iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A self-hosted Trilium Notes server should not be placed directly on the internet with its port simply exposed. Keep the application behind a properly configured HTTPS reverse proxy, leave Trilium authentication enabled, reduce container and application privileges, and protect the complete data directory with tested backups. The exact commands and screens depend on whether you installed Trilium with Docker, a package, or another supported method, so use the paths and setting names below as a hardening checklist and confirm version-specific details in the documentation for your installed release.
Start with an accurate deployment inventory
Hardening fails when you do not know which component is accepting connections, where Trilium stores its files, or which authentication layer is actually in use. Record the following before changing settings:
- The Trilium version and image or package tag.
- The installation method: Docker, a host package, or another supported deployment.
- The complete data-directory path and the user that owns it.
- Every listening address and port, including the local Trilium port and any public proxy port.
- The reverse proxy, if present, and where TLS certificates are terminated.
- Whether Trilium uses its local password system, OpenID Connect (OIDC), or disabled authentication.
- Any host firewall, router port-forward, VPN, or access-control rule that can reach the service.
Trilium configuration can be supplied through environment variables or config.ini; when both are present, environment variables take precedence. Keep a written copy of the effective values so an upgrade or container replacement does not silently change the security posture.
Keep authentication enabled for remote access
An internet-reachable Trilium instance must require authentication inside Trilium. Setting noAuthentication=true disables authentication and bypasses TOTP as well. That option may be appropriate for a strictly localhost-only instance or a tightly controlled environment in which another component is deliberately responsible for access control, but it is not a safe convenience setting for a server reachable from the internet.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Choose one of Trilium’s supported sign-in models and test it from a separate device before exposing the service publicly.
| Authentication choice | What it provides | Operational trade-off |
|---|---|---|
| Local password plus TOTP | Trilium’s built-in password login and time-based one-time passwords, including recovery codes. | You must protect the authenticator account and store recovery codes somewhere safe but separate from the server. |
| OpenID Connect | Login is delegated to a configured OIDC identity provider. MFA or passkeys are enforced by that provider. | Provider settings, redirect URLs, claims, and the Trilium account link must all be correct. |
| Authentication disabled | Unauthenticated access for localhost-only use or a deliberately controlled front end. | It also disables TOTP and should not be treated as suitable for an ordinary public server. |
Local password and TOTP
Use a unique, long Trilium password and enable TOTP in Trilium’s security settings. Generate and store the recovery codes before relying on the second factor. A password manager or offline encrypted record is preferable to leaving recovery codes in the server’s data directory. Verify that a new browser requires both the password and the one-time code, then verify that a recovery code works once and is consumed as expected.
Free tools Windows power users keep installed
One-click scans. No signup required.
OIDC
OIDC can centralize MFA or passkeys, but configuring the provider alone does not link its identity to the intended Trilium account. Complete the account-linking step in Trilium and test both a normal login and a failed or unlinked identity. Keep a recovery path that does not depend on an untested proxy session or a single administrator browser.
Do not confuse proxy login with Trilium login
A reverse proxy can display an access prompt, but an interactive forward-auth workflow may interrupt unattended synchronization. It also does not automatically establish the session and account state that Trilium clients expect. Use Trilium’s own authentication for the web interface and confirm that desktop or mobile synchronization completes without being trapped by an interactive challenge.
Expose only an HTTPS entry point
Remote access should terminate on HTTPS with a certificate trusted by the clients that will browse or synchronize. Trilium’s usual deployment pattern is TLS termination at a reverse proxy, although Trilium also supports its own TLS configuration.
Preferred proxy-terminated TLS
Bind Trilium to a private interface or an internal container network, then publish only the proxy’s HTTPS listener. The proxy handles certificate issuance and renewal while forwarding requests to Trilium’s local HTTP endpoint. Confirm renewal before the first certificate expires and make sure the proxy does not leave an unencrypted public listener active.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Built-in Trilium HTTPS
If you use Trilium’s own TLS support instead, install a certificate and private key with permissions that prevent ordinary users and unrelated containers from reading the key. A self-signed certificate can work when every client is configured to trust it, but each browser and synchronization client must receive that trust configuration. Do not disable certificate validation to get around warnings; Trilium explicitly identifies that workaround as insecure.
Network boundaries
The backend should not be reachable directly from the internet. On Docker, publish the proxy’s port rather than the Trilium container port, or bind the application port only to a loopback or private address. On a packaged installation, use the host firewall and proxy listener to enforce the same separation. Router port-forwarding should point to the intended HTTPS entry point, not to an arbitrary application port. Never publish the Docker control socket as a shortcut to application access; possession of that socket can amount to control of the host.
Make the reverse proxy preserve Trilium’s behavior
A proxy that returns a login page but breaks WebSockets or client-IP handling is not a secure, reliable deployment. Configure the proxy as an application-aware gateway, not merely a port forward.
Forward WebSocket upgrades
Trilium uses WebSocket behavior for interactive functions and synchronization-related communication. The proxy must pass the HTTP Upgrade and Connection headers correctly and allow the upgraded connection to remain open for the expected session lifetime. Test a live note edit, opening the web interface in another browser tab, and a full synchronization from each client type you use.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Configure trusted-proxy handling
Trilium needs to know which proxy addresses it may trust when interpreting forwarded client information. Restrict that trust to the actual proxy network or address range. A broad trust setting lets an untrusted client forge its apparent IP address, which weakens logging and any address-based controls. After configuring it, inspect Trilium’s logs and confirm that the recorded client address is the real client rather than only the proxy.
Keep unattended sync non-interactive
Interactive forward-auth can be reasonable for a human-only administrative site, but it can block a synchronization client that cannot complete a browser challenge. If you retain a proxy-level access layer, test every unattended client and document the exception. In most Trilium deployments, the safer compatibility choice is to let the proxy provide HTTPS and routing while Trilium performs the application login.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Reduce container and host privileges
Docker is an isolation boundary, not a guarantee that the application is safe. A compromised process has more opportunity to affect the host when it runs as root, receives broad Linux capabilities, or can access sensitive host paths.
Consider the rootless image
Trilium provides a rootless Docker image. Its documentation describes non-root containers as a security best practice because they reduce the potential impact of a container breakout:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →“Running containers as non-root is a security best practice that reduces the potential impact of container breakouts.”
Before switching, check the image documentation for the expected UID and GID, then ensure the mounted data directory is writable by that identity. A common failure after a rootless migration is a container that starts but cannot create the database, logs, or backup files because the host directory is still owned by the old root-running process. Correct ownership deliberately; do not solve the problem by making the directory world-writable.
Minimize host access
- Mount only the data directory and other paths Trilium explicitly requires.
- Avoid privileged mode and unnecessary Linux capabilities.
- Use a read-only root filesystem where your deployment supports it, while leaving the data mount writable.
- Keep the container and host on current security updates appropriate to your release process.
- Separate Trilium from unrelated workloads so a compromise does not expose additional secrets.
These controls lower impact; they do not prove that a particular Docker deployment is secure. Review them after image changes because the expected user, paths, and default settings can change between releases.
Disable high-risk application capabilities unless required
Trilium’s backend scripting and SQL Console can be powerful administrative tools, but they also expand what a malicious or misused note can do. Starting with Trilium v0.104.0, both are disabled by default as an attack-surface reduction.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Leave backend scripting off by default
Enable backend scripting only for a documented, trusted use case. Before enabling it, identify who can create or edit scripts, what data the scripts can reach, and how you will audit or revoke that access. Recheck the setting after upgrades because security defaults are version-dependent.
Leave SQL Console off unless you need it
The SQL Console can expose or modify the notes database directly. Keep it disabled for ordinary note-taking and remote access. If an administrator must enable it temporarily, limit the account and maintenance window, take a current backup first, and disable it again when the task is complete.
Review security settings after every upgrade
Record the effective values of authentication, scripting, SQL Console, TLS, proxy trust, and listening addresses before upgrading. Compare them with the new release’s documented defaults afterward. Do not assume that replacing an image or package preserves a setting supplied through a different configuration mechanism.
Recommended Free Tools
Protect the complete Trilium data directory
The data directory is the recovery boundary. It contains the database, configuration, backups, and logs. Trilium’s documentation states:
“If you want to back up your Trilium data, just backup this single directory – it contains everything you need.”
Back up the entire directory rather than copying only the database file. Restrict its permissions so the Trilium service account and the designated backup process are the only routine readers. Treat configuration and logs as sensitive: they can reveal account details, paths, and operational history.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Keep a copy outside the server’s failure domain
A second copy on the same disk does not protect against disk failure, ransomware, an accidental deletion, or a host compromise. Keep at least one recoverable copy on separate storage or a separate system, protect it with encryption appropriate to your threat model, and restrict who can read or delete it. If your backup system supports immutable or append-only retention, consider it for the copy that must survive an administrative mistake or compromise.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Make backups consistent and usable
Follow the deployment’s documented procedure for quiescing or snapshotting the data directory so you do not capture a partially written database. Record when each backup completed and whether the transfer and integrity checks succeeded. A green backup job is not proof of recoverability until you can restore it.
Test restoration
- Provision an isolated test host or container with the same or a compatible Trilium release.
- Stop the test instance and replace its empty data directory with a copy of the backup.
- Start Trilium without exposing it publicly.
- Confirm that notes, attachments, configuration, users, and recent changes are present.
- Test login, TOTP or OIDC account access, and synchronization from a disposable client.
- Record the elapsed time, any manual repair, and the release compatibility result.
Keep the restoration notes with the backup records. They turn an untested archive into an operational recovery procedure.
Verify the hardened service from outside
Perform a deliberate review after initial setup and after any host, proxy, identity-provider, or Trilium release change.
- From an external network, confirm that only the intended HTTPS entry point responds.
- Confirm that direct access to the backend port fails or is limited to the private network.
- Check that the certificate is valid for the hostname, trusted by clients, and renewed before expiry.
- Verify that an unauthenticated request cannot open the application and that
noAuthentication=trueis not active on a public instance. - Test local-password plus TOTP or the complete OIDC login and account link, including the documented recovery path.
- Open a session, edit a note, and synchronize from every client type while watching for WebSocket or forward-auth failures.
- Inspect logs for the real client address and confirm that only the intended proxy is trusted.
- Check container user ownership, mounted paths, capabilities, and exposed ports.
- Confirm that backend scripting and SQL Console remain disabled unless an approved task requires them.
- Verify that the latest full data-directory backup completed and that the last restore test remains valid.
Use a change-based maintenance routine
Security is a continuing configuration task rather than a one-time port decision. Re-run the inventory and external checks whenever you change the host, router, reverse proxy, certificate, identity provider, container image, package, or Trilium release. Preserve the previous configuration and a recent tested backup before making high-impact changes. If a change breaks synchronization, first check WebSocket upgrade handling and interactive proxy authentication; if login fails, check the Trilium authentication mode and OIDC account link before weakening TLS or disabling authentication.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
