Gramps Web — Proxmox LXC¶

Gramps Web is a self-hosted web frontend for the Gramps genealogy application. It runs as a set of Docker containers (web app, API, and a Celery worker for background tasks) and is served over HTTPS via Tailscale, making it accessible from any device on your tailnet without exposing it to the public internet.

1. Create the LXC Container¶

In the Proxmox web UI, create a new CT with these settings:

RAM: 1 GB
CPU: 2 cores
Network: DHCP
Features: Enable nesting — required for Docker to run inside the LXC

2. Base OS Setup¶

In the LXC shell:

apt update && apt upgrade -y && apt install curl -y

3. Install Docker¶

Gramps Web is distributed and run entirely via Docker Compose — there are no native packages to install. The official Docker install script handles adding the apt repo, GPG key, and installing the engine in one step.

curl -fsSL https://get.docker.com -o get-docker.sh
sh get-docker.sh

4. Create Admin User¶

adduser jake

When prompted for a password, enter your preferred password. Then add jake to the docker and sudo groups:

usermod -aG docker jake
usermod -aG sudo jake

Apply the new group membership and switch to the user:

newgrp docker
su - jake

5. Set Up Gramps Web via Docker Compose¶

mkdir gramps-web && cd gramps-web
nano docker-compose.yml

Copy the compose template from the Gramps Web quickstart guide. The template defines containers for the web frontend, the API backend, Redis, and a Celery worker for background tasks like media processing and tree imports.

6. Tailscale — TUN Device Access¶

Tailscale is used here for two things: putting the LXC on your private tailnet so it's reachable from other devices, and providing TLS certificates via tailscale serve so the app is served over HTTPS without a separate reverse proxy or public cert setup.

Unprivileged LXCs don't have access to /dev/net/tun by default, which Tailscale needs to create its virtual network interface. On the Proxmox host, edit the container config (replace 107 with your VMID):

nano /etc/pve/lxc/107.conf

Add at the bottom:

lxc.cgroup2.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file

Reboot the LXC:

# From Proxmox host
pct stop 107 && pct start 107

7. Install and Connect Tailscale¶

Back in the LXC console:

curl -fsSL https://tailscale.com/install.sh | sh

Start Tailscale and authenticate:

tailscale up

Copy the URL displayed into a browser and log in to your Tailscale account.

In the Tailscale admin console, make sure MagicDNS is enabled, and enable HTTPS.

8. Configure Tailscale Serve (HTTPS)¶

tailscale serve acts as a local reverse proxy — it terminates TLS using a certificate issued by Tailscale's CA, then forwards traffic to Gramps Web running on port 5050. This means the app is accessible at https://gramps.<tailnet>.ts.net with a valid cert, no manual certificate management needed.

tailscale serve --bg --https=443 http://localhost:5050

You should see:

Serve started and running in the background.
To disable the proxy, run: tailscale serve --https=443 off

Gramps Web is now accessible over HTTPS on your tailnet.