Self-hosted vs managed BookStack: an honest comparison

Who this is for

Small IT teams, agencies and technical founders who already use BookStack or are about to, and who are deciding whether to keep a server for it. BookHost sells managed hosting, so we have an interest here. We still think self-hosting is the right answer for many teams, and we say where.

What running BookStack yourself involves

Installation

BookStack is a PHP application backed by MySQL or MariaDB. You can install it directly on a Linux server following the official docs, or run the popular LinuxServer.io Docker image next to a MariaDB container. With the Docker image, persistent data lives under /config, the configuration file is /config/www/.env, and you must set APP_URL, APP_KEY and the database connection variables.

Updates

BookStack is updated regularly, including security fixes. On a manual install an update is roughly git pull, composer install --no-dev and php artisan migrate; with Docker you pull the new image and recreate the container. BookStack’s docs recommend a backup before every update. Around the application you also maintain the operating system, PHP, the database server and your reverse proxy.

TLS and the address

You need a domain, DNS, and a reverse proxy or web server that renews certificates automatically. If the address changes later, BookStack’s stored URLs must be updated too.

Email

BookStack sends invitations, password resets and notifications by email. That means SMTP credentials for a provider whose mail actually arrives, plus SPF and DKIM records for your sending domain. A wiki whose password reset mail lands in spam produces support tickets.

Backups and restore tests

A BookStack backup has three parts: the database, the uploaded images and attachment files, and the .env file with its APP_KEY. Backups belong on a different machine from the wiki, and they only count once you have restored one. Our BookStack backup guide has the commands.

Monitoring

Somebody should find out that the wiki is down, the disk is full, the certificate failed to renew or last night’s backup did not run before a colleague does. That means uptime checks, disk alerts and a backup job that reports failures instead of failing silently.

Side by side

The real cost of self-hosting is time

A small virtual server is cheap. The expensive part is the hours, and they come unevenly: a quiet month may need almost nothing, while a failed upgrade or a full disk can eat an afternoon at an awkward moment. A fair way to compare is to write down, for your own team:

• Hours per month for updates, OS patches and checking backups.
• Hours per quarter for a restore test.
• Hours per year for incidents, upgrades of PHP or the database, and certificate or mail problems.
• The hourly cost of the person doing it, and what they would otherwise work on.
• Who covers when that person is on holiday.

If the result is well below €39 a month and you have more than one person who can fix the server, self-hosting is a sound choice. If the wiki depends on one busy admin, the risk matters more than the money.

What managed hosting does and does not change

With BookHost, we handle hosting, maintenance and security updates, and back up each workspace daily. Backups are encrypted. A nightly restore check rebuilds one workspace at a time from its backup in an isolated test instance, rotating so every workspace comes round in turn; it is not a test of every backup every night. You get restore help through email support. 5 GB of uploads included (1 GB = 1 billion bytes). Upload directories are measured periodically; the dashboard warns from 80% by default. Uploads are not automatically blocked at this allowance. Contact support for higher storage needs; no automatic storage emails.

Some limits stay. A daily backup is not continuous recovery: a restore can cost up to a day of changes. Backups currently live on the same server as the workspaces; a copy at a second location is in preparation and not yet in operation. We do not promise a fixed restore time or a contractual availability commitment. The reliability page and how we test restores describe the details.

When self-hosting is the better choice

• You have ops capacity and more than one person who can maintain the server.
• You need LDAP, SAML or OIDC sign-in, or enforced two-factor authentication.
• You rely on custom themes, logical theme hooks or other server-side changes.
• Your policy requires the wiki to run on your own infrastructure.
• You need S3 or other external file storage.

When managed hosting is the better choice

• Nobody on the team wants to be on call for the wiki server.
• You want backups and restore checks handled by someone else.
• BookStack’s own email-and-password sign-in is enough for your team.
• You want to start within minutes, without buying a server first.

Checklist for self-hosters

If you run BookStack yourself, these are the things worth confirming:

• BookStack, PHP, the database server and the OS each have an update routine and an owner.
• You follow BookStack release notes so security releases are not missed.
• HTTPS is enforced and certificate renewal is automatic and monitored.
• APP_URL matches the public address exactly.
• Outgoing mail works: send yourself a password reset and check it arrives.
• The database is dumped daily with a consistent snapshot.
• Uploaded images and attachment files are archived with the same backup run.
• A copy of .env and its APP_KEY is stored securely, separate from the server.
• Backups are copied off the server and old ones are rotated out.
• You have restored a backup to a separate instance in the last quarter and checked pages, images, attachments and a normal user login.
• Uptime, disk space and backup failures raise an alert someone reads.
• A second person knows where the backups are and how to restore them.

If you tick most of these already, you are running BookStack well and probably do not need us. If several are open and nobody has time to close them, a 14-day free trial of BookHost costs nothing to try. When you are ready to move an existing instance, read what actually breaks when moving to managed hosting and the migration page.