Skip to content
Greffon
Tutorial

Self-Host Multica with Greffon

Multica manages AI coding agents as team members. The orchestration record (issues, agents, chat) is worth owning. Here is the honest setup on a greffer, SMTP gotcha and all.

GLGreffon Labs6 min read
~/blog/self-host-multica

Multica is an open-source platform for managing AI coding agents (Claude Code, Codex, Gemini CLI, and others) as if they were team members: you assign tasks, track progress, and reuse skills across agents. The work it coordinates is your codebase and your prompts, so the record of who was asked to do what is worth keeping on hardware you own rather than an account you rent. Grafting the Multica server onto a greffer puts that record on your machine, and Greffon takes the TLS and routing off your plate.

Why own the server

Multica splits into two halves. The half you graft here is the server: the web UI, the API, and a bundled Postgres that holds your issues, agents, chat history, and skills. The other half is an agent daemon that runs on your own machine, where the actual code lives, and points back at this server. Self-hosting the server means the orchestration history (the prompts you sent, the tasks you tracked, the skills you built up) sits on a box you control, not a third party's.

Graft it from the catalog

On a greffer you do not hand-write a compose file or wire a reverse proxy. Pick Multica from the catalog and graft it onto your greffer. The platform generates the JWT signing secret for you at instance creation, issues the certificate, and routes the app, so the web UI comes up reachable over HTTPS without you assembling that plumbing by hand.

Wire SMTP before you log in

This is the part you cannot skip, and it is the one most likely to lock you out. Multica logs you in with an emailed verification code. If no mail transport is configured, that code is only written to the server logs and never delivered, which means you cannot log in through the normal flow at all. So link an SMTP integration to the instance as part of setup, not after.

No SMTP means no login
Multica login is by emailed code. Without an SMTP integration the code only lands in the server logs, so attach SMTP to the instance before you try to sign in. Multica speaks STARTTLS or implicit TLS (SSL). Plaintext SMTP is not supported, so a provider that only offers unencrypted port 25 will not work.

Any transactional mail provider with TLS works here: a dedicated SMTP service, or your own mail server if it offers STARTTLS or SSL. You supply the host, port, username, and password through the instance's SMTP integration, and Multica uses it to deliver login codes.

The agent daemon runs on your machine

Grafting the greffon gives you the server, not the agents. The agent daemon, the piece that actually runs Claude Code or Codex against your repositories, runs on your own machine and connects out to this instance. That is by design: the code and the API keys for your coding agents stay local, and the greffer only ever sees the orchestration layer.

The greffon is the coordinator, not the worker
Do not expect the greffer to execute coding tasks. It hosts the web UI, API, and database. Point your local Multica agent daemon at the instance URL, and it does the work where your code lives.

Reach it from anywhere

The Multica server is a plain HTTP web app, which makes it straightforward to reach. On the same network as your greffer it works the moment it starts. To reach it from elsewhere, including from an agent daemon on a laptop somewhere else, you have two honest options.

The simplest is tunnel mode: a greffer connects outbound to the manager's tunnel and serves its apps without opening a single inbound port, which is the answer for a box behind NAT or CGNAT with no public IP. The tunnel carries HTTP and TCP, and Multica is HTTP, so it is fully covered. If you would rather expose the greffer directly, port forwarding plus dynamic DNS still works. Either way the server stays reachable over HTTPS.

Storage, usage stats, and backups

Multica bundles its own Postgres, so the greffon carries a real database rather than a flat file. Give it room: the issue history, chat, and skills grow over time, and a database wants memory and disk headroom to stay responsive. This is not a featherweight app like a static site, so size the greffer accordingly.

The Usage and Runtime dashboards stay at zero by default
Those panels rely on a periodic rollup job, and the bundled Postgres does not ship pg_cron to schedule it. So the Usage and Runtime numbers read zero out of the box. This is cosmetic. The core features (issues, agents, chat, real-time updates) are unaffected, so do not chase a problem that is not there.

Because the data lives in that Postgres volume, back it up. Greffon handles TLS and routing today, and native one-click backups are coming in M2. Until then, bring your own backup tool (restic or borgbackup are the usual choices), dump the Postgres data on a schedule, and keep a copy off the greffer. As with anything you self-host, run it on an always-on greffer (a small VPS or a mini-PC) rather than a laptop that sleeps, so the server is up when your agents reach for it.

FAQ

Does grafting Multica run the AI agents on my greffer?
No. The greffon is the Multica server: web UI, API, and Postgres. The agent daemon that runs Claude Code, Codex, or Gemini CLI lives on your own machine, where your code is, and points at this instance. The greffer only holds the orchestration layer.
Why can't I log in after grafting it?
Almost always missing SMTP. Multica sends a login code by email, and without an SMTP integration that code only goes to the server logs. Attach an SMTP integration with STARTTLS or SSL to the instance, then request the code again.
Why are the Usage and Runtime dashboards showing zero?
They depend on a periodic rollup job that needs pg_cron to schedule, and the bundled Postgres does not include it. It is cosmetic. Issues, agents, chat, and real-time updates all work regardless.
Can I reach it if my greffer is behind NAT?
Yes. Multica is an HTTP app, so tunnel mode covers it fully: the greffer connects outbound and serves the app with no inbound ports open. Port forwarding plus dynamic DNS is the alternative if you want to expose the greffer directly.
GL
Greffon Labs
We build Greffon, the simplest way to turn any machine into a server you own.

Ready to turn on your greffer?

Install in minutes. Deploy each app in seconds. Your server, your apps.

Read the docs