Production checklist

Checklist

Served over HTTPS behind a reverse proxy.
PUBLIC_APP_URL is the exact public origin (https://…, no trailing slash).
CORS_ORIGIN set to the public origin rather than *.
BETTER_AUTH_SECRET is long, random, stored as a secret, and never changes.
MongoDB is not exposed to the internet, and has authentication enabled.
Automated MongoDB backups, with a tested restore.
A single app instance (see Scaling).
Health check on GET /api/health.
Access restricted if the instance is private (sign-up is open by default).

Reverse proxy

Imprime listens on plain HTTP (port 3023). Terminate TLS in front of it and forward everything — including /.well-known/* — to the app. For the MCP endpoint, disable response buffering so streamed responses go through immediately.

Caddy
nginx

imprime.example.com {
  reverse_proxy localhost:3023 {
    flush_interval -1
  }
}

Caddy obtains and renews certificates automatically.

server {
    listen 443 ssl http2;
    server_name imprime.example.com;

    ssl_certificate     /etc/letsencrypt/live/imprime.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/imprime.example.com/privkey.pem;

    client_max_body_size 12m;   # images are uploaded as base64 JSON (10 MB limit)

    location / {
        proxy_pass http://127.0.0.1:3023;
        proxy_http_version 1.1;
        proxy_set_header Host              $host;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 60s;     # PDF rendering is capped at 30 s
    }

    location /api/mcp {
        proxy_pass http://127.0.0.1:3023;
        proxy_http_version 1.1;
        proxy_set_header Host              $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_buffering off;
        proxy_read_timeout 1h;
    }
}

Scaling

Two pieces of state live in the memory of the process:

MCP sessions (closed after 30 minutes of inactivity);
MCP preview renders, held briefly so the link can be opened.

They are lost on restart and are not shared between instances. Run one instance and scale it vertically (more CPU speeds up PDF rendering). If you must run several, use sticky sessions so a client always reaches the same instance. The REST export endpoint is stateless and unaffected.

Backups

MongoDB holds everything: accounts, API keys, templates, variables and images.

# Daily dump (cron), keeps 14 days
docker compose exec -T mongodb mongodump --archive --gzip > /backups/imprime-$(date +%F).gz
find /backups -name 'imprime-*.gz' -mtime +14 -delete

Restore with mongorestore --archive --gzip --drop < file.gz. Test it regularly.

Updating

git pull
docker compose up -d --build

Read the release notes / commit log before updating: the project is under active development.