Self-Hosting
Deploy the backend and dashboard inside your own environment. Your logs never leave your infrastructure — Blocklog has no access to your data.
Data guarantee
licenses.blocklog.dev — no log content is ever transmitted externally.Licensing
After signing up, you will receive an email containing:
Note
Prerequisites
Container runtime
Docker & Docker Compose (single-node) or Kubernetes (scaled)
Database
PostgreSQL 14+
Task queue
Redis 6+
License key
Provided in your onboarding email
Architecture
| Image | Description | Source |
|---|---|---|
blocklog-backend.tar | Core API, Celery workers, PostgreSQL adapter, Redis adapter | Delivered via email |
blocklog-dashboard.tar | Engineer dashboard + compliance console | Delivered via email |
The backend exposes a FastAPI application on port 8000. The dashboard is a Next.js app on port 3000. Both are fronted by an nginx reverse proxy that handles TLS and traffic forwarding.
Docker Compose Quickstart
Step 1
Load the Docker image from the file you received via email, then copy the example environment file.
# You will receive the Docker image via email after license activation.
# Load the image, then set up your environment:
docker load -i blocklog-backend.tar
cp .env.example .envStep 2
Edit .env and fill in the required values. The license key, JWT secret, database URL, and Redis URL are mandatory.
# License (provided via email — 30-day free trial, then paid)
BLOCKLOG_LICENSE_KEY=bl_live_your_key_here
# Security — generate long random strings for each
JWT_SECRET_KEY=generate_a_long_random_string
API_KEY_SALT=generate_another_random_string
# Database
DATABASE_URL=postgresql://user:password@db_host:5432/blocklog
# Redis
REDIS_URL=redis://redis_host:6379/0
# CORS — add your dashboard domain here
CORS_ORIGINS=http://localhost:3000,https://your-dashboard-domain.com
Security
.env file in production. Use AWS Secrets Manager, HashiCorp Vault, or your cloud provider's secrets service instead.Step 3
Run migrations and bring up all services. This starts the API, Celery workers, Celery scheduler, and the nginx proxy.
# Run database migrations
make migrate
# Start the full stack
make prod-upapiCore FastAPI application on port 8000workerCelery workers for hash chaining and log sealingbeatCelery scheduler for periodic batch sealingnginxReverse proxy handling TLS and traffic forwardingStep 4
Load the dashboard image and point it at your backend URL.
# Load the dashboard image received via email:
docker load -i blocklog-dashboard.tar
# Configure backend URL
NEXT_PUBLIC_BLOCKLOG_API_BASE_URL=https://your-backend-url/api/v1docker-compose up -d
# Dashboard available at http://localhost:3000Step 5
Check that all services are healthy, test the API, and open the dashboard.
# Check service health
docker compose ps
docker compose logs -f api
# Test the API
curl http://localhost:8000/health
# Open the dashboard
open http://localhost:3000Updates
When a new version is available, you will receive updated image files via email. Load and restart each service in place:
# Backend
docker load -i blocklog-backend-vX.Y.Z.tar
docker compose up -d
# Dashboard
docker load -i blocklog-dashboard-vX.Y.Z.tar
docker-compose up -dSecrets Management
Storing credentials in .env is fine for evaluation. For production, move them to a dedicated secrets manager. Example using AWS Secrets Manager:
aws secretsmanager create-secret \
--name blocklog/jwt-secret \
--secret-string "your_jwt_secret"Reference secrets in your ECS task definition or inject them via your deployment pipeline. Never commit .env files containing real credentials to version control.
Network
Recommended topology: place all Blocklog services in a private subnet behind an internal load balancer that accepts HTTPS only. Outbound access is required only for:
License validation
licenses.blocklog.dev — no log data sent, only a valid/invalid response
All customer log data stays within your subnet.
CORS
Add your dashboard domain to CORS_ORIGINS in the backend .env. If you change the dashboard domain later, update this value and restart the backend.
CORS_ORIGINS=http://localhost:3000,https://your-dashboard-domain.comData Access
| Blocklog (Cloud) | Your Self-Hosted Instance | |
|---|---|---|
| Your agent logs | ✗ Never | ✓ Yes |
| Your trace data | ✗ Never | ✓ Yes |
| Log content | ✗ Never | ✓ Yes |
| Instance version | ✓ Telemetry only | — |
| License status | ✓ Valid / invalid | — |
Infrastructure
Evaluation
Production
High-Volume
Backup
Troubleshooting
Services won't start
Check for missing environment variables or database connection errors.
docker compose logs api
# Check for missing env variables or DB connection errorsDatabase migration fails
docker compose logs db
make migrateLicense validation fails
Ensure outbound access to licenses.blocklog.dev is not blocked by your firewall or VPC security groups.
# Ensure outbound access to licenses.blocklog.dev is not blocked
docker compose logs api | grep licenseDashboard can't reach backend (CORS error)
Add the dashboard URL to CORS_ORIGINS in the backend .env, then restart.
# Add your dashboard URL to CORS_ORIGINS in backend .env, then restart
docker compose restart apiCharts not rendering in the dashboard
The dashboard container may be hitting its memory limit.
# Add to docker-compose.yml under the dashboard service:
mem_limit: 512mSupport
For deployment help, email founder@blocklogsecurity.com or open an issue at github.com/soumyasurana/blocklog-dashboard.