Skip to main content
This page installs a self-hosted Floe on an Unraid server from two templates, Floe-Server and Floe-Client, and covers the three ways to reach them: direct LAN ports, one domain, or two hostnames. Floe is published as two containers because the web client and the signaling server have separate network and security settings. Install both templates for a working instance. Both templates pull the same images the Docker Compose stack uses, so nothing is built on your server. See Container images.

The short version

Download the two templates into Unraid’s user templates folder, then add Floe-Server and Floe-Client from Add Container. Start with direct LAN access: it needs no proxy, and each template then holds the other’s address. Move to a domain later, once the LAN install works.

Before you start

Start with direct LAN access. It needs nothing but the two containers, and you can move to a domain later. The three layouts: The exact client origin matters in all three, because it is the origin the signaling server accepts browser connections from.

Add the templates to Unraid

Floe’s templates are not in Community Applications, so a search on the Apps tab does not find them. Put the two template files in Unraid’s user templates folder yourself, then start each container from Add Container. These steps are for Unraid 6.10.0 and later, which has no field for a template address.
1

Open a terminal on the server

In the Unraid web interface, open the web terminal, shown as >_ at the top right. SSH as root works too.
2

Download both templates

Save them in the user templates folder on the boot device:
Terminal
Unraid lists every .xml file in that folder. The my-<Name>.xml form is the name Unraid gives a template it saves, so your settings go back into the same file.
3

Open Add Container

Open the Docker tab and click Add Container. The tab is there only while Docker is enabled in Unraid’s settings.
4

Pick the template

In the Template list at the top of the page, pick Floe-Server under User templates. Unraid fills the form from the template.
5

Fill in the fields and apply

Set the fields as the section for your layout below describes, then click Apply. Unraid pulls the image and creates the container. Repeat from Add Container for Floe-Client.

Direct LAN installation

1

Install Floe-Server

Add the Floe-Server container first, from its template: see Add the templates to Unraid. Keep Signaling Port at 3001 unless that host port is already used.Set Client URL to the URL that browsers will use for the client. With the default client port, an example is:
Client URL
Keep Trusted Proxy Count at 0 for direct access.
2

Install Floe-Client

Add the Floe-Client container from its template the same way. Keep Web UI Port at 3000 unless it conflicts with another container.Set Signaling Server URL to the full origin browsers use to reach Floe-Server, including the scheme and the host port, with no trailing slash:
Signaling Server URL
That value is the container’s SOCKET_URL. The client hands it to the browser from GET /api/config on every page load, so changing it later takes a container restart and never a rebuild. See How the client finds the server.
3

Open and test Floe

Open the Floe-Client Web UI in its own browser tab. Floe refuses to be shown inside another page, so a dashboard that embeds apps in a frame shows a blank frame for it. Confirm that the badge at the top right of the card reads Ready, not Offline, then create a link and open it in a second browser or device.
The two templates hold each other’s addresses, so a port change is never a one-sided edit. Change the Floe-Client host port and Floe-Server Client URL has to carry the new port. Change the Floe-Server host port and Floe-Client Signaling Server URL has to match it. A mismatch looks like a client that loads perfectly and never connects.

One domain behind a reverse proxy

Put both containers behind a single hostname and there is no signaling address to keep in sync at all. Leave Floe-Client Signaling Server URL empty, which is how the template ships it, and the browser talks to whatever origin served the page. A Floe-Client added from an earlier copy of the template holds the placeholder http://YOUR-UNRAID-IP:3001 there, as its value and as its default, and Unraid puts a default back whenever its field is empty. On such a container turn on Advanced View, click Edit beside the field, and clear Default Value as well. This layout needs path rules in your proxy, written by hand. If your proxy makes that hard, the two-hostname layout below needs none.
1

Proxy the domain to Floe-Client

Send https://floe.example.com to the Floe-Client host port for everything except the signaling paths.
2

Proxy the signaling paths to Floe-Server

Send /socket.io/, /ws, /api/, and /health to the Floe-Server host port.
3

Keep the config route on the client

Send /api/config back to the client, as an exception to the /api/ rule above.
4

Set Client URL to the domain

Set Floe-Server Client URL to https://floe.example.com.
5

Set Trusted Proxy Count

Set Floe-Server Trusted Proxy Count to the number of proxy hops, which is 1 for a single reverse proxy.
6

Clear Signaling Server URL

Leave Floe-Client Signaling Server URL empty. On a container added from an earlier copy of the template, clear its Default Value too.
Step 3 is the one people miss, because nothing shows when it goes wrong. Copy-pasteable Caddy and nginx configurations for exactly this routing, and a check that shows where /api/config went, are in Run behind one domain.

Two hostnames behind a reverse proxy

Use HTTPS for anything reachable outside your trusted LAN. Proxy the client and server separately, and enable WebSocket forwarding for the server.
1

Proxy the client hostname

Send the client hostname to the Floe-Client host port.
2

Proxy the signaling hostname

Send the signaling hostname to the Floe-Server host port.
3

Set Client URL to the client origin

Set Floe-Server Client URL to the public HTTPS client origin.
4

Count the proxy hops

Set Floe-Server Trusted Proxy Count to the number of proxy hops.
5

Set Signaling Server URL

Set Floe-Client Signaling Server URL to the complete public HTTPS server origin.
6

Keep the hostname in the Host header

Keep the hostname in the Host header when proxying the signaling hostname. The CLI and Floe Desktop connect to the signaling hostname, which is not your Client URL. The server lets them in by matching their Origin against Host, so a proxy that rewrites Host to the container address gets them refused with a 403.
For example:
Template values

The CLI and Floe Desktop

Both connect to the signaling server, so give them the Floe-Server address. On the direct LAN and two-hostname layouts the web client lives at a different address, and the share links both apps hand out have to carry it: See Use a self-hosted server.

TURN relay

The default configuration has no relay and works on many networks: it hands clients public STUN servers only. To support peers behind strict NAT or CGNAT, add a TURN relay. In the Floe-Server template, turn on Advanced View and fill in Cloudflare TURN Key ID and Cloudflare TURN API Token with a Cloudflare Realtime TURN key. You can also run coturn separately and fill in Self-hosted TURN Domain and Self-hosted TURN Secret instead. If that coturn has no TLS certificate, set Self-hosted TURN TLS to off. A Floe-Server added from a template older than 1.11.1 has no such field: add a Variable with the key TURN_TLS and the value off instead. See TURN relay. A request link lets someone send files to a Floe Desktop that waits for them. Request links stay off until a policy file turns them on.
1

Set the policy folder

In the Floe-Server template, turn on Advanced View and set Request Link Policy Folder to a folder on the server, such as /mnt/user/appdata/floe/policy. The template mounts it at /app/policy, read-only. Map the folder, not the file: an edit puts a new file in place of the old one, and a mount of the file alone keeps showing the old one.
2

Create the policy file

Put a file named policy.json in that folder containing {"requestLinks": true}. The server runs as the unprivileged user node, not as root, so that user has to be able to read the folder and the file. A folder and a file that every user can read work. A file it cannot read is logged as policy file unreadable, keeping previous policy, and request links stay off.
3

Name the file

Set Request Link Policy File to /app/policy/policy.json, then click Apply.
A Floe-Server added from a template older than 1.11.0 has neither field, and one from the 1.11.0 template has Request Link Policy File but no folder. Add what is missing: a Path that maps the folder to /app/policy read-only, and a Variable with the key POLICY_FILE. To turn request links off again, and for what the server logs, see Turn on request links. The page a sender opens shows Report this link only when the Floe-Client template’s advanced Request Link Report Email field holds an address you read. A Floe-Client added from a template older than 1.11.1 has no such field: add a Variable with the key REQUEST_REPORT_EMAIL instead. See Sending to a link on your server.

Other settings

The Floe-Server template has fields for the client URL, the proxy count, and the two connection limits (Maximum Connections Per IP and Maximum Open Connections Per IP). It also has the TURN options, the stats database (Upstash Redis REST URL and Upstash Redis REST Token), and the policy folder and file. Every field but the first two and Signaling Port shows only in Advanced View. Any other server variable in Configuration, such as MAX_TURN_REQUESTS_PER_IP, has no field: add a Variable with that key to Floe-Server. A Floe-Server added before the template gained Maximum Open Connections Per IP has no such field either: add a Variable with the key MAX_SOCKETS_PER_IP instead.

Container updates

Both templates follow the latest image tag, which changes only when Floe publishes a version tag. Use Unraid’s normal container update flow to pull a new release. The containers store no files or application settings in volumes, so there is no appdata directory to migrate. The one thing to keep is the policy folder, if you added one for request links. Update Floe-Client to 1.12.0 before Floe Desktop 1.1 reaches your users. Every request link Floe Desktop 1.1 and later makes holds a link key, and an older client reads that as an incomplete link. The Microsoft Store updates Floe Desktop on its own, and a container here moves only when you apply its update. See Keep the client and server on one version. To pin a version, change the tag at the end of each template’s Repository field, for example ghcr.io/jannskiee/floe-server:latest to ghcr.io/jannskiee/floe-server:1.12.1. Change both templates to the same version, because the client and the server should match. The tags you can use are in Container images.

If something goes wrong

Last modified on November 13, 2026