Skip to main content
The Plugins page (sidebar → Infrastructure → Plugins) installs the services your apps need next to them on the same server: a database, a cache, object storage, and a secrets store. Each plugin runs with Docker Compose and starts again on its own after a reboot.

Install a plugin

Click Install on its card. The install runs in the background, with each step on the page:
1

Docker

The first install puts Docker Engine on the server from Docker’s official apt repository.
2

Ports

Free ports are picked the same way as for websites. A port a plugin holds is never given to a website.
3

Passwords

Strong passwords (and MinIO’s keys) are generated and stored encrypted with the panel’s key.
4

Start

The compose file is written to /opt/laravelify-plugins/<name> (root only) and the service starts.
When it is done, the panel shows the credentials once, with copy buttons. Save them in your password manager, then click I saved them. Linked websites get them in their .env either way. Installing again (after an error, for example) keeps the plugin’s data, ports, and passwords.

What keeps it safe

  • Every port is bound to 127.0.0.1. Nothing is reachable from the internet unless you give the plugin a domain.
  • Data lives in named Docker volumes. Plugins cannot mount folders of the server.
  • Before anything starts, the server checks the compose file: no privileged containers, no host network, no Docker socket, no builds, no extra capabilities (Vault’s IPC_LOCK is the one exception).
  • Passwords are never written to a log, a task message, or an error. The files that hold them on the server are readable by root only.
Pick a website under Linked websites on the card and click Link. The plugin’s variables are written into the website’s .env and its processes restart: GlitchTip connects every website by itself. VS Code is not a plugin: every website has its own (and Workspaces open several together). The PostgreSQL and MySQL plugins also show on the Database page. Unlinking removes exactly those variables again.
Linking PostgreSQL replaces the website’s own DB_* settings, such as a MySQL database the panel made for it. VAULT_TOKEN is Vault’s root token: fine for one app on your own server, but create a token with a narrower policy for anything shared.

Vault: sealed and unsealed

Vault keeps its data encrypted and seals itself every time it restarts. While sealed it answers every request with an error.
  • On install, the panel initializes Vault with 5 unseal keys (3 are needed) and a root token, stores them encrypted, and unseals it.
  • The card shows Sealed or Unsealed. Click Unseal after a restart.
  • Unseal on its own after a restart or reboot checks every minute and unseals Vault for you.
With auto-unseal on, the unseal keys sit on the same server as Vault (encrypted with the panel’s key). Anyone who gets the server and the panel gets your secrets too. Leave it off when that matters, and unseal by hand.

Open it on a domain

MinIO’s console and Vault’s UI can open on a domain. On the card, click More → Open on a domain and enter:
  • the domain, like minio.example.com
  • a Cloudflare tunnel, for HTTPS. With an API token in Settings → Cloudflare, Laravelify adds the tunnel route and the DNS record.
  • a basic auth user and password (12 characters or more)
nginx then asks for that user and password before anything reaches the plugin. PostgreSQL and Redis have no web page, so they have no domain.

MinIO’s S3 API on a public domain

Image links and your apps’ S3 clients need MinIO’s S3 API without a password. Click More → S3 API on a domain and enter a domain like s3.example.com and a tunnel. It has no basic auth: MinIO’s own access keys decide who can write, and a bucket’s policy decides who can read. Set the console on another domain, like s3-ui.example.com, behind a password. Both show on MinIO’s card.

Back up plugins

Plugins back up with your databases, to your backup storage:
  • Back up on the card saves one copy now.
  • A database backup schedule lists the plugins (plugin:postgres, plugin:minio, …). All databases includes them.
PostgreSQL is saved with pg_dumpall, MySQL with mysqldump, and MongoDB with mongodump --archive. Redis, MinIO, and Vault are saved as a gzipped copy of their data volume.
Plugin backups are restored by hand: download the copy, then load it with psql for PostgreSQL, or unpack it into the plugin’s data volume while the plugin is stopped.

Start, stop, logs, uninstall

  • Start, Stop, and Restart run in the background.
  • Logs shows the last lines of the plugin’s containers, with passwords blanked.
  • Uninstall asks you to type the plugin’s name. It stops and removes the containers, deletes the data volumes, removes its domain, and unlinks every website.

From an AI agent

The MCP server has list-plugins, install-plugin, plugin-status, unseal-vault, and link-plugin. None of them ever returns a password, token, or unseal key.