How to Deploy Langfuse (Self-Hosted) with a Custom Domain

Method: Docker Compose + Cloudflare Tunnel (No Port Forwarding Required)

Prerequisites

1. A Linux Server (Home server, VPS, or EC2) with Docker & Docker Compose installed.
2. A Domain Name (e.g., yourdomain.com).
3. A Cloudflare Account (Free tier is sufficient).

---

Step 1: Point Your Domain to Cloudflare

Skip this if your domain is already managed by Cloudflare.

1. Log in to the Cloudflare Dashboard and click "Domain registration".
2. Enter your root domain (e.g., yourdomain.com) and select the Free Plan.
3. Cloudflare will provide two Nameservers (e.g., bob.ns.cloudflare.com).
4. Log in to your domain registrar (Namecheap, GoDaddy, etc.).
5. Go to DNS Settings (or "Nameservers") and change "Default DNS" to "Custom DNS".
6. Paste the two Cloudflare nameservers and save.
7. Wait 15-30 minutes for Cloudflare to show the status as "Active".

---

Step 2: Set Up Cloudflare Tunnel (On Your Server)

This creates a secure link from your server to the internet without opening router ports.

2.1 Install cloudflared

Run this on your Linux server:

# Download and install the package
curl -L --output cloudflared.deb [https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb](https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb)
sudo dpkg -i cloudflared.deb

2.2 Authenticate and Create Tunnel

# Login (this gives you a URL to visit in your browser)
cloudflared tunnel login

# Create a new tunnel (Save the UUID output!)
cloudflared tunnel create langfuse-production

# Link your specific subdomain to the tunnel
# Replace <UUID> with your real ID from the previous command
cloudflared tunnel route dns <UUID> langfuse.yourdomain.com

2.3 Move Credentials to System Folder

The background service runs as root, so it needs the keys in /etc/cloudflared.

sudo mkdir -p /etc/cloudflared
sudo cp ~/.cloudflared/cert.pem /etc/cloudflared/
sudo cp ~/.cloudflared/*.json /etc/cloudflared/

2.4 Create Configuration File

Create the config file: sudo nano /etc/cloudflared/config.yml
Paste the following content (Update <UUID> and hostname):

tunnel: <UUID>
credentials-file: /etc/cloudflared/<UUID>.json

ingress:
  - hostname: langfuse.yourdomain.com
    service: [http://127.0.0.1:3000](http://127.0.0.1:3000)
  - service: http_status:404

2.5 Start the Tunnel Service

# Install the system service
sudo cloudflared service install

# Start and enable it
sudo systemctl start cloudflared
sudo systemctl enable cloudflared

Verification: Run sudo systemctl status cloudflared. It should be active (running).

---

Step 3: Configure Langfuse (Docker Compose)

You must update Langfuse to know its public URL, otherwise login will fail.

3.1 Edit docker-compose.yml

Open your file (nano docker-compose.yml) and update the langfuse-web service environment variables.

Crucial Changes:
1. NEXTAUTH_URL: Must match your https domain.
2. NEXT_PUBLIC_LANGFUSE_BASEURL: Must match your https domain.
3. Ports: Ensure it binds to 127.0.0.1 or 0.0.0.0.

Example Snippet:

  langfuse-web:
    image: docker.io/langfuse/langfuse:3
    restart: always
    depends_on: *langfuse-depends-on
    ports:
      - 3000:3000
    environment:
      <<: *langfuse-worker-env
      
      # --- NETWORK CONFIGURATION ---
      NEXTAUTH_URL: [https://langfuse.yourdomain.com](https://langfuse.yourdomain.com)
      NEXT_PUBLIC_LANGFUSE_BASEURL: [https://langfuse.yourdomain.com](https://langfuse.yourdomain.com)
      # -----------------------------

      NEXTAUTH_SECRET: ${NEXTAUTH_SECRET:-mysecret}
      # ... (keep other existing variables) ...

3.2 Apply Changes

docker compose down
docker compose up -d

---

Step 4: Final Cloudflare Settings

1. Go to Cloudflare Dashboard > SSL/TLS.
2. Set encryption mode to Full. (Do not use "Flexible", it causes redirect loops).
3. Go to DNS. Ensure your langfuse CNAME record is Proxied (Orange Cloud icon).

---

Step 5: Verify

Visit https://langfuse.yourdomain.com.

• If it works on mobile but not desktop: It is a local DNS cache issue.
  • Fix: Change your computer's DNS to 1.1.1.1 or run sudo killall -HUP mDNSResponder (Mac) / ipconfig /flushdns (Windows).