All documentation
Deploy and extend15 min

Self-host WantasticCore

Deploy the all-in-one open-source control plane and verify day-two operations.

Outcome

A persistent deployment with TLS, database, Redis, portal, Winbox and WireGuard services.

Before you start

  • Linux with Docker
  • A domain
  • TCP 80/443/8291 and UDP 51820
  • NET_ADMIN permission

Start the all-in-one container

Docker · sh
docker run -d --name wantastic \
  --cap-add NET_ADMIN --restart unless-stopped \
  -p 80:80 -p 443:443 -p 8291:8291 -p 51820:51820/udp \
  -v wantastic-data:/var/lib/wantastic \
  ghcr.io/wantastic-app/wantastic:latest
Operational note: Persist /var/lib/wantastic; it holds config, Postgres, Redis, certificates and logs.

Complete the setup wizard

  1. 1Open the host and verify the bootstrap certificate context.
  2. 2Set console, Winbox and WireGuard hostnames.
  3. 3Add a Let's Encrypt email after public DNS points to the host.
  4. 4Create a unique super-admin password.
  5. 5Keep the default-deny firewall unless the host firewall is managed separately.

Publish DNS and firewall rules

  • 80/tcp: ACME HTTP-01 and redirect.
  • 443/tcp: portal, console and setup.
  • 8291/tcp: Winbox multiplexer.
  • 51820/udp: WireGuard.
Operational note: The container cannot open a cloud firewall, upstream NAT or security group. Configure every layer.

Verify and back up

  1. 1Store dumps off-host.
  2. 2Back up configuration and certificate state.
  3. 3Test restore and renewal before relying on the deployment.
Useful checks · sh
docker logs -f wantastic
docker exec wantastic s6-svstat /run/service/postgres
docker exec wantastic s6-svstat /run/service/wantastic-core
docker exec wantastic su-exec postgres pg_dump -U wantastic wantastic > backup.sql

Verify the result

Console has a trusted certificate.
Postgres and core report up.
A remote WireGuard handshake succeeds.
Winbox/browser tools work externally.
An off-host backup completes.

Common issues

Let's Encrypt stays on bootstrap TLS.
Likely cause

DNS is wrong or TCP 80 is blocked.

Fix

Verify public A/AAAA, open port 80 at every layer and retry after propagation.

Portal works but devices do not connect.
Likely cause

UDP 51820 is blocked or forwarded incorrectly.

Fix

Test cloud, host and upstream firewall/NAT separately; TCP does not prove UDP.

Data disappears after recreation.
Likely cause

The data volume is missing or the wrong volume is mounted.

Fix

Stop writes, find the previous named volume and reattach it before creating new state.

Continue with

Security modelReduce public exposure, credential sprawl and lateral reach while keeping operations practical.Device onboardingChoose the correct client, create a unique identity and validate the first handshake.Common issues and fixesStart from the symptom, isolate the failing layer and verify recovery at the target.
Self-host WantasticCore | Wantastic Docs