Deploy Appsmith with the appsmith-internal-tools template

Stand up Appsmith Community Edition, an open-source low-code platform for internal tools, on a single Quake AI instance using the validated OpenTofu template appsmith-internal-tools. You apply the template, sign up the first admin account, point a domain at the host and serve it over HTTPS, connect a datasource, build a minimal internal app, and invite a teammate.

Appsmith keeps your team's internal tools on infrastructure you own. You run it yourself; this is a self-hosted tool you operate, not a managed multi-tenant service.

Prerequisites#

You need:

• OpenTofu 1.6.0 or later (or Terraform 1.6.0 or later) installed locally.
• Your OpenStack credentials sourced into the shell (source openrc.sh). See the OpenStack CLI guide.
• An SSH keypair that already exists in your project. Record its name for the key_name variable.
• A copy of the appsmith-internal-tools template directory from the template reference page.
• A domain you can point at the instance, for the HTTPS step.

Step 1: Apply the template#

Copy the template's example variables file and set key_name:

cp terraform.tfvars.example terraform.tfvars

key_name = "YOUR_KEY_NAME"

Initialize, preview, and apply:

tofu init
tofu plan
tofu apply

OpenTofu provisions a private network, a router, a security group, a block volume mounted at /var/lib/docker, an instance, and a floating IP. On first boot, cloud-init installs Docker Engine, generates APPSMITH_ENCRYPTION_PASSWORD and APPSMITH_ENCRYPTION_SALT into /opt/appsmith/.env, and starts the fat container: no held-back service waits on manual configuration.

Read the outputs and record floating_ip and app_url:

tofu output

Step 2: Sign up the first admin account#

Open app_url from the previous step (http://YOUR_FLOATING_IP:8080). The raw app port is restricted to the private network by default; tunnel over SSH if you have not opened app_allowed_cidr to your workstation.

Sign up with an email and password. The first account to sign up becomes the workspace admin.

Step 3: Point a domain at the host and serve HTTPS with Caddy#

Serving Appsmith over a stable HTTPS domain is recommended before you invite teammates or connect production datasources.

1. Create a DNS A record for your domain (for example tools.example.com) pointing at YOUR_FLOATING_IP. Follow How to point a domain at a Quake AI resource. Wait until it resolves:

dig +short tools.example.com

1. SSH to the instance and create /opt/appsmith/Caddyfile:

tools.example.com {
  reverse_proxy 127.0.0.1:8080
}

1. Add Caddy to /opt/appsmith/docker-compose.yml:

services:
  caddy:
    image: caddy:2
    restart: unless-stopped
    network_mode: host
    volumes:
      - /opt/appsmith/Caddyfile:/etc/caddy/Caddyfile
      - caddy_data:/data
volumes:
  caddy_data:

1. Restart the stack:

cd /opt/appsmith
sudo docker compose up -d

For background on certificates, see How to issue and auto-renew a TLS certificate with Let's Encrypt.

Step 4: Connect a datasource#

1. Inside your workspace, select New > Datasource.
2. Choose REST API for the quickest connection, or point at a self-managed PostgreSQL instance if you already run one: fill in the host, port, database name, and credentials.
3. Select Test to confirm the connection, then Save.

Step 5: Build a minimal internal app#

1. Create a new app and drag a Table widget onto the canvas.
2. Bind the table to a query against the datasource you connected (for example a SELECT query or a GET request).
3. Add a Button widget wired to a second query (for example an UPDATE or a POST request) that runs against the row selected in the table.
4. Select Deploy to publish the app to your workspace.

Step 6: Invite a teammate#

1. Go to Settings > Members > Invite.
2. Enter a teammate's email and assign them a role (App Viewer, Developer, or Administrator) scoped to what they need.
3. Appsmith emails an invite they accept with their own credentials, if you configured outbound email, or you share the workspace URL directly.

What you built#

• Applied the appsmith-internal-tools template to provision a network, security group, data volume, instance, and floating IP, with the fat container started automatically by cloud-init
• Signed up the first admin account
• Served Appsmith over HTTPS by pointing a domain at the floating IP and routing it through a Caddy reverse proxy
• Connected a datasource and built a minimal internal app with a table and one action
• Backed up the encryption password and salt before connecting any real datasource
• Invited a teammate

Scope of this deployment#

This template runs a single-VM Appsmith host, not a managed low-code cloud. The instance is CPU-only and runs in one region, and the app server, embedded MongoDB, and embedded Redis all run inside the same container. You operate the instance, Docker, Appsmith, and the data volume yourself: back up /appsmith-stacks (the encryption keys especially), patch the image, and watch resource use as concurrent users grow.

Next steps#

• Appsmith internal-tools template: the template reference, parameters, and resource map
• Self-managed PostgreSQL template: a datasource to pair with Appsmith for a database-backed internal app
• Security hardening checklist: tighten SSH access and exposure before you connect production datasources

Clean up#

When you no longer need the deployment, destroy everything the template created:

tofu destroy

Then remove the DNS A record you created in step 3, if you added one. Because Appsmith and all of its persistent state live on the instance and its attached volume, tofu destroy removes them along with the infrastructure. Export any apps you want to keep first: Settings > Export application writes an app definition to a local JSON file.