| title | Deployment |
|---|---|
| description | Choose how to run Mantis and expose a public trigger URL. |
The mantis needs a public-reachable URL. Pick the option that matches where you want to run it.
| What runs where | Public URL via | When this is right | |
|---|---|---|---|
| A. Local Docker | Your machine | None (localhost only) | Development, testing, air-gapped use |
| B. Docker + Tailscale | Your machine | Tailscale Funnel (*.ts.net) |
Personal mantis on a laptop / home server, works behind CGNAT |
| C. Docker + Cloudflare Tunnel | Your machine | Your own domain on Cloudflare | You already have a Cloudflare-hosted domain and want SSO via Cloudflare Access |
| E1. Railway | Railway (long-running) | *.up.railway.app or custom |
Set-and-forget; the worker runs natively with no cron config |
| E2. Fly.io | Fly (long-running) | *.fly.dev or custom |
Same shape as Railway, with broader regional choice |
| E3. Render | Render (long-running) | *.onrender.com or custom |
Same shape; free tier exists but cold-starts after 15 min idle |
For any public option, also see public edge limits for rate-limit and DDoS guidance, and backups for Postgres backup strategies.
Both B and C give you a public HTTPS URL for mantis running on your own hardware. The differences:
| Tailscale (B) | Cloudflare (C) | |
|---|---|---|
| Need to own a domain? | No, uses *.ts.net |
Yes, must be on Cloudflare |
| Setup steps | ~3 | ~5 |
| Dashboard SSO | Tailnet membership / ACLs in split mode | Cloudflare Access, one app and one policy |
The stateless mantis-edge Cloudflare Worker is a separate concept. It runs on Cloudflare's edge with no DB, and URLs decrypt purely from the Worker's secret. See mantis-edge deployment for the Worker setup.