Cloud features, self-hosted
Self-hosted Myrtille has every feature, for any number of users, under the Apache 2.0 licence. Myrtille Cloud sells connectivity and peace of mind, never features: nothing exposed on your side, a hosted relay, mobile notifications, single sign-on, backups and operations. Everything the cloud does is in the repository and documented here, so you can run it yourself.
| What the cloud runs | Self-hosted today |
|---|---|
| Mobile notifications (Web Push) | Yes: the town hall sends them itself, with its own VAPID keys. |
| A relay for agents | Yes: run the relay yourself. |
| The town on phones | Your town hall at a public https address. |
| Single sign-on (OIDC) | Planned for sprint 7. |
| Backups | Yes: myrtille backup, and a restore built into the image. |
Mobile notifications
Section titled “Mobile notifications”The town installs as an app on a phone or a desktop, and opens on the mail. On a device where a person turns them on, the urgent items of the mail ring: an item that opens at high or critical, once, to every browser of a member who sees its district. An open permission rings again 60 seconds before it expires. The owner sets the time of a daily summary (18:00 in the time zone of the town by default), or none.
Self-hosted, this works today, with nothing to configure:
- The town hall makes its own VAPID key pair the first time it needs it, and keeps it in the settings of the town, the private key encrypted with the instance secret.
- It sends the notifications itself (Web Push, RFC 8291 and RFC 8292), to the push services of the browsers only (Google, Mozilla, Apple, Microsoft). Any other address is refused when a browser subscribes.
- A notification names the item and its urgency, never more than 80 characters of its details, and the device writes the text in its own language.
- Set
MYRTILLE_PUSH_CONTACTto themailto:orhttps:contact the push services may write to about your instance. By default it is your httpsMYRTILLE_PUBLIC_URL; without either, the town hall warns at its start and giveshttps://myrtille.eu.
Browsers allow notifications only on a page served over https (or on the machine itself), so give the town hall an https MYRTILLE_PUBLIC_URL (Install with Docker Compose).
Agents and phones without an inbound port
Section titled “Agents and phones without an inbound port”The local agents of the developers and the phones connect out to the town hall: the town hall never dials an agent, and an agent opens no port to the network. Self-hosted, they connect straight to your town hall, so it must be reachable at an https address from where they are: behind a reverse proxy with https, or the domain Coolify gives the service (Install with Coolify).
The cloud adds a hosted relay, so that nothing on your side needs a public address: a stateless WebSocket gateway, with signed agent tokens and logs that transit without being stored. The town hall and its agents both connect out to it. Run the relay yourself explains how to run the same relay on your own server, and where the cloud publishes the outbound addresses to allow in your Coolify.
Single sign-on
Section titled “Single sign-on”Sign-in with OIDC (Google, GitHub, and any OIDC provider), with roles mapped from a claim, is planned for sprint 7, with two-factor authentication. Its documentation will say what the cloud preconfigures, so you can set the same yourself. Until then, members sign in with an e-mail and a password.
Backups
Section titled “Backups”An owner downloads a hot copy of the database with myrtille backup, and the image restores it. Install with Docker Compose gives every step, and why to keep the instance secret apart from the backup.