<Home>
Start here
← All templates
application / DEPLOYMENT PRESET

Xem

Self-hosted email marketing workspace with independently bundled or existing PostgreSQL, Redis and S3-compatible storage.

Before you start

  • Stable HTTPS origin and initial administrator credentials
  • Private PostgreSQL and Redis, each bundled or an existing service with its current credentials
  • Private media storage: bundled MinIO with a dedicated persistent volume, or an existing S3-compatible bucket
  • Keep database, media objects, RSA encryption key and signing secrets together in protected backups
  • Configure your own sending provider inside Xem before sending mail; no managed sending, SMTP submission, MCP, payments or hosted AI service is included
  • After deployment, open Custom domains, verify the site URL hostname, and apply routing and TLS before using login or callbacks

Configuration that needs your attention

Only Caddy is public. It sends /api/v1, public forms and tracking to the private API; /api/auth stays on the frontend. Browser API calls use this installation without a per-domain image build.

The preset enables S3_DISABLE_ACL so backend uploads omit object ACLs. Bundled MinIO stays private; browser reads use short-lived signed URLs through the installation proxy. Existing storage keeps its own bucket policy.

PostgreSQL, Redis and storage choices are independent. Existing services are not provisioned or deleted by Hakopod; Xem applies database migrations at startup.

Initial administrator settings are used only for an empty installation. Keep the RSA private key stable; losing it can make encrypted provider credentials unreadable.

The bundled Redis has a 64 MiB no-eviction budget and PostgreSQL permits 100 connections. The upstream API pool allows 300 connections and worker concurrency is fixed at 10; review capacity for your workload.

Managed sending, SMTP submission, notifications, hosted assistants, MCP and payments are excluded. A user-owned sending provider must be configured separately.

Bundled MinIO uses a dedicated account and creates only the private xem-files bucket. The console and administrative API have no public route. Single-instance media storage is not redundant; keep independent backups.

Required secrets

Configure these scoped secrets during deployment review in your Hakopod installation. Secret values stay out of the application TOML.

  • database-password
  • redis-password
  • jwt-secret
  • frontend-session-secret
  • encryption-private-key
  • admin-password
  • storage-user
  • storage-password

This preset needs a public site URL. Set the correct origin before starting the application.

Use this preset

  1. Open the Catalog in your own Hakopod dashboard and select Xem.
  2. Choose the project, environment, and application name. Set the required values and secret references.
  3. Review the generated configuration, resource requests, networking, and storage plan.
  4. Deploy, then inspect readiness and logs. Configure backups for persistent data before relying on the service.

Read the upstream setup documentation ↗

View native TOML and setup notes ↗

Pinned container image

theboringhumane/xemgo:sudo@sha256:b35d7d53fa9999af023fe21eb26853443b7877e399f954eeffbd5dd68c091f25

The catalog pins this image for reproducibility. Review upstream updates and compatibility before changing it.