#6370·webstudio

[Docs] Plain Docker self-hosting needs much clearer documentation for internal LAN deployments

Author: DW-MediaLabCreated Sep 12, 2026Updated Sep 12, 2026

Summary

A builder deployed only on an internal LAN is significantly harder to configure than the current documentation suggests.

Accessing the builder directly through a LAN IP over HTTP resulted in:

500 Invariant failed

with server logs reporting a cross-origin request being blocked.

To get a working internal-only installation I ultimately needed:

  1. Internal DNS for webstudio.home.dw
  2. Internal HTTPS using Caddy
  3. A trusted internal CA on the client
  4. Wildcard DNS for *.webstudio.home.dw
  5. A wildcard TLS certificate for *.webstudio.home.dw

The wildcard is required because project canvases use hostnames such as:

p-<project-id>.webstudio.home.dw

Suggested change

Add a dedicated section for internal/on-premises installations explaining that:

  • production-mode builder access effectively requires HTTPS
  • project canvas previews require wildcard DNS
  • project canvas previews require wildcard TLS
  • *.builder-domain must route to the builder app
  • direct LAN-IP access is not a realistic production configuration

The current 500 Invariant failed response is also very difficult to diagnose.