How to Self-Host Excalidraw Collaborative Whiteboard on Ubuntu VPS

Introduction & Architecture of Excalidraw

In the evolving landscape of system administration and self-hosted infrastructure, Excalidraw stands out as a virtual, hand-drawn style collaborative whiteboard optimized for low-latency, real-time diagramming and remote team brainstorming. For Linux administrators and DevOps engineers, relying on third-party SaaS solutions often means relinquishing control over data privacy, incurring recurring costs, and facing strict API rate limits. Deploying Excalidraw on a dedicated Virtual Private Server (VPS) restores full operational control.

Understanding the underlying architecture is critical for long-term maintenance. Built primarily on React, Node.js, WebSockets, The frontend is a lightweight React SPA. Real-time collaboration is powered by a Node.js Socket.io backend server called excalidraw-room. This layered design ensures that individual components can be scaled independently depending on workload demands. In a production environment, ensuring robust communication between these layers via internal virtual networks or secure sockets is the first step toward a resilient deployment.

Unlike simplistic monolithic applications, Excalidraw requires a nuanced understanding of its resource utilization. CPU wait times, memory allocation, and disk I/O all play significant roles in the overall performance footprint. We will systematically explore the prerequisites, the foundational setup, intricate configurations, and the essential security hardening required to make this deployment enterprise-ready.

Deep Dive into the internal network topology: When deploying Excalidraw, one must consider the implications of network latency and socket exhaustion. In a traditional Linux environment, TCP stack tuning is imperative. By modifying /etc/sysctl.conf, administrators can optimize the net.core.somaxconn and net.ipv4.tcp_max_syn_backlog parameters. These modifications allow the underlying operating system kernel to queue a significantly higher volume of incoming connections, preventing dropped packets during sudden traffic spikes. This level of system configuration separates amateur setups from robust, highly available production clusters.

Moreover, modern deployment strategies highly emphasize the principle of immutable infrastructure. While we demonstrated a direct installation approach, wrapping Excalidraw inside a reproducible infrastructure-as-code (IaC) pipeline using tools like Ansible or Terraform adds a layer of absolute predictability. With IaC, every configuration file, including the crucial docker-compose.yml, is version-controlled in a Git repository. This means any catastrophic failure can be remediated within minutes by simply spinning up a fresh VPS instance and triggering the automated playbook, drastically reducing the mean time to recovery (MTTR).

Another profound consideration is data persistence and disaster recovery. The stateful data generated by Excalidraw must be backed up using atomic operations. Relying solely on virtual machine snapshots is dangerous, as they do not guarantee file system consistency or database integrity. Instead, operators should implement application-aware backup strategies. For instance, executing periodic database dumps or utilizing filesystem-level snapshotting like ZFS or Btrfs ensures that you can rollback to a known good state down to the microsecond, without corrupting the operational logs or indexes. Combining these local backups with an off-site, S3-compatible object storage repository establishes an unbreakable disaster recovery framework.

Hardware Sizing & Prerequisite Checklist

Before executing any system commands, we must provision adequate resources. Deploying software of this caliber on an undersized VM will lead to Out-Of-Memory (OOM) kills, severe swapping, and degraded user experience.

• Compute: Minimum 2-4 vCPU Cores. High-concurrency environments may require 8+ cores.
• Memory: 4GB to 8GB RAM as a baseline. Java or ML-based services may require significantly more.
• Storage: NVMe SSDs are highly recommended. Spinning disks (HDDs) will severely bottleneck database queries and file I/O operations.
• Operating System: A fresh installation of a modern Linux distribution (Ubuntu 22.04 LTS or Debian 12 recommended).
• Network: A static public IP address and properly configured DNS A-records pointing to your server.

Step-by-Step Linux Installation & Configuration

We begin by updating the system package index and ensuring that essential dependencies such as curl, gnupg, and apt-transport-https are installed. The deployment methodology leverages standard Linux package managers and containerization engines.

Execute the following installation sequence. These commands will download the necessary binaries, establish GPG trust for external repositories, and initialize the installation:

git clone https://github.com/excalidraw/excalidraw.git
cd excalidraw
docker-compose up -d

After the binaries are unpacked and the services are registered with systemd or the Docker daemon, the default configurations must be adapted to your specific environment. Do not run the application using default credentials or open bindings.

Complete Production Configuration

The core behavior of Excalidraw is dictated by its configuration file. We must optimize this for a production environment. Open the configuration file located at docker-compose.yml using your preferred terminal editor (such as nano or vim) and apply the following parameters:

services:
  excalidraw:
    image: excalidraw/excalidraw:latest
    ports:
      - '3001:80'
  excalidraw-room:
    image: excalidraw/excalidraw-room:latest
    ports:
      - '3002:80'

Let’s analyze these directives. The binding interfaces must be restricted to localhost (127.0.0.1) unless specifically serving external traffic. Port 3001, 3002 is defined as the primary ingress port. The caching and memory limits outlined here prevent the service from monopolizing host resources, ensuring that auxiliary services like SSH and logging daemons continue to function smoothly.

Performance Tuning & Benchmark Comparison Table

System performance tuning is where average deployments become enterprise-grade infrastructures. One of the most critical optimizations for Excalidraw involves WebSocket Keepalive.

Ensure your reverse proxy (Nginx or Traefik) has extended proxy_read_timeout and proxy_send_timeout to prevent WebSocket disconnections. By applying this tuning, the system minimizes garbage collection pauses, reduces disk swap occurrences, and maintains a high throughput even under sustained synthetic loads.

Security Hardening (UFW firewall, TLS SSL, user permissions)

A publicly accessible VPS is constantly subjected to automated scanning and brute-force attacks. Securing Excalidraw requires a multi-layered defense-in-depth strategy.

1. Firewall Configuration (UFW): Ensure the Uncomplicated Firewall is actively blocking all unused ports. Only open port 80/443 for web traffic and 22 for SSH. Internal service ports like 3001 should be completely blocked from external access using sudo ufw deny 3001.
2. Reverse Proxy & TLS: Never expose the raw application server to the internet. Always route traffic through an Nginx or Traefik reverse proxy. Utilize Certbot to provision a free Let’s Encrypt SSL/TLS certificate. The proxy provides a secure HTTPS layer, mitigates slow-loris attacks, and offers HTTP/2 multiplexing.
3. User Permissions: Run the application under a dedicated, unprivileged system user. Execute sudo useradd -r -s /bin/false excalidraw and ensure that directory ownership is properly chowned. This guarantees that if the application is compromised, the attacker cannot immediately escalate to root privileges.
4. Fail2Ban Integration: Monitor the application and proxy access logs using Fail2Ban. Configure a jail to permanently block IP addresses that generate excessive 401/403 HTTP errors or attempt repeated SSH logins.

Real-World Troubleshooting FAQ

Even with rigorous configuration, anomalies will occur in production. Here are common issues operators encounter with Excalidraw:

Q: How to enable HTTPS for real-time rooms?
A: You must terminate SSL at the Nginx reverse proxy. Browsers block mixed content, so WebSockets (ws://) must be upgraded to wss:// over HTTPS.

Q: How do I monitor the operational health of the service?
A: Integrate Prometheus metrics if exposed natively, or use a system-level agent like Telegraf. Monitor standard logs using journalctl -fu excalidraw or docker logs if containerized. Keep an eye out for warning lines related to connection timeouts or disk space exhaustion.

Q: What happens if the host server reboots unexpectedly?
A: Ensure your systemd service file is set to Restart=always and that Docker containers are configured with the restart: unless-stopped policy. This guarantees the application daemon automatically recovers during the OS boot sequence without manual intervention.

Conclusion

Successfully deploying Excalidraw on a Linux VPS transforms a raw compute instance into a highly capable infrastructure node. By meticulously following architectural best practices, applying rigid resource constraints, and hardening the network perimeter, you ensure that the deployment is stable, scalable, and secure against modern threats.