Self-host Plausible Analytics on a VPS

To self-host Plausible Analytics, run Plausible Community Edition (CE) from its official repository with Docker Compose: three containers, Plausible itself, PostgreSQL for accounts and sites, and ClickHouse for the events. You register the first account, put it on a domain with HTTPS, and add the script it gives you to your pages.

CE is the free, self-managed release of Plausible's dashboard. It comes without Plausible's support, is released less often than their cloud, and some features stay in the cloud; the community-edition README lists them. Your data stays on your server.

What you need#

• A server. Standard (2 vCPU, 4 GB) is the smallest plan we offer it on. Plausible recommends at least 2 GB of memory, and ClickHouse is the hungry part, so Standard leaves room for traffic peaks and ClickHouse's background work. ClickHouse also needs a CPU with SSE 4.2.
• A domain or subdomain for the dashboard, such as stats.example.com.
• An SSH client on your computer. Connect with SSH covers it.

We haven't benchmarked how much traffic each plan handles. Memory is usually the first limit; watch the server's graphs in the panel and move up a plan if ClickHouse runs short.

Install it with the one-click app#

Order a server with the Plausible Analytics one-click app. On the first boot it installs Docker, clones the newest CE release to /opt/plausible, generates its secret keys in /opt/plausible/.env, and starts the containers with Plausible published on 127.0.0.1:8000 only.

Plausible lets whoever registers first, while it has no users, create the first account. So you register through a tunnel before the dashboard is public. From your computer:

ssh -L 8000:127.0.0.1:8000 root@203.0.113.10

Leave that open, browse to http://localhost:8000 and register your account. After the first account, registration is by invitation only, which is Plausible's default.

On the server, this shows whether Plausible is ready, with PostgreSQL and ClickHouse reported as ok:

curl http://127.0.0.1:8000/api/system/health/ready

Put it on your domain with HTTPS#

1. Point stats.example.com at the server with an A record for its IPv4 address.
2. Allow ports 80 and 443 in the panel firewall.
3. On the server, run:

vps9-https stats.example.com

vps9-https first checks Plausible's database for users and refuses to go on while there are none, so the registration page is never public. Then it sets BASE_URL in /opt/plausible/.env to https://stats.example.com, restarts Plausible with it, installs Caddy from Caddy's own packages and points it at 127.0.0.1:8000. Caddy gets and renews the Let's Encrypt certificate, usually within a minute.

Log in at https://stats.example.com, add your site, and put the script it gives you on your pages.

Doing it by hand on another server#

The community-edition README has the quick start. In outline, on a server with Docker (Install Docker), clone a release tag (check the README for the current one):

git clone -b v3.2.1 --single-branch https://github.com/plausible/community-edition plausible-ce
cd plausible-ce
echo "BASE_URL=https://stats.example.com" >> .env
echo "SECRET_KEY_BASE=$(openssl rand -base64 48)" >> .env
echo "HTTP_PORT=80" >> .env
echo "HTTPS_PORT=443" >> .env

Then create compose.override.yml to publish those ports, so Plausible gets its own Let's Encrypt certificate:

services:
  plausible:
    ports:
      - 80:80
      - 443:443

Start it with docker compose up -d, then open your domain and register straight away: until someone has, anyone who opens the page can.

Updates and backups#

Updates are yours. Read the release notes first, because major versions can need extra steps. Then, in /opt/plausible, fetch the new release tag with Git, check it out and recreate the containers:

cd /opt/plausible
git fetch --tags
git checkout v3.2.1
docker compose up -d

Use the tag of the release you're moving to in place of v3.2.1. We turn on the operating system's automatic security updates.

Back up /opt/plausible/.env and the db-data, event-data and plausible-data volumes off the server. .env holds the secret keys (SECRET_KEY_BASE and TOTP_VAULT_KEY), so a restore without it isn't complete. Backups you should run shows how to copy archives off the server every night.

When it goes wrong#

• vps9-https says to register through the SSH tunnel first: nobody has registered yet. Open the tunnel, register at http://localhost:8000, and run it again.
• Links in the dashboard and emails point at localhost: BASE_URL is still http://localhost:8000. Run vps9-https with your domain, which sets it and restarts Plausible.
• No visits show up: the script on your pages points at the wrong address, or an ad blocker on your own browser is blocking it. Check the snippet in your site's settings matches https://stats.example.com, and test from another browser.