Setup generator

Pick your stack and get a one-command install, or the files to set up yourself. The install command sends your choices and domains to certshell.dev to build the script; keys and passwords are generated on your server and never sent.

Reverse proxy

Caddy Traefik My own

Identity provider

Pocket ID Existing OIDC

CertShell domain Pocket ID domain OIDC issuer URL Must send a groups claim users can't change. Trusted proxy IP Source IP CertShell sees from your proxy. Default is the Docker gateway, for a proxy on the host. Encrypt CA key at restRecommended. Adds a ca_password secret.

Install

One command Step by step