Skip to main content
PostQueen runs as one container image next to three services: PostgreSQL, Redis and Temporal. The official Docker Compose file starts all four, so a working install is a clone, a short .env file and one command. This page covers what runs, what the machine needs and which guide to follow. To start right away, go to Try it locally or Deploy to a server.

​
Pick a path

Try it locally

Docker Compose on your own computer, over plain HTTP. About five minutes, and one command removes it.

Deploy to a server

Docker Compose on a virtual machine, on your own domain, with HTTPS. The path for an install other people use.

Kubernetes with Helm

The Helm chart, for a cluster you already run. You bring the Temporal server.

Run from source

Hot reload for changing the code, with a dev container if you prefer.
Docker Compose is the reference for the Compose file itself, and it also covers running the image on its own when you already have PostgreSQL, Redis and Temporal.

​
What runs

The image holds four processes: On every start the container first applies the database schema, then starts the three Node processes under pm2. Backups and upgrades explains what that step does to your data.
Temporal is required. Without a reachable Temporal server the web app loads and posts can be written, but nothing is published and no mail is sent.

​
What the machine needs

Any Linux that runs Docker Engine with the Compose plugin v2.24 or newer works, on amd64 or arm64. Docker Desktop on macOS and Windows is fine for a local try. The Compose stack runs eight containers, and Temporal’s Elasticsearch alone takes several hundred megabytes, so a 2 GB machine runs out of memory while it starts. Video conversion takes about two cores while it runs. Building the image from source needs more memory than running it.

​
Ports

A proxy that reaches the container over the Docker network, such as Traefik, uses port 5000. A proxy on the host uses 4007.

​
Outbound connections

PostQueen calls each network’s API from the server, so a strict egress firewall has to allow the hosts of the networks you connect, for example:
  • api.x.com and upload.x.com for X
  • graph.facebook.com, graph.instagram.com and graph.threads.net for Meta
  • api.linkedin.com and www.linkedin.com for LinkedIn
  • open.tiktokapis.com, and business-api.tiktok.com for TikTok Business
  • Google’s *.googleapis.com hosts, such as www.googleapis.com, oauth2.googleapis.com and the Business Profile API hosts, for YouTube and Google Business Profile
  • api.neynar.com for Farcaster
  • the instance in MASTODON_URL, and the servers people enter for Bluesky, Lemmy, WordPress and Listmonk
There is no outbound proxy setting. HTTPS_PROXY and HTTP_PROXY are not read. Behind an egress proxy, allow the hosts at the network layer or use a transparent proxy.

​
HTTPS

The login cookie is marked Secure, so browsers send it only over HTTPS. A server install therefore needs a certificate, which a reverse proxy in front of PostQueen provides: Domain and HTTPS walks through it. For a local try over plain HTTP, NOT_SECURED=true drops that requirement. Never set it on a server other people can reach.

​
Next steps

Channel developer apps

Each network’s app, variables and redirect URI.

Email

Resend or SMTP, so password resets and invitations arrive.

Uploads and storage

Media on the local disk, or in Cloudflare R2.

Backups and upgrades

The volumes to back up, and how to move to a newer image.
Last modified on September 23, 2026