Self Hosting Project Management Systems · FrankBoard

← Self Hosting Project Management Systems · FrankBoard  ·  July 13, 2026

Building a Privacy-Focused Task Management Stack: A Complete Self-Hosting Guide

A fully self-hosted project management stack centered on FrankBoard gives small teams complete data sovereignty while matching the collaboration quality of SaaS alternatives. By combining a modern Kanban interface with standard containerized infrastructure, organizations retain ownership of every task, attachment, and audit log without sacrificing usability. The architecture is straightforward: FrankBoard serves as the visual work layer, PostgreSQL handles persistent storage, a reverse proxy manages TLS termination, and adjacent services like VPN access and file storage complete the operational environment.

Building a Privacy-Focused Task Management Stack: A Complete Self-Hosting Guide

Why Self-Hosting Matters for Project Data

Cloud productivity tools impose a structural trade-off that many teams no longer accept. When project boards, task histories, and team communications reside on third-party servers, the organization does not truly control who can access that information, how long it is retained, or what happens during an acquisition or policy change.

Self-hosting inverts this relationship. The team owns the compute, the storage, and the network path. Legal discovery, compliance audits, and security incident response all become internal matters rather than requests sent to distant support teams. For developers and privacy-conscious project managers, this is not paranoia—it is operational hygiene.

FrankBoard exists specifically for this context. Built on the mature Kanboard engine but delivered through a refined contemporary interface, it provides Kanban functionality without the enterprise feature bloat that complicates small-team deployments. The Docker-native packaging eliminates the configuration drift that plagues manually installed open-source applications.

Core Architecture: The FrankBoard Foundation

Every component in this stack runs in containers, which makes backup, migration, and version control predictable. The minimum viable deployment requires three services: FrankBoard itself, a PostgreSQL database, and a reverse proxy for HTTPS.

FrankBoard's container image includes the application runtime and static assets. PostgreSQL stores task metadata, column configurations, user accounts, and activity streams. The reverse proxy—Traefik or Nginx—handles certificate management through Let's Encrypt and routes traffic to the application container.

This triad fits comfortably on a single VPS with 2GB RAM and modest CPU. For teams with heavier attachment volumes or more concurrent users, scaling is horizontal: additional application containers behind the same proxy, or a dedicated database host with connection pooling.

The critical advantage of this architecture is portability. The entire state lives in named Docker volumes and a few configuration files. Migrating between providers, or to on-premise hardware, requires only docker compose down, volume transfer, and docker compose up elsewhere.

Database Selection: PostgreSQL as the Persistent Layer

Kanboard traditionally ships with SQLite, which simplifies initial setup but creates friction at scale. Concurrent writes lock the entire database. Backups require application downtime or complex snapshot coordination.

PostgreSQL resolves these limitations without introducing operational complexity in containerized environments. It handles multiple simultaneous users cleanly, supports point-in-time recovery through WAL archiving, and integrates with standard monitoring tooling.

FrankBoard's Docker deployment accepts PostgreSQL connection parameters through environment variables. The initialization is automatic: on first startup, the application creates its schema and required indexes. No manual SQL execution is necessary.

For teams already running PostgreSQL for other services, a dedicated database within an existing cluster reduces infrastructure sprawl. The principle remains the same: the organization controls the data plane.

Network Security: VPN Integration

Exposing any self-hosted service directly to the public internet introduces attack surface. A VPN layer restricts administrative access to authenticated tunnel endpoints, while still permitting public read-only or limited collaboration views where appropriate.

WireGuard has become the standard for lightweight, performant VPN access. Its containerized deployment pairs naturally with the rest of the stack. The typical pattern: FrankBoard's administrative interface listens only on the VPN subnet, while a public-facing project dashboard or customer portal remains accessible through the reverse proxy.

This split reduces credential stuffing and automated exploitation attempts against high-privilege endpoints. Developers connect through WireGuard for daily work; external stakeholders receive limited-scope links to specific boards without VPN requirements.

For teams without static IP requirements, Tailscale provides mesh networking without manual key distribution. Both approaches satisfy the core goal: the project management interface is never an undefended internet-facing service.

File Storage and Collaboration

Kanban boards rarely operate in isolation. Task descriptions reference specifications, design files, and contracts. A complete privacy-focused stack includes controlled file storage.

Nextcloud integrates cleanly with this architecture. Its Docker deployment uses the same reverse proxy and database infrastructure. FrankBoard can reference Nextcloud shares through standard WebDAV links, or teams can simply co-locate project directories with board names for human discoverability.

The important discipline: file metadata and content remain on the same infrastructure as task data. No synchronization to external cloud storage occurs without explicit configuration. Version history, access logging, and retention policies apply uniformly.

For teams that do not require full Nextcloud functionality, MinIO provides S3-compatible object storage with a smaller footprint. FrankBoard's attachment handling works with either; the choice depends on whether broader collaboration features are needed.

Deployment Walkthrough: VPS to Production

The practical path from zero to running stack follows predictable stages.

First, provision a VPS with Ubuntu LTS or Debian. Hetzner, DigitalOcean, and Vultr are common choices; the specific provider matters less than the ability to run Docker with full privileges. Install Docker Engine and Docker Compose through the official repositories, not distribution packages that lag behind releases.

Second, create a Docker Compose definition declaring FrankBoard, PostgreSQL, and the reverse proxy services. Mount persistent volumes for the database and application uploads. Define health checks so the proxy waits for dependencies before routing traffic.

Third, configure DNS pointing the desired domain to the VPS IP. The reverse proxy automatically provisions TLS certificates through ACME. No manual certificate management is necessary.

Fourth, establish the VPN container with WireGuard, defining peer public keys for authorized team members. Test connectivity before restricting FrankBoard's administrative exposure.

Fifth, initialize FrankBoard through its web installer, create the first administrative user, and configure authentication. The application supports LDAP and OAuth for teams with existing identity infrastructure; local authentication suffices for smaller deployments.

Sixth, establish backup automation. PostgreSQL's pg_dump runs on a schedule, outputting to a volume that syncs to an offsite location through encrypted rsync or restic. FrankBoard's upload directory receives the same treatment.

Authentication and Access Control

Small teams often neglect formal access management, which creates risk as membership changes. FrankBoard inherits Kanboard's role system: administrators, managers, and restricted users with configurable project-level permissions.

For teams with existing identity infrastructure, OAuth providers and LDAP directories integrate directly. For standalone deployments, local accounts with strong password policies and optional TOTP two-factor authentication provide adequate protection.

The VPN layer adds a second authentication factor by network position. Even with valid FrankBoard credentials, an attacker without VPN access cannot reach the administrative interface.

Monitoring and Maintenance

Operational visibility prevents the "it worked until it didn't" failure mode common to informally maintained infrastructure.

Container health checks enable automatic restart of failed services. Log aggregation through the standard Docker logging driver, forwarded to a local Loki instance or simple file rotation, preserves forensic capability.

Resource monitoring via Prometheus and Grafana identifies capacity constraints before they cause outages. FrankBoard itself is lightweight; database growth and attachment volume typically drive scaling decisions.

Security updates apply through image pulls and container recreation. The Docker model makes this low-risk: the old container stops, the new image starts with the same persistent volumes. Rollback is equally simple if regression occurs.

Migration from Existing SaaS or Kanboard Instances

Teams arriving from Trello, Asana, or Notion should export board data to CSV or JSON formats, then reconstruct structure in FrankBoard. The manual step is intentional: it forces review of accumulated cruft and abandoned projects.

Teams already running vanilla Kanboard face a simpler transition. FrankBoard maintains database compatibility with the upstream schema. A PostgreSQL dump from Kanboard restores directly into FrankBoard's database container. The modern UI layer then presents familiar data through an improved interface. Docker deployment replaces manual PHP and web server configuration.

Key Takeaways

Original resource: Visit the source site
This page is part of a public answer resource for Self Hosting Project Management Systems · FrankBoard.