{"id":668,"date":"2025-10-01T20:04:51","date_gmt":"2025-10-01T19:04:51","guid":{"rendered":"https:\/\/www.flat-planet.net\/?p=668"},"modified":"2025-10-01T20:04:54","modified_gmt":"2025-10-01T19:04:54","slug":"self-hosted-nightscout-xdrip","status":"publish","type":"post","link":"https:\/\/flat-planet.net\/?p=668","title":{"rendered":"Self-Hosted Nightscout & xDrip"},"content":{"rendered":"\n

I’ve recently had multiple issues with the official Dexcom G7<\/a> app on my phone<\/a>, and after they broke the BYOD version of the app,<\/a> I decided to move in another direction.<\/p>\n\n\n\n

xDrip<\/h2>\n\n\n\n

As of 2025.08.08<\/a>, xDrip now supports the G7 directly. Just two notes here. Follow the instructions<\/a> to the letter, and ignore the screenshots – the options to select are Dex, and use the 4 digit bluetooth pairing code as the Transmitter ID.<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

With xDrip working well, I then decided to get Nightscout<\/a> up and running to act as a replacement for the Clarity<\/a> reports.<\/p>\n\n\n\n

Nightscout<\/h2>\n\n\n\n

Nightscout<\/a> depends on MongoDB as the backend storage, so my docker-compose.yml file starts a nightscout-mongodb<\/a> service. The main change here from other examples is that the bitnami containers are now under bitnamilegacy<\/a>, since its no longer being maintained – not a huge concern since its completely internal to the nightscout docker network.<\/p>\n\n\n\n

  nightscout-mongodb:                                   # SERVICE_NAME - used by the \"depends_on:\" to make sure the database it running before things try to use it\n    image: bitnamilegacy\/mongodb:latest                       # Other options \"image: mongo:latest\" will need adjustments in other places such as \"volumes:\" mounts\n    container_name: nightscout-mongodb                  # called in Nightscout's MONGODB_URI. General good practice to be the same as SERVICE_NAME but not required\n    environment:\n      - PUID=1000                                               # Not necessary, but sets the USER who runs the container as not root\n      - PGID=1000                                               # Not necessary, but sets the USER who runs the container as not root\n      - TZ=Europe\/Dublin                                       # Refer to {nightscout-app}\n      - MONGO_INITDB_ROOT_USERNAME=mongodbpoweruser             # May be necessry if importing from another database or doing management on the database\n      - MONGO_INITDB_DATABASE=auth                              # May be optional, hard to find documaentation about it\n      - MONGO_INITDB_ROOT_PASSWORD=mongoRootPassword03          # Will probably never be needed, I set it the same as MONGODB_ROOT_PASSWORD\n      - MONGODB_ROOT_USER=mongodbpoweruser                      # I'm not sure what the differences are but is usually set the same as MONGO_INITDB_ROOT_USERNAME\n      - MONGODB_ROOT_PASSWORD=mongoaRootPassword02              # I'm not sure what the differences are but is usually set the same as MONGO_INITDB_ROOT_PASSWORD\n      - MONGODB_USERNAME=nightscout01                           # Username called in Nightscout's MONGODB_URI - I set to just \"Nightscout\"\n      - MONGODB_PASSWORD=mongoPassword01                        # Password called in Nightscout's MONGODB_URI\n      - MONGODB_DATABASE=nightscout02                           # Database called in Nightscout's MONGODB_URI - I set to just \"Nightscout\"\n      - MONGODB_PORT_NUMBER=27017                               # DEFAULT[27017] - Port each MongoDB will use inernally 27017:<<MONGODB_PORT_NUMBER>>\n    #ports:                                                  # Only needed to access database externally. If all parts are in the same stack\/network removal or # suggested\n    #  - 27017:27017                                             # DEFAULT[27017:27017] - <<EXTERNAL PORT>>:<<MONGODB_PORT_NUMBER>>\n    volumes:\n      - .\/database:\/bitnami\/mongodb:rw        # \/LOCATION\/ON\/YOUR\/SYSTEM:\/CONTAINER\/LOCATION - for \"mongo:latest\" use \":\/data\/db\"\n      - .\/log:\/var\/log:rw                         # Refer to {nightscout-app}\n      - \/etc\/localtime:\/etc\/localtime:ro                        # Refer to {nightscout-app}\n    restart: always                                             # Refer to {nightscout-app}\n    networks:\n      - nightscout\n    healthcheck:                                                # OPTIONAL: This adds a Healthcheck to the container. Instead of just saying `[Running]` it will say `[Healthy]` if it is unhealthy it should restart\n      test: [\"CMD\", \"sh\", \"-c\", \"mongosh --eval 'db.runCommand(\\\"ping\\\")' || exit 1\", \"||\", \"bash\", \"-c\", \"kill -s 15 1 && sleep 10 && kill -s 9 1\"]\n      interval: 10s\n      timeout: 10s\n      retries: 3\n      start_period: 20s<\/code><\/pre>\n\n\n\n
Nightscout itself is can be completely configured from the docker-compose<\/a> file, but the most important parameters are below. Be sure to update (and keep secret) the API_SECRET. I’ve set it to use unsecured\/HTTP, as I’ll terminate the HTTPS using trafik (more on this later).<\/p>\n\n\n\n
      - TZ=Europe\/Dublin                                        # Use your Time Zone from https:\/\/wikipedia.org\/wiki\/List_of_tz_database_time_zones\n      - API_SECRET=myAPIsecret123                               # In xDrip: REST-API > Base URL= \"<<API_SECRET>>@<<BASE_URL>>\/api\/v1\/\"\n      - MONGODB_URI=mongodb:\/\/nightscout01:mongoPassword01@nightscout-mongodb:27017\/nightscout02\n      - INSECURE_USE_HTTP=true                                  # DEFAULT[false] - Set this to \"true\", unless you have your own SSL provided internally, if you wish to access without reverse Proxy\n      - BASE_URL=https:\/\/nightscout.my.domain               #URL of your Nightscout site accessed outside the local network\n      - DISPLAY_UNITS=mmol\/L                                    # DEFAULT[mg\/dl] - CHOICES: \"=mg\/dl\" | \"=mmol\" \"=mmol\/L\" (same thing either works)\n      - AUTH_DEFAULT_ROLES=denied                               # DEFAULT[readable] - CHOICES: \"readable\" | \"denied\" | <<Or any valid role name>>\n<\/code><\/pre>\n\n\n\n
That is enough to get the local service up, running and reachable, but I also wanted it to be accessible via the interwebs. I could just tailscale it, but since I have a public IP and self-host other services, I decided to open it up.<\/p>\n\n\n\n
Traefik<\/h2>\n\n\n\n
I’m using Trafeik to do two things – (1) SSL Termination, and (2) Rate-Limiting connections to the service.<\/p>\n\n\n\n
SSL Termination<\/h3>\n\n\n\n
Its worth taking a look at the Traefik configuration in detail, as I found most of the online examples a bit obscure, or not quite covering my use case, which is that I have wildcard certs for my domain already, and wanted to use those.<\/p>\n\n\n\n
  traefik:\n    image: traefik:latest\n    container_name: traefik\n    restart: always\n    command:\n      - --providers.docker.network=nightscout\n      - --entryPoints.https1337.address=:1337\n      - --providers.docker=true\n      - --providers.file.directory=\/etc\/traefik\/dynamic\n      - --providers.file.watch=true\n    ports:\n      - \"1337:1337\"\n    volumes:\n      - \/var\/run\/docker.sock:\/var\/run\/docker.sock:ro\n      - .\/traefik\/dynamic\/tls.yml:\/etc\/traefik\/dynamic\/tls.yml\n      - .\/traefik\/certs:\/certs           # Your wildcard certs here\n    labels:\n      - \"traefik.enable=true\"\n    networks:\n      - nightscout<\/code><\/pre>\n\n\n\n
So to begin with we are creating a service called traefik, using the latest image, and allowing it to alwas restart. Then in the commands we are doing the following;<\/p>\n\n\n\n