Self-Host Excalidraw with Greffon
A whiteboard for sketching diagrams, on a box you own. Excalidraw grafts onto a greffer in minutes. The one honest catch: by default, your drawings live in the browser, not on the server.
Excalidraw is a virtual whiteboard for hand-drawn-style diagrams: boxes, arrows, flowcharts, the kind of quick sketch you would otherwise scribble on a meeting room wall. The public excalidraw.com is great, but if you would rather your diagrams never touch someone else's servers, self-hosting puts the app on a machine you own. Grafting it onto a greffer takes minutes, and there is one honest detail worth getting straight up front: where the drawings are actually stored.
Why own the whiteboard
The self-hosted Excalidraw image is the same editor as the hosted site, served from your own greffer instead of a public domain. For sketches that touch internal architecture, account names, or anything you would rather not paste into a third-party site, running your own copy means the app and its assets sit on hardware you control. It is a lightweight, browser-only app, so it asks very little of the greffer it runs on.
Graft it from the catalog
You do not hand-write a compose file or wire a reverse proxy. Pick Excalidraw from the catalog and graft it onto your greffer. Greffon issues the certificate and routes the app, so it comes up reachable over HTTPS from the first start. There is nothing to configure: no admin password, no database, no environment variables to set. It is one of the simplest greffons in the catalog.
Where your drawings live
This is the part that surprises people, and it is the most important thing to understand before you rely on a self-hosted Excalidraw. The self-hosted image is a static, browser-only app. There is no backend, no database, and no server-side storage. Your drawings live in your browser's local storage, on the device you drew them on.
.excalidraw file) and open it elsewhere. Treat those exported files as the thing you actually back up.This also changes what backups mean for this greffon. There is no server-side volume to snapshot, so a backup tool on the greffer would have nothing of yours to capture. The data that matters is the .excalidraw files you export, which live on your own machine. Back those up the way you back up any other document. (For greffons that do keep server-side data, native backups are coming in M2; until then the usual answer is bring-your-own with restic or borgbackup. Excalidraw simply does not need it.)
Reach it from anywhere
On the same network as your greffer, the whiteboard works the moment it starts. To reach it from elsewhere, you have two honest options. Excalidraw is a plain HTTP app, so both apply cleanly.
The simplest is tunnel mode: a greffer connects outbound to the manager's tunnel and serves its apps without opening a single inbound port, which is the answer for a box behind NAT or CGNAT with no public IP. If you would rather expose the greffer directly, port forwarding plus dynamic DNS still works. Either way the whiteboard stays reachable over HTTPS.
Resources and always-on
Excalidraw is about as light as a greffon gets: it is an nginx process serving static files, with all the actual work happening in your browser. It will run comfortably on a small greffer alongside other apps without noticeably moving the needle on memory or CPU.
Because there is no state on the server, restarts are cheap and you do not risk losing data when the greffer reboots (your drawings are in your browser regardless). That said, if you want the whiteboard reachable whenever you reach for it, run it on an always-on greffer rather than a laptop that sleeps. A small VPS, a mini-PC, or a free Oracle Cloud box is a fine home for it.
