Tome of Finite Knowledge

Self-hosting Overleaf CE+

7 min read

Overleaf CE+, or Community Edition Plus, is an open-source fork of Overleaf CE with additional features added which bring functionality much closer to the licensed Overleaf Pro self-hosted edition.

See also

The main repo for Overleaf CEP is here: https://github.com/yu-i-i/overleaf-cep

I’m doing this because a long, long time ago I was a Sharelatex member before they were absorbed into Overleaf, and am not happy with how much Overleaf is starting to lock behind a paywall even for members who’ve been a member longer than Overleaf has owned the online editor.

Installation

Docker Compose approach

Notes on using a straight docker compose approach instead of the Overleaf toolkit.

  • Mongodb must be v8.0 or newer
  • Needs a redis container

See also

Overleaf container

services:
  overleaf-cep:
    container_name: overleaf-cep
    # seems like there's no `latest` tag.  Check the latest version yourself!
    image: overleafcep/sharelatex:6.1.2-ext-v4.1
    restart: unless-stopped
    env_file:
      - overleafcep.env
    ports:
      - 8091:80
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock
      - /opt/docker/overleaf/data:/var/lib/overleaf
      - /opt/docker/overleaf/logs:/var/log/overleaf

In the overleafcep.env file:

##################################
# mongodb settings

# This URL should be comprised of:
# 1. mongodb://
# 2. `user`: your mongodb username
# 3. `password`: your mongodb password
# 4. `mongo`: the hostname of the database server
# 5. `overleaf`: the name of the database in the server
OVERLEAF_MONGO_URL=mongodb://user:password@mongo/overleaf

# redis host.  Seems you have to set it twice, dunno why
OVERLEAF_REDIS_HOTS=olcep-redis
REDIS_HOST=olcep-redis

####################################
# redis settings

# a few general settings...
# your reverse proxy host
VIRTUAL_HOST=overleaf.example.com
# generate a secret with `openssl rand -base64 32`
OVERLEAF_INVITE_TOKEN_SECRET="abcd...1234"

####################################
# settings which determine the texlive docker images to use for compiles

# this prefix is prepended to the image names
TEX_LIVE_DOCKER_IMAGE_ROOT=ghcr.io/dante-ev

# *default* image to use for sandboxed compiles
TEX_LIVE_DOCKER_IMAGE=texlive:latest

# all available options for users to pick from for compile envs
ALL_TEX_LIVE_DOCKER_IMAGES=texlive:latest, texlive:2026-08-01

# what names should be displayed in the UI for those images
ALL_TEX_LIVE_DOCKER_IMAGE_NAMES=TeXLive Latest, TeXLive 2026.08

# extra flags you want to pass to the compiler
TEX_COMPILER_EXTRA_FLAGS=-shell-escape

####################################
# sandbox compile settings

# enable sandboxed compiles
SERVER_PRO=true
DOCKER_RUNNER=true
SANDBOXED_COMPILES=true
SIBLING_CONTAINERS_ENABLED=true
SANDBOXED_COMPILES_SIBLING_CONTAINERS=true

# where the sibling containers' volumes are bind-mounted to
# these two have to be mapped to inside the /var/lib/overleaf/data 
# folder as you mapped it in the host overleaf-cep service file
SANDBOX_COMPILES_HOST_DIR_COMPILES="/opt/docker/overleaf/data/data/compiles"
SANDBOX_COMPILES_HOST_DIR_OUTPUT="/opt/docker/overleaf/data/data/output"

See also

https://github.com/yu-i-i/overleaf-cep/wiki/Extended-CE:-Sandboxed-Compiles

Setting username, password, and database

See the MongoDB setup section where you set/get these three points from.

Pulling docker images

For sandboxed compiles, it appears that you have to manually pull the docker images you set in ALL_TEX_LIVE_DOCKER_IMAGES before you start the service. For example, sudo docker pull texlive/texlive:latest-full.

Redis setup

Compose:

services:
  redis:
    container_name: olcep-redis
    image: redis:6.2
    restart: unless-stopped
    volumes:
      - ./redis_data:/data

That’s all — no environs here! Just make sure the container_name value is set in the REDIS_HOST and OVERLEAF_REDIS_HOST environs for both MongoDB and Overleaf containers.

MongoDB setup

Compose:

services:
  mongo:
    container_name: mongo
    image: mongo:8.0
    restart: unless-stopped
    env_file:
      - mongo.env
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./config:/etc/mongo
      - /opt/docker/ol-mongo/data:/data/db
      - /opt/docker/ol-mongo/log:/var/log/mongodb
    command: --replSet rs0 --auth --bind_ip_all --keyFile /etc/mongo/keyfile
    healthcheck:
      test: echo 'db.stats().ok' | mongosh localhost:27017/test --quiet
      interval: 10s
      timeout: 10s
      retries: 5

In the associated mongo.env:

MONGO_INITDB_DATABASE=overleaf
MONGO_INITDB_ROOT_USERNAME=admin
MONGO_INITDB_ROOT_PASSWORD=password

Not these credentials!

The username and password you set here are NOT the ones you want to use in the mongodb URL for Overleaf! Those will come later. This is, however, the right database name to use.

Ensure the mongodb compose maps /etc/mongo to a local directly. In that directory, create:

config/
    keyfile
    mongod.conf

To generate keyfile:

openssl rand -base64 756 > keyfile

In mongod.conf:

replication:
  replSetName: "rs0"

Set permissions:

$ chown 999:999 keyfile
$ chmod 600 keyfile

Once you start the container for the first time, you’ll need to log in and configure the database and user for Overleaf.

$ sudo docker exec -it mongo bash
# use the MONGO_INITDB_ROOT_USERNAME and _PASSWORD creds here
$ mongosh admin --username admin --password password
# "rs0" needs to match the replSetName in your mongod.conf; `mongo:27017` needs to match your db server hostname and port
admin> rs.initiate({ _id: "rs0", members: [ { _id: 0, host: "mongo:27017" } ] })
admin> use overleaf
# the 'user' and 'password' here VVV are the ones to use for the mongodb url in overleaf
admin> db.createUser({ user: 'user', pwd: 'password', roles: [ { role: "dbOwner", db: "overleaf" } ] })

Tip

The user created on the last step in that snippet has the credentials to use for the OVERLEAF_MONGO_URL env (in this example, it would be mongodb://user:password@mongo/overleaf).

First-time setup

Admin account creation

Once the service is running, browse to overleaf-server.example.com/launchpad and you should be prompted to set up the first admin account. Once complete, you’ll be redirected to the login page; log in, and you should land on the admin panel.

See also

https://docs.overleaf.com/on-premises/user-and-project-management/user-management#administrators

Advanced features

Sandboxed Compiles

Example config and env files are already set up for sandbox compiles. For problems, see:

along with the other troubleshooting section.

SSO / OIDC

See Authentik & Overleaf CE+.

Confirm admin rights

Confirm that you’re able to see the “Admin” button in the top-right of the Overleaf UI; if it doesn’t show up, your admin-selection environs are wrong.

Troubleshooting

Log location

Check whichever host directory you mapped /var/log/overleaf to. If you pasted the above compose file, that’ll be /opt/docker/overleaf/logs. Within that folder, you should find various log files.

  • clsi.log: Common LaTeX Service Interface log. Contains HTTP 404 errors about containers not being found.

Images not available

  • Overleaf Pro texlive images (the ones on quay) are not publicly available (overleaf proprietary). Instead, try one of the following:
    • danteev/texlive
    • ayaka-notes/texlive-full

Pull images manually

sudo docker pull <image> for the images you want on the host. Ex sudo docker pull ghcr.io/dante-ev/texlive:latest, then recompile.

  • Write a small script (and hook it to the compose file) to hack-job parse the env file, find these images to pull, and pull them.

Cannot find file ‘main.tex’

  • Confirm the bind mounts for the main container and the sandbox CLSI container are the same location on host
    • In the compose file, you mapped x/y/z:/var/lib/overleaf. Make sure that
      • SANDBOX_COMPILES_HOST_DIR_COMPILES is set to x/y/z/data/compiles
      • SANDBOX_COMPILES_HOST_DIR_OUTPUT is set to x/y/z/data/output
  • Confirm permissions are set properly for all volumes
    • “All volumes” especially means the /var/lib/overleaf mount (inside the container. In my example, it’s mapped to /opt/docker/overleaf/data on the host side).
    • sudo chown www-data:www-data -R ...
    • sudo chmod 755 -R ...
  • Make sure the sandbox compile containers are running with the right user
    • Add TEXLIVE_IMAGE_USER=www-data to the env file (I saw this in a GitHub comment; didn’t fix it for me, but nonetheless)

See also

https://github.com/yu-i-i/overleaf-cep/issues/66

Finding the right environ

The biggest hurdle to this, by far, was my adamant refusal to touch the overleaf toolkit. The toolkit reads in an RC-like configuration file, then generates Docker files and env files with the appropriate settings for each of the microservices on the fly. It stands to reason that config values in the RC file are mangled on their way to becoming environs.

Largely, this seems to not be the case — the values set in the config file are in fact just passed through to container environs. The trick is finding them. Hunt around at the links below:

Graph View

Backlinks