Secure Dense-Mem on Vultr with Traefik

Quick Answer

The secure cloud version uses one public HTTPS endpoint and keeps the admin surface private.

Running Dense-Mem locally is the easiest start. Running it on a small cloud server is how you make the same memory reachable from your laptop, desktop, work machine, and remote AI clients.

This tutorial builds a secure beginner setup:

Your AI client -> https://memory.example.com/mcp -> Traefik -> Dense-Mem

The public internet sees only the HTTPS Dense-Mem endpoint. The control portal stays private.

What You Are Building

This setup is for normal users, families, and small teams who want one memory server without building a platform from scratch.

Step 1: Create The Vultr Server

Open Vultr with the referral link:

Create a Vultr account or server

Create a new Cloud Compute instance:

For the firewall:

Do not open these ports to the public:

8080, 8090, 5432, 7474, 7687

Those are internal or local admin/database surfaces.

Step 2: Point A Domain To The Server

You need a domain or subdomain, such as:

memory.example.com

Create an A record:

Wait until DNS resolves:

ping memory.example.com

If the ping shows your Vultr IP, continue.

Step 3: SSH Into The Server

From your computer:

ssh root@YOUR_SERVER_IP

Update Ubuntu:

apt update
apt upgrade -y

Install Docker using Docker's official Ubuntu instructions. The short version is:

apt install -y ca-certificates curl
install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
  -o /etc/apt/keyrings/docker.asc
chmod a+r /etc/apt/keyrings/docker.asc
​
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
  $(. /etc/os-release && echo \"$VERSION_CODENAME\") stable" \
  > /etc/apt/sources.list.d/docker.list
​
apt update
apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

Check:

docker compose version

Step 4: Download The Expert Compose File

Create the app folder:

mkdir -p /opt/dense-mem
cd /opt/dense-mem

Download the Traefik-ready compose file:

curl -fsSLo docker-compose.yml \
  https://raw.githubusercontent.com/markhuangai/dense-mem/main/examples/docker-compose.expert.yml

Create .env:

cat > .env <<'EOF'
POSTGRES_PASSWORD=replace-with-a-long-random-password
NEO4J_PASSWORD=replace-with-a-long-random-password
CONTROL_PORTAL_TOKEN=replace-with-a-long-random-token
AI_API_URL=https://api.openai.com/v1
AI_API_KEY=your-ai-provider-api-key
AI_API_EMBEDDING_MODEL=text-embedding-3-large
AI_API_EMBEDDING_DIMENSIONS=3072
​
DENSE_MEM_DOMAIN=memory.example.com
[email protected]
CONTROL_PORTAL_BIND=127.0.0.1
CONTROL_PORTAL_PORT=8090
EOF

Edit it:

nano .env

Replace:

• memory.example.com with your real domain
• [email protected] with your email
• every placeholder password/token with a real secret
• your-ai-provider-api-key with your provider API key
• AI_API_URL with your OpenAI-compatible provider base URL if you are not using OpenAI
• AI_API_EMBEDDING_MODEL and AI_API_EMBEDDING_DIMENSIONS with a matching embedding model and dimension

You can create random secrets with:

openssl rand -base64 32

The example uses OpenAI's text-embedding-3-large, which returns 3072 dimensions. If you use text-embedding-3-small, set AI_API_EMBEDDING_DIMENSIONS=1536. Pick the embedding model before storing important memory; changing model or dimensions later requires rebuilding or re-embedding memory data.

Step 5: Start Dense-Mem With Traefik

Start the public HTTPS stack:

docker compose --profile traefik up -d

Check the containers:

docker compose ps

Check the public health endpoint:

curl https://memory.example.com/health

If this returns JSON with a healthy or degraded status, your public HTTPS route is working. A degraded status can still happen when optional Redis is disabled; for a single-server setup, that is expected.

Step 6: Create A Team And API Key

Create your first shared memory team:

docker compose exec server /app/provision-team --name "primary-memory"

Save the printed API key somewhere private.

Set it locally on any machine that will connect:

export DENSE_MEM_API_KEY="dm_default-prof_..."

Step 7: Connect Claude Code To The Public Server

claude mcp add --transport http dense-mem https://memory.example.com/mcp \
  --header "Authorization: Bearer $DENSE_MEM_API_KEY"

Ask Claude Code:

Remember that this Dense-Mem server is my shared AI memory.

Then open a new session and ask:

What do you remember about my Dense-Mem setup?

Step 8: Connect Codex To The Same Server

Add this to ~/.codex/config.toml:

[mcp_servers.dense_mem]
url = "https://memory.example.com/mcp"
bearer_token_env_var = "DENSE_MEM_API_KEY"
tool_timeout_sec = 60
enabled = true

Restart Codex.

Now Claude Code and Codex are connected to the same memory brain.

Step 9: Keep The Control Portal Private

The control portal manages teams, profiles, keys, and security settings. Do not expose it publicly.

The expert compose file publishes it only on 127.0.0.1:8090 on the server. To use it from your computer, make an SSH tunnel:

ssh -L 8090:127.0.0.1:8090 root@YOUR_SERVER_IP

Then open:

http://127.0.0.1:8090/

Use your CONTROL_PORTAL_TOKEN from .env.

Share Memory With Family Or Work Teams

Dense-Mem can support more than one shared memory boundary.

Use the same team when people should share memory. Use separate teams when memory should not mix.

That is the product idea: one memory brain when you want continuity, clear walls when you need privacy.

Security Checklist

Before you invite anyone else:

• keep the control portal private
• keep API keys private
• use read-only keys for tools that should not write memory
• rotate keys when a machine is lost or a teammate leaves
• do not store passwords, seed phrases, or private keys as memories
• back up Docker volumes if the memory matters
• remember that hosted AI providers can receive memory text for embeddings and verification

Dense-Mem makes AI memory more durable. It does not remove your duty to protect sensitive information.

Why This Matters

The best AI setup is not one chat window. It is a connected workspace.

Claude Code can learn your coding rules. Codex can recall the same rules. A family assistant can remember travel preferences. A work team can preserve decisions from last month instead of rediscovering them every sprint.

Dense-Mem gives those tools a shared memory layer you own.

Try it, share it, and star the repo if you want more people to find it:

github.com/markhuangai/dense-mem