evc-team-relay-ubuntu-vm-report

Team Relay — Ubuntu VM installation

Date: 1 October 2026

Server

• VM: obsidiancrdt, Tailscale IP 100.113.222.40.
• SSH account: yuri.
• Ubuntu 26.04.1 LTS, x86_64, approximately 3.3 GiB RAM and 86 GiB free disk space before installation.
• This is a separate Team Relay installation. The Raspberry Pi installation was left unchanged; no existing accounts, shares, or notes were migrated.

Installation

Installed Ubuntu’s Docker and Compose packages, Git, curl, and OpenSSL. Enabled Docker at boot.

Team Relay release v1.13.4 was checked against the project’s latest release and downloaded using its published x86_64 container images.

Six persistent services: PostgreSQL, MinIO, control plane, collaboration relay, web publishing, and Caddy. Two initialization jobs create the storage bucket and migrate the database.

Configuration and persistent data are in /opt/evc-team-relay/deployment:

• compose.json: Docker deployment definition.
• .env: private settings and generated secrets.
• relay.toml: relay settings and signing-key configuration.
• Caddyfile: proxy routes and WebSocket authentication handling.
• data/: database, object storage, relay state, and uploads.

The deployment directory has permissions 700; files containing secrets have permissions 600. Persistent containers use unless-stopped restart policies. No database or object-storage ports are published directly. HTTP entry points bind only to the VM’s loopback address on ports 18000–18002. Control-plane metrics are blocked through Caddy.

Cloudflare connection ports

Cloudflare Tunnel was subsequently installed on 1 October 2026 using the official Cloudflare APT repository and the supplied tunnel token. cloudflared version 2026.9.3 runs directly on the VM as a systemd service. The service is active, enabled at boot, and registered four connections to Cloudflare. Its service file is root-only (600) because it contains the tunnel credential. The token is omitted from this report.

Team Relay was subsequently configured for domain rothirsch.net. Create these HTTP hostname routes in the Cloudflare dashboard for the connected tunnel:

Public hostname	Purpose	Local target
team.rothirsch.net	Login, API, administrator dashboard	http://127.0.0.1:18000
relay.rothirsch.net	Collaboration relay, including WebSockets	http://127.0.0.1:18001
notes.rothirsch.net	Published notes, optional	http://127.0.0.1:18002

These ports listen only on localhost. If cloudflared runs in a container, its own 127.0.0.1 is not the VM; use host networking on Linux or connect it to the deployment network and use the Caddy container’s internal ports 8000, 8001, and 8002 respectively. A tunnel on another machine cannot reach the current loopback-only ports.

Updated .env values CONTROL_PLANE_PUBLIC_URL, RELAY_PUBLIC_URL, RELAY_AUDIENCE, and CORS_ALLOWED_ORIGINS; also updated relay.toml server URL to match RELAY_AUDIENCE exactly. Publishing’s hostname and URLs in .env and compose.json were updated, and affected containers were recreated. Private credentials remain unchanged. The connector token alone does not grant Cloudflare DNS or tunnel-route administration, so creating those dashboard routes remains a user step.

New application addresses — Cloudflare routes pending

Purpose	Address
Plugin server / API	https://team.rothirsch.net
Administrator dashboard	https://team.rothirsch.net/admin-ui/login
Collaboration relay	wss://relay.rothirsch.net
Published notes	https://notes.rothirsch.net

Cloudflare Tunnel is connected and Team Relay advertises these public addresses. Public hostname routes still need to be added to the tunnel. Tailscale Serve/HTTPS was not enabled, and no Tailscale proxy configuration was left running. HTTPS from actual external clients has not been checked.

Credentials and connecting

Administrator login: admin@example.com. A random password was generated on the VM and saved privately:

ssh yuri@100.113.222.40
cat ~/evc-team-relay-handoff/credentials.md

No passwords or private keys are included in this report. SMTP and external integrations are disabled; invitation emails will not be sent automatically.

Once Cloudflare routes and Team Relay’s public URLs are configured, add the new HTTPS API hostname in Obsidian’s Team Relay settings and sign in. Each collaborator needs their own account and sharing permissions. Client setup and actual co-editing between Obsidian clients have not been performed.

Backups

Initial backup: /var/backups/evc-team-relay/evc-team-relay-20261001T075912Z.tar.gz.

A consistent backup helper is installed:

sudo /usr/local/sbin/evc-team-relay-backup

It briefly stops the stack, archives its configuration and persistent data to /var/backups/evc-team-relay, and restarts it. Archives contain secrets and have private permissions. Backups are manual and local to this VM; no schedule or off-device backup was configured.

Maintenance

cd /opt/evc-team-relay/deployment
sudo docker compose -f compose.json ps
sudo docker compose -f compose.json logs --tail=100
sudo docker compose -f compose.json up -d

Completion checks

All six persistent containers were running after the backup and restart. PostgreSQL, MinIO, control plane, relay, and publishing reported healthy. Administrator authentication succeeded without printing its token. Local API readiness, relay readiness, publishing root, and administrator login page returned HTTP 200. Proxy access to control-plane metrics returned HTTP 404. Docker is enabled at boot, and ports 18000–18002 were confirmed bound only to 127.0.0.1.

No external HTTPS connection, attachment transfer, or simultaneous Obsidian editing was checked; external access is deferred.

References

• Team Relay release
• Obsidian plugin