN server on a machine with a public address, such as coturn on a small VPS, with its port open there (usually UDP 3478). Add it to FLUXER_LIVEKIT_TURN_SERVERS and leave FLUXER_LIVEKIT_USE_EXTERNAL_IP set to true. On a compose install, put the value in .env and run docker compose up -d. If calls still fail, open TCP 7881 and UDP 7882 as well.

Tor, I2P, Lokinet or .alt names. These also use --behind-proxy, and rexctl skips the DNS check for them. Tor and I2P browsers use plain HTTP, and Fluxer generates http links for them. For Lokinet or .alt names opened over plain HTTP, run rexctl config set FLUXER_PUBLIC_SCHEME=http after the install. The plain-HTTP limits above apply.

A private network only. Use a non-public name such as chat.home.arpa or fluxer.internal, and make it resolve to the machine on every device. Names like localhost and bare IP addresses are not accepted. For names ending in .home.arpa, .internal, .local or .localhost, Fluxer issues certificates from its own local CA (certificate authority). Every device must trust that CA's root certificate, which you copy out of the edge container with docker cp. For other private names, run rexctl config set FLUXER_EDGE_TLS internal.

Can a self-hosted Fluxer instance talk to fluxer.com?

No, not yet. Federation lets people on different instances talk to each other, the way email works between providers. It has not shipped. Fluxer's Roadmap 2026 post, dated 4 November 2026, lists federation as an experimental draft in 2026, and stable in the first half of 2027. The November 2026 update says it is still on the roadmap. So today, a user on your instance cannot message people on fluxer.com, the official instance, or on any other instance. Everyone who wants to chat with your users needs an account on your server.

Two more roadmap items are plans, not features. Peer-to-peer calls in the desktop app for instances without a voice server are planned. So is end-to-end encryption for DMs, group DMs and notes. If chat across servers matters to you now, compare Fluxer with a Matrix Synapse server on a VPS, or read the wider list of self-hosted Slack alternatives.

Upgrades, backups and restore

The Run your instance page at docs.fluxer.com/operator/running/ is the reference here. Read it before your first upgrade. The main commands are:

rexctl upgrade --check
rexctl upgrade
rexctl backup

rexctl upgrade --check looks for a new release without installing it. rexctl upgrade upgrades rexctl and Fluxer together. It makes a backup first, and it rolls back if the new version will not start. rexctl backup writes one file holding settings, database and uploads into the backups directory of the instance folder. By default it keeps the newest 3. A backup made without uploads restores only on the instance it came from. The page also lists rexctl restore, which takes a backup file, plus rexctl rollback and rexctl doctor.

Those backups sit on the same disk as the instance. If the disk or the VPS is lost, the backups go with it. Copy the newest file to another machine on a schedule.

FAQ

Is Fluxer free to self-host?

Yes. Fluxer's own post on self-hosting says the software is free to self-host and needs no licence key or extra payment. The source is AGPL-3.0-or-later. The Operator Pass is an optional one-time purchase, and it changes nothing on your own instance. Your real cost is the server, which needs at least 2 CPU cores, 4 GB of memory and 20 GB of free disk.

What are the minimum server requirements for Fluxer?

The fluxer.com/selfhost page asks for a 64-bit Intel, AMD or Arm machine with at least 2 CPU cores, 4 GB of memory and 20 GB of free disk space. You also need a domain with an A record pointing at the server's public IP. Vultr's guide asks for 4 cores and 8 GB, but that is Vultr's own figure, not Fluxer's minimum, and Vultr gives no reason for it.

Which ports does a self-hosted Fluxer instance need open?

TCP 80, 443 and 7881, and UDP 443 and 7882. rexctl can open them in ufw or firewalld on the server, but it cannot touch your hosting provider's network firewall, so open the same ports there in the provider's panel. Each extra voice server takes the next free TCP and UDP pair, counting up from 7881 and 7882.

Why do Fluxer voice calls fail behind Cloudflare Tunnel?

Call media does not pass through a tunnel. A tunnel-only instance needs a TURN server on a machine with a public address, such as coturn on a small VPS with UDP 3478 open. Add it to FLUXER_LIVEKIT_TURN_SERVERS, keep FLUXER_LIVEKIT_USE_EXTERNAL_IP set to true, and open TCP 7881 and UDP 7882 if calls still fail. rexctl does not install a TURN server for you.

Can users on my Fluxer instance talk to people on fluxer.com?

Not today. Federation has not shipped. Fluxer's Roadmap 2026 post, dated 4 November 2026, plans an experimental draft in 2026 and a stable release in the first half of 2027. Until then, each instance is separate, and people need an account on your instance to chat with your users. The desktop and mobile apps can still sign in to your instance by its address.