this post was submitted on 26 Feb 2026
264 points (96.5% liked)

Selfhosted

57238 readers
468 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

  7. No low-effort posts. This is subjective and will largely be determined by the community member reports.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] Kernal64@sh.itjust.works 1 points 5 days ago (1 children)

What was your secret to get it working? I've been trying to get it running for 2 weeks following the official guide. I'm able to create an admin user via the CLI, but when I try to go to any of the subdomains I've created, I either get a 404 or the TLS handshake fails to complete. The people behind ESS are very clear that they do not offer any support and I haven't been able to find an answer to this problem anywhere.

[–] UnpledgedCatnapTipper@piefed.blahaj.zone 2 points 5 days ago (1 children)

Ok, so that sounds like either a DNS issue or a reverse proxy issue. Did you configure your domain/subdomains to point to the public IP address of where you're setting things up? Are you using the reverse proxy in the guide or do you already have a reverse proxy and you're adding ESS domains to it? Did you configure port forwarding on your router?

I have had issues with accessing my locally hosted services via domain name while on the same network. My router doesn't like to route internal traffic back to its own WAN port. Can you access it from something on a different network (cellular data)?

[–] Kernal64@sh.itjust.works 1 points 1 day ago (2 children)

Sorry for the delayed response, things have been wildly busy for me.

I did configure my domains as instructed, and they do resolve to the expected IP address. I don't have an already existing reverse proxy, so I was just following along with what the guide was telling me to do. That said, this may be the issue, because I don't recall seeing any specific set up for the included reverse proxy and I've been through that guide 3 times. I haven't configured port forwarding on my router since I'm using a Hetzner VPS for this, but I did make sure to open up the required ports on the firewall.

Also, the way to include additional config files tripped me up like crazy for a good few hours, and then how to format them tripped me up for even longer, for options they don't have examples for (like automatically joining any new accounts to a room, for example).

If you've got specific options you're trying to set, I'm happy to help if I can. The documentation is atrocious for this bit, so if you're not a kubernetes pro (I am definitely not) it is confusing!

[–] UnpledgedCatnapTipper@piefed.blahaj.zone 1 points 1 day ago (1 children)

Alright that gives me a good idea what your working with.

I am running it along side some other projects, so I already had a reverse proxy set up, so I didn't look closely at the other parts of the guide in that section.

If you want to be able to use this server for other hosting in the future, you may want to set up a reverse proxy. I can give some advice about that if you're interested!

In your case, if the only thing you ever want to host on this box is Matrix, you don't need a reverse proxy. You should be able to do the steps here and it should result in a working deployment.

It looks like that should give you a tls.yaml file, which you need to include when issuing the helm command to deploy everything. This one:

helm upgrade --install --namespace "ess" ess oci://ghcr.io/element-hq/ess-helm/matrix-stack -f ~/ess-config-values/hostnames.yaml <optional additional values files to pass> --wait

You need to make sure that in the section, you include:

-f ~/ess-config-values/tls.yaml

So your command would be this, if you have no additional yaml files, and if you do, simply put "-f path/to/file" at the end, right before the "--wait":

    helm upgrade --install --namespace "ess" ess oci://ghcr.io/element-hq/ess-helm/matrix-stack -f ~/ess-config-values/hostnames.yaml -f ~/ess-config-values/tls.yaml --wait
[–] Kernal64@sh.itjust.works 1 points 3 hours ago (1 children)

Thanks for your help! It's very much appreciated. I was thinking I might want to use this VPS for an occasional OwnCast stream and as a SyncThing target, so it sounds like I'll need a reverse proxy. Any recommendations on something relatively easy to use? I've seen people mention ngnix, traefik, caddy and a few others, but I'm not sure which would integrate nicely with ESS. Also, I appreciate the heads up about the helm commands. Definitely important info to have!

You're welcome!

I use https://nginxproxymanager.com/ for my reverse proxy. It doesn't exactly integrate with ESS, but it's not super challenging to set up proxy hosts for the domains (you can specify multiple domain names in one Proxy Host if they all point to the same host/port).

I find it nice because I can manage it via a web portal, but it's on my home LAN. Depending on how you access your VPS this might be less convenient than using one of the other options, but I don't have much experience with the others.

I set up Let's Encrypt certs to automatically renew for the Matrix domains, pointed them all at the ESS host server and port, and then enabled Websockets Support. That last bit is critical, or things will simply not work correctly, especially calls. image