[Docs] Plain Docker self-hosting needs much clearer documentation for internal LAN deployments
Author: DW-MediaLabCreated Sep 12, 2026Updated Sep 12, 2026
Summary
A builder deployed only on an internal LAN is significantly harder to configure than the current documentation suggests.
Accessing the builder directly through a LAN IP over HTTP resulted in:
500 Invariant failedwith server logs reporting a cross-origin request being blocked.
To get a working internal-only installation I ultimately needed:
- Internal DNS for
webstudio.home.dw - Internal HTTPS using Caddy
- A trusted internal CA on the client
- Wildcard DNS for
*.webstudio.home.dw - A wildcard TLS certificate for
*.webstudio.home.dw
The wildcard is required because project canvases use hostnames such as:
p-<project-id>.webstudio.home.dwSuggested change
Add a dedicated section for internal/on-premises installations explaining that:
- production-mode builder access effectively requires HTTPS
- project canvas previews require wildcard DNS
- project canvas previews require wildcard TLS
*.builder-domainmust route to the builder app- direct LAN-IP access is not a realistic production configuration
The current 500 Invariant failed response is also very difficult to diagnose.
Source: webstudio-is/webstudio