Self-Host Stirling-PDF with Greffon
Splitting, merging, and OCR-ing PDFs usually means uploading them to some website you do not control. Here is the honest setup for running the whole toolkit on a greffer instead.
Most people do their PDF chores on a grab-bag of free websites: one to merge, another to compress, a third to convert to Word. Every one of those means uploading a document, sometimes a sensitive one, to a server you know nothing about. Stirling-PDF puts the entire toolkit on a machine you own. Grafting it onto a greffer means the documents never leave your own hardware.
Why own the toolkit
Stirling-PDF is a locally hosted, web-based PDF toolkit. Split, merge, rotate, crop, compress, convert to and from images and Office formats, run OCR, add or remove passwords, sign, watermark, and more, all from one browser UI. It runs entirely on your server, so a contract, a bank statement, or a medical scan never gets uploaded to a third-party site just so you can rotate a page.
That is the real win here. The convenience of the free PDF sites is genuine, but so is the cost: you hand them the file. Self-hosting keeps the convenience and removes the upload.
Graft it from the catalog
On a greffer you do not hand-write a compose file or wire a reverse proxy. Pick Stirling-PDF from the catalog and graft it onto your greffer. Greffon issues the certificate and routes the app, so it comes up reachable over HTTPS without you assembling that plumbing by hand. The UI is on port 8080 inside the container; Greffon handles the TLS front for you.
The no-login default
This is the sharp edge worth knowing before you expose it. The catalog ships Stirling-PDF with login disabled (SECURITY_ENABLELOGIN is false). That is a deliberate single-user default: anyone who can reach the URL can use every tool, with no username or password prompt.
Stirling-PDF does support its own accounts: flipping login on enables usernames, passwords, and per-user settings. If more than one person will touch the instance, or it will be reachable beyond your own devices, turn that on rather than relying on the URL being hard to guess.
Reach it from anywhere
Stirling-PDF is a plain HTTP web app, so reaching it is straightforward. On the same network as your greffer it works the moment it starts. To reach it from elsewhere you have two honest options.
The simplest is tunnel mode: a greffer connects outbound to the manager's tunnel and serves its apps without opening a single inbound port, which is the answer for a box behind NAT or CGNAT with no public IP. If you would rather expose the greffer directly, port forwarding plus dynamic DNS still works. Because this is an HTTP app and not a UDP one, the tunnel carries it cleanly either way, and your traffic stays over HTTPS.
Memory and the heavier tools
Most of Stirling-PDF is light: split, merge, and rotate barely register. The heavier features are the conversions. OCR and the Office-format conversions pull in LibreOffice and a Tesseract pipeline under the hood, and a large or image-heavy document can briefly use a meaningful chunk of RAM while it processes.
What to back up
Stirling-PDF does not keep a library of your documents: files you upload for a one-off operation are processed and then go. So most of the time there is little state to lose. What does persist is worth knowing about: your saved signatures and custom branding, and any Automate or folder-scan pipeline configs you set up. Those live in the greffon's volumes and survive a normal update or restart.
If you have invested in pipelines or signatures, treat those volumes as the thing to protect. Greffon handles TLS and routing today, and native one-click backups are coming in M2. Until then, bring your own backup tool (restic or borgbackup are the usual choices), snapshot the volumes on a schedule, and keep a copy off the greffer.
