Most posts about self‑hosting or indie projects drift into marketing speak. This one doesn’t. This is simply how I build and ship MindMapVault — the real workflow, the real tools, and the real reasons behind them.
This chapter is about ownership. Not in the corporate sense, but in the “I want to understand and control my own tools” sense. If you’re building something solo, or experimenting with automation, or trying to level up your confidence as a developer, this might resonate.
Why I Self‑Host My Git Forge
I run a self‑hosted Forgejo instance on my NAS with a runner. Not because GitHub or GitLab are bad — they’re great — but because I know myself.
Sometimes I move fast.
Sometimes I forget things.
Sometimes I push .env values straight into a repo.
Keeping the forge and runner physically close to me solves that. It gives me:
- control (no accidental secrets leaving my network)
- convenience (fast CI, predictable environment)
- confidence (I can experiment without worrying about leaking something)
And honestly? I just like the project. Forgejo is clean, lightweight, and fits the “local‑first” philosophy behind MindMapVault.
What I use it for
- another Git remote
- CI/CD workflows
- automated checks
- release builds
- experiments that I don’t want to run on a public cloud
It’s not about paranoia. It’s about craftsmanship. When you own the forge, you own the workflow.
Automation Makes You a Better Developer (Especially Solo)
When you’re working alone, automation isn’t a luxury — it’s a survival mechanism.
My Forgejo runner handles:
- type‑checking
- offline‑parity checks
- desktop build pipelines
- release asset uploads
- version bumping
- changelog generation
This means I can focus on the actual product instead of the glue.
And here’s the interesting part:
AI tools like GitHub Copilot Agents changed the way I commit.
Not by writing code for me — but by making me more disciplined:
- commits became larger but more coherent
- changelogs became more structured
- documentation became essential, not optional
- project planning became a real process, not a TODO file
When AI helps you move faster, the meta‑work (planning, documenting, structuring) becomes even more important. Otherwise you drown in your own velocity.
Production Hosting: Simple, Predictable, Mine
I host production on a Czech community VPS: vpsFree.cz. It’s stable, affordable, and gives me the right balance of control and simplicity.
The setup is intentionally minimal:
- backend (Rust)
- Postgres
- MinIO
- Cloudflare Tunnel
- Cloudflare Pages for the frontend
All running via a single docker-compose.yml, all credentials in a single .env file. when you are ready zyou just run docker compose up -d and in 6 seconds the new version, fix is up in production.
# ─────────────────────────────────────────────────────────────────────────────
# MindMapVault — local dev compose
# Manages the backend plus the local RustFS and PostgreSQL dependencies.
# Use `docker compose up` / `docker compose up --build`.
# ─────────────────────────────────────────────────────────────────────────────
services:
minio:
image: minio/minio:latest
container_name: mindmapvault-minio
restart: unless-stopped
networks:
- cryptmind
ulimits:
nofile:
soft: 65535
hard: 65535
command: server /data --console-address ":9001"
environment:
MINIO_ROOT_USER: ${MINIO_ACCESS_KEY:-minioadmin}
MINIO_ROOT_PASSWORD: ${MINIO_SECRET_KEY:-minioadmin}
ports:
- "${MINIO_API_PORT:-9000}:9000"
- "${MINIO_CONSOLE_PORT:-9001}:9001"
volumes:
- minio-data:/data
healthcheck:
test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:9000/minio/health/live >/dev/null || exit 1"]
interval: 10s
timeout: 5s
retries: 12
start_period: 10s
postgres:
image: postgres:16
container_name: mindmapvault-postgres
restart: unless-stopped
networks:
- cryptmind
ports:
- "${POSTGRES_PORT:-5432}:5432"
environment:
POSTGRES_USER: ${POSTGRES_USER:-postgres}
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
POSTGRES_DB: ${POSTGRES_DB:-cryptmind}
volumes:
- postgres-data:/var/lib/postgresql/data
healthcheck:
test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-postgres} -d ${POSTGRES_DB:-cryptmind}"]
interval: 10s
timeout: 5s
retries: 12
start_period: 10s
backend:
build:
context: .
dockerfile: backend/Dockerfile.local
container_name: mindmapvault-backend
restart: unless-stopped
networks:
- cryptmind
depends_on:
minio:
condition: service_healthy
mongodb:
condition: service_healthy
postgres:
condition: service_healthy
ports:
- "${BACKEND_PORT:-8090}:8090"
volumes:
- stoolap-data:/data
environment:
HOST: "0.0.0.0"
PORT: "8090"
MALLOC_ARENA_MAX: "2"
MALLOC_TRIM_THRESHOLD_: "131072"
MALLOC_MMAP_THRESHOLD_: "131072"
MALLOC_CONF: ${MALLOC_CONF:-background_thread:true,narenas:1,dirty_decay_ms:0,muzzy_decay_ms:0,metadata_thp:disabled}
DB_ENGINE: ${DB_ENGINE:-mongodb}
POSTGRES_DSN: postgresql://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@postgres:5432/${POSTGRES_DB:-cryptmind}
MINIO_ENDPOINT: http://minio:9000
MINIO_ACCESS_KEY: ${MINIO_ACCESS_KEY:-minioadmin}
MINIO_SECRET_KEY: ${MINIO_SECRET_KEY:-minioadmin}
MINIO_BUCKET: ${MINIO_BUCKET:-mindmapvault-maps}
MINIO_PUBLIC_ENDPOINT: ${MINIO_PUBLIC_ENDPOINT:-http://127.0.0.1:9000}
MINIO_REGION: ${MINIO_REGION:-us-east-1}
MINIO_PRESIGN_EXPIRY_SECS: ${MINIO_PRESIGN_EXPIRY_SECS:-3600}
JWT_SECRET: ${JWT_SECRET}
JWT_ACCESS_EXPIRY_SECS: ${JWT_ACCESS_EXPIRY_SECS:-900}
JWT_REFRESH_EXPIRY_SECS: ${JWT_REFRESH_EXPIRY_SECS:-2592000}
STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY:-}
STRIPE_PUBLISHABLE_KEY: ${STRIPE_PUBLISHABLE_KEY:-}
STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET:-}
STRIPE_PRICE_PAID_YEARLY_ID: ${STRIPE_PRICE_PAID_YEARLY_ID:-}
STRIPE_CHECKOUT_SUCCESS_URL: ${STRIPE_CHECKOUT_SUCCESS_URL:-https://mindmapvault.com/vaults}
STRIPE_CHECKOUT_CANCEL_URL: ${STRIPE_CHECKOUT_CANCEL_URL:-https://mindmapvault.com/vaults}
STRIPE_PORTAL_RETURN_URL: ${STRIPE_PORTAL_RETURN_URL:-https://mindmapvault.com/vaults}
DISABLE_APP_LOGIN_TURNSTILE: ${DISABLE_APP_LOGIN_TURNSTILE:-false}
ENABLE_DIAGNOSTICS_ROUTES: ${ENABLE_DIAGNOSTICS_ROUTES:-false}
ENABLE_PPROF: ${ENABLE_PPROF:-false}
PPROF_DURATION_SECS: ${PPROF_DURATION_SECS:-90}
CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:-http://localhost:5173,http://tauri.localhost,https://tauri.localhost}
RUST_LOG: ${RUST_LOG:-backend=info,tower_http=info}
healthcheck:
test: ["CMD-SHELL", "curl -sf http://localhost:8090/health || exit 1"]
interval: 15s
timeout: 5s
retries: 5
start_period: 10s
cloudflared:
image: cloudflare/cloudflared:latest
container_name: mindmapvault-cloudflared
restart: unless-stopped
command: tunnel --no-autoupdate run
depends_on:
backend:
condition: service_healthy
environment:
TUNNEL_TOKEN: ${TUNNEL_TOKEN}
networks:
- mindmapvault-network
volumes:
minio-data:
name: cryptmind-minio-data
postgres-data:
name: cryptmind-postgres-data
networks:
cryptmind:
name: cryptmind-network
then the docker ps looks like this:
CONTAINER ID NAME CPU % MEM USAGE / LIMIT MEM % NET I/O BLOCK I/O PIDS
468768ef5c79 mindmapvault-backend 0.00% 31.55MiB / 4GiB 0.77% 26.7MB / 4.73MB 0B / 0B 9
06c14906524a mindmapvault-postgres 0.00% 31.82MiB / 4GiB 0.78% 2.17MB / 28.7MB 0B / 0B 7
d52f573bcdef mindmapvault-minio 3.68% 86.56MiB / 4GiB 2.11% 3.65MB / 10.7MB 0B / 0B 13
27fcb47af8c7 mindmapvault-cloudflared 0.19% 16.31MiB / 4GiB 0.40% 132MB / 212MB 0B / 0B 13
No Azure.
No Firebase.
No vendor lock‑in.
Just a clean, reproducible, auditable setup.
Open‑Sourcing the Local‑First Version
And when I have what to show then I pushed the FOSS version of MindMapVault here:
https://github.com/mindmapvault/mindmapvault-foss
It’s a local‑first, privacy‑focused, offline‑capable mind‑mapping desktop app.
- No cloud.
- No telemetry.
- No account.
If you review the code and see weak spots, please comment directly. I welcome criticism — it’s the only way a solo project grows.
GitHub Wiki & Pages — Free Tools Many Developers Underuse
The GitHub Wiki is a perfect home for these research notes once they mature.
It’s Markdown-native, versioned, and acts as a clean documentation hub.
I even use it as a lightweight blog for deeper technical posts.
GitHub Pages hosts the interactive MindMapVault demo — free, fast, and frictionless.
Together, Wiki + Pages + Actions + runners make GitHub a full publishing and documentation platform.
What this gives you for free:
- Wiki for architecture docs
- Pages for interactive JS demos
- Actions for CI
- Runners for automation
- A complete developer ecosystem
Research First — Write It Down Before You Build
Before implementing any feature, I create a small Markdown mockup in research/ or notes/.
It’s not a spec — just a quick outline of goals, constraints, and what “good” looks like.
This keeps the project coherent and gives Copilot the right context.
Even a rough sketch prevents future architectural mistakes.
For MindMapVault, every complex feature starts as a simple .md file.
Why this helps:
- clarifies goals early
- reduces rework
- gives Copilot better context
- documents decisions
- keeps ideas discoverable
Goals
- Allow arbitrary file attachments (many per map) without transferring plaintext to server in encrypted mode.
- Use per-map buckets or per-map prefixes to keep attachments discoverable and scannable.
- Lazy-download UX: file blobs are fetched only when the user requests/downloads them.
- Provide secure presigned URLs for direct client upload/download while the server maintains metadata, access control, and versioning.
High-level design
- Storage layout (S3/MinIO recommended):
- Bucket-per-map: `cryptmind-<map-id>` OR
- Single bucket + prefix: `maps/<map-id>/attachments/<attachment-uuid>` (preferred if many buckets are undesirable)
- Object keys: `attachments/<attachment-uuid>/<sanitized-filename>` or `attachments/<timestamp>-<uuid>-<name>`
- Versioning: enable S3 versioning where possible; store `s3_version_id` in DB on complete.
Security & encryption
- Encrypted mode (server never sees plaintext or DEKs):
- Client-side: encrypt attachment (AES-GCM or AES-SIV) on the client using the same client-side DEK management as mindmaps.
- Send `encrypted: true` and minimal `encryption_metadata` (algorithm, non-secret IV/nonce, tag if detached) to server when initiating upload. Do NOT send DEKs.
- Server returns presigned upload URL or accepts proxied upload; backend stores opaque object and writes metadata to DB.
- On download, server issues presigned GET; client downloads then decrypts locally.
- Plaintext mode: files uploaded without encryption; server may perform virus scanning or content checks per policy.
Database schema (maybe)
- attachments
- id: UUID (PK)
- map_id: UUID (FK)
- node_id: UUID (nullable) — attach to a node/note if applicable
- name: TEXT (original filename)
- sanitized_name: TEXT
- content_type: TEXT
- size_bytes: INTEGER
- s3_key: TEXT
- s3_version_id: TEXT (nullable)
- uploaded_by: UUID (user id)
- uploaded_at: TIMESTAMP
- encrypted: BOOLEAN
- encryption_meta: JSON (algorithm, iv, tag — non-secret values only)
- checksum_sha256: TEXT (optional)
- status: ENUM('pending','available','deleted')
Example: A Real Changelog Entry
This is what a typical release looks like now — structured, explicit, and automation‑friendly:
**[0.3.27] – 2026‑05‑03**
**Changed**
- Editor UX / Node Icons — Restored full node icon workflow in `MindMapEditor.tsx`:
- toolbar icon picker
- context‑menu icon action
- keyboard shortcut `I`
- inline icon rendering
- multi‑select icon toggling
- help panel + status bar hints
- Editor Components — Added reusable icon picker infrastructure (`MindMapIconPicker.tsx`, `DynamicLucideIcon.tsx`).
- CI / Release Automation — Modernized `.github/workflows/desktop-build.yml`:
- upgraded actions
- replaced deprecated upload steps
- switched to Corepack for `pnpm`
- kept `$GITHUB_OUTPUT` usage
**Validation**
- `pnpm exec tsc --noEmit` → clean
- `node scripts/check_frontend_offline_parity.mjs` → passed
This is the kind of detail that makes automation reliable and future‑you grateful.