Read this first: the four things that actually go wrong when self-hosting

[DuarteSantos8]

Nearly every self-hosting problem reported so far is one of four things. If you're stuck, start
here — the full guide is docs/SELF_HOSTING.md.

1. No passkey prompt at all

You're on http:// or on a bare IP address. Passkeys need a real hostname over HTTPS — there is
no way around this, it's a browser rule, not an openGym one. localhost works for a quick local
try; anything else needs a domain and a certificate. Cloudflare Tunnel (no open ports) or Caddy
(automatic Let's Encrypt) are both about five minutes, see section 3 of the guide.

2. "verification failed" when logging in

RP_ID and ORIGIN in your .env don't exactly match the URL in your address bar.

RP_ID=gym.example.com          # hostname only, no scheme, no port, no trailing slash
ORIGIN=https://gym.example.com # full origin

Restart after changing them. Two things people trip over: www. counts as a different hostname,
and changing RP_ID later invalidates every passkey already registered — they were bound to
the old one.

3. Behind a reverse proxy and it half-works

The proxy has to pass the original Host through. If your proxy rewrites it, the browser sees
one origin and the API validates against another, and you land back in problem 2. Traefik, Caddy
and NPM all do the right thing by default; hand-written nginx configs are the usual culprit.

4. Exercise images/GIFs missing

They're not in the repo — they're ~146 MB fetched at runtime from the upstream dataset. Check
docker compose logs media, then re-run docker compose up -d or ./scripts/fetch-media.sh.

---

While you're here: back it up

Everything lives in ./data — profiles, passkeys, history:

tar czf opengym-backup-$(date +%F).tar.gz data/

Individual users can also export their own history as JSON from Settings → Data. Do this
before any update you're nervous about.

---

Still stuck? Reply here or open a new Q&A thread with: your reverse proxy, your RP_ID and
ORIGIN (these are not secrets — the contents of data/ are), the URL you're visiting, and what
docker compose logs api says. Please don't paste data/.

[mavproductions]

I registered my account/passkey on my computer with a password manager that supports passkeys. When trying to access it on my phone, the password manager companion app isn't an option for providing the passkey the desktop made.

After making my main account I disabled guests and configured invite only.

[JonathanSigemo]

IMO, the passkey requirement is overkill. When self-hosting this and accessing it through Tailscale, HTTPS shouldn't be necessary. Adding an alternative login method would make the project more accessible.