paueron/orbitpage repository overview

⁠OrbitPage - Open-source, self-hosted link-in-bio and public page builder

Create a link-in-bio, digital business card, portfolio, venue page, or small-business microsite - and self-host it with Docker.

Quick start⁠ · Features⁠ · Documentation⁠ · Contributing⁠ · Security⁠

OrbitPage is a free, MIT-licensed Linktree alternative for building link-in-bio pages, digital business cards, portfolios, creator profiles, venue menus, event pages, and small-business websites. It combines a visual editing dashboard with responsive public rendering, built-in SEO and analytics, an Express backend, SQLite, and local file storage. No external database is required.

This repository is the self-hosted edition. The optional managed service is available at orbitpage.com⁠, but its control plane, billing, managed storage, and hosted-only features are not part of this repository.

⁠Why OrbitPage

• Own the stack and the data. Run one Docker container with SQLite and local storage, on your server or homelab.
• Edit visually. Manage content, design, menus, subpages, privacy, analytics, and publishing from the responsive dashboard.
• Publish more than a list of links. Combine profiles, media, contact details, events, maps, menus, calls to action, and focused subpages.
• Ship a discoverable public page. Configure canonical URLs, Open Graph and Twitter cards, Schema.org data, sitemaps, robots directives, QR codes, and consent-aware analytics.

⁠Contents

• Why OrbitPage⁠
• Quick start⁠
• What you can build⁠
• Dashboard workspaces⁠
• How it runs⁠
• First run⁠
• Configuration⁠
• Data and backups⁠
• Production checklist⁠
• Development⁠
• Documentation⁠
• Security and contributing⁠

⁠Quick start

⁠Docker image (recommended)

OrbitPage publishes one multi-architecture Linux image for amd64 and arm64 on Docker Hub and GitHub Container Registry. Docker automatically selects the matching image for the host. The commands below use Docker Hub:

sudo install -d -m 0700 /etc/orbitpage
sudo install -d -m 0750 /var/lib/orbitpage
printf 'NODE_ENV=production\nPORT=8080\nDATA_DIR=/app/data\nJWT_SECRET=%s\n' \
  "$(openssl rand -hex 32)" | sudo tee /etc/orbitpage/orbitpage.env >/dev/null
sudo chmod 0600 /etc/orbitpage/orbitpage.env

sudo docker pull paueron/orbitpage:latest
sudo docker run -d --name orbitpage \
  --restart unless-stopped \
  --env-file /etc/orbitpage/orbitpage.env \
  -p 8080:8080 \
  -v /var/lib/orbitpage:/app/data \
  --security-opt no-new-privileges:true \
  paueron/orbitpage:latest

Open the public page at http://localhost:8080⁠, the dashboard at http://localhost:8080/dashboard/profile⁠, and the health check at http://localhost:8080/health⁠.

The same multi-architecture image is available as ghcr.io/paoloronco/orbitpage:latest. The latest and main tags follow the newest commit whose complete CI and native amd64/arm64 smoke tests passed; sha-<commit> pins that build. For production, use an immutable version tag from GitHub Releases⁠. The unless-stopped policy restarts OrbitPage after failures and host reboots while respecting an explicit stop; use always only when an explicit stop must not survive a Docker daemon restart.

See the complete Docker deployment procedure⁠ for image selection, Compose, verification, updates, backups, and rollback.

⁠Docker Compose (local evaluation)

1. Clone the repository.
2. Start the local evaluation service:

docker compose up -d

The tracked Compose file contains a public placeholder secret and is only for local evaluation on a trusted machine. Do not expose it to a network. For production, use the protected env-file Compose procedure⁠; never commit a real secret or put it in a docker run -e argument.

⁠One-command Linux install

On a clean x86-64 Debian 12/13 or Ubuntu 22.04/24.04 server, VM, or LXC:

curl -fsSL https://raw.githubusercontent.com/paoloronco/OrbitPage/main/install.sh | sudo bash

The installer automates the same Docker deployment, generates a private JWT secret, persists application data, starts OrbitPage, and installs the orbitpage management command.

For a Proxmox VE 8+ host, use the dedicated host-to-LXC installer instead:

curl -fsSL https://raw.githubusercontent.com/paoloronco/OrbitPage/main/install-pve.sh | bash

Do not run the Linux guest installer directly on a Proxmox host. See Deployment⁠ for supported options, static networking, image pinning, backups, updates, and removal.

⁠Run from source

Requirements:

• Node.js ^20.19.0 or >=22.12.0
• npm
• Git

git clone https://github.com/paoloronco/OrbitPage.git
cd OrbitPage/app
npm ci
npm run install:server
export JWT_SECRET="$(openssl rand -hex 32)"
export DATA_DIR="$PWD/.orbitpage-data"
npm run start

The production-style source run is available at http://localhost:3001⁠.

⁠What you can build

⁠Public pages and content

• A main public page plus focused subpages with independent slugs, titles, descriptions, and blocks.
• Link, internal OrbitPage navigation, text, heading, separator, image, native video, social, contact, map, event, callout, and consent-aware embed blocks, with presets for media, scheduling, and forms.
• Venue menus with locale, sections, one-level subsections, products, variants, images, prices, and availability.
• Per-block visibility, ordering, scheduling, icons, cover media, calls to action, and layout controls.
• Responsive public rendering for mobile, laptop, and desktop layouts.

⁠Identity and design

• Creator, company, and studio profile structures.
• Profile image or logo, shape and size, favicon, social profiles, browser title, SEO description, and footer.
• Ready-made themes plus colors, typography, spacing, surfaces, borders, radius, shadow, blur, and per-card overrides.
• Live preview using the same public renderer.
• Dashboard localization in 14 languages with Arabic RTL layout.

⁠Publishing and discovery

• A unified Publish workspace for QR codes, sitemap state, and discovery files.
• Screen and print QR presets with PNG and SVG downloads.
• Canonical URL, Open Graph, Twitter Card, Schema.org, and noindex controls.
• Generated sitemap.xml.
• Editable robots.txt, llms.txt, humans.txt, ai.txt, security.txt, and safe custom text endpoints.

⁠Operations, privacy, and security

• Built-in self-hosted click and CTA counters, plus optional GA4 integration on the public page.
• Consent controls, policy links, Google Consent Mode, and optional external CMP integration.
• Complete or selective JSON backup and restore.
• Upload quotas, validated image and video uploads, and unused-media cleanup.
• Multiple dashboard users, scoped permissions, password management, and TOTP two-factor authentication.
• Health checks, persistent local data, Docker support, and additive SQLite migrations.

⁠Dashboard workspaces

The current dashboard keeps related work together:

Dashboard routes are stable, including /dashboard/profile, the Content destinations /dashboard/content/link, /dashboard/content/menu, /dashboard/content/shop, and /dashboard/content/pages, plus /dashboard/ai, /dashboard/theme, and /dashboard/publish. Legacy routes such as /admin, /dashboard/content, and the old Links, Pages, Menu, and Access paths remain compatibility aliases.

Read the dashboard guide⁠ for the complete route map and editing workflow.

⁠How it runs

Browser
  ├─ public OrbitPage
  └─ /dashboard/* React workspace
           │
           ▼
      Express application
       ├─ internal dashboard API
       ├─ SQLite database
       └─ local uploads

Repository layout:

app/
  src/                  React + TypeScript frontend
  server/               Express backend and SQLite
  packages/page-schema/ Shared page-data schemas
  e2e/                  Playwright browser tests
docs/                   User and operations guides
scripts/                Installer and repository helpers
.github/                CI, release, and image workflows
Dockerfile              Canonical production image

See app/README.md⁠ for application development boundaries.

⁠First run

1. Open the public URL. A fresh instance shows Under construction and is excluded from indexing and analytics.
2. Open /dashboard/profile.
3. Review the runtime, SQLite, storage, frontend, and session checks.
4. Create the password for the fixed first username, admin.
5. Choose the primary public-page slug.
6. Complete setup and follow the dashboard guide.

The administrator, slug, and starter profile are created atomically. Existing installations created before slug-based setup remain backward compatible.

⁠Configuration

The essential production settings are:

For AI provider settings, cleanup controls, rate limiting, HTTPS, base paths, CORS, reset recovery, and build-time variables, use the complete Configuration reference⁠.

⁠Data and backups

Everything that must survive a restart belongs under DATA_DIR:

orbitpage.db
uploads/

Persist /app/data in Docker. Back up the database and uploads together before upgrades or restores. Never commit a database, database backup or sidecar, uploads, logs, environment file, or real user content.

The dashboard can create complete or selective JSON exports. A selective export does not replace a consistent infrastructure backup. Follow the verified backup and restore runbook⁠, copy recovery archives off-host, and test a restore periodically.

⁠Production checklist

1. Keep a stable, long, random JWT_SECRET in a protected env file or secret store.
2. Persist DATA_DIR or /app/data.
3. Put OrbitPage behind trusted HTTPS.
4. Set PUBLIC_SITE_URL to the final public origin.
5. Enable TOTP for privileged users under Dashboard > Account.
6. Create a verified off-host backup and complete a restore drill before relying on it.
7. Verify /health and the public, dashboard, login, edit, and upload paths after deployment.
8. Set SEO_INDEXING=false on staging and private instances.

Read Deployment⁠ before configuring a reverse proxy, base path, cloud platform, update, or rollback.

⁠Development

From app/:

npm ci
npm run install:server

Run the API and frontend in separate terminals:

npm run server:dev
npm run dev

Quality checks:

npm run lint
npm run test:unit
npm run build
npm run test:e2e:chromium

See Development⁠ and CONTRIBUTING.md⁠ before opening a pull request.

⁠Documentation

Start from the task-oriented documentation index⁠.

The self-hosted Express API is an internal boundary used by the bundled dashboard, not a stable external SDK. Read the self-hosted API boundary⁠. The separate OrbitPage community node for n8n⁠ connects to the managed Automation API; it does not expose the bundled self-hosted API as a public contract.

⁠Security and contributing

Report suspected vulnerabilities privately through a GitHub Security Advisory⁠ or the contact in SECURITY.md⁠. Do not open a public issue for an unpatched vulnerability.

Issues and focused pull requests are welcome. Read CONTRIBUTING.md⁠ for setup, checks, compatibility expectations, and the contribution workflow. Participation follows the Code of Conduct⁠.

OrbitPage's open-source edition is available under the MIT License⁠.