There are multiple ways to get CryptPad up and running, but I went with Docker (via Komodo, which has a web GUI kinda like Portainer, but it's not freemium) and Nginx Proxy Manager.

Installation & Setup

For reference, here's the official guide. It's okay, but I didn't quite get everything the first time through (as evidenced by my other thread).

Make sure you have access to at least one domain name with the ability to create at least two subdomains. I personally went with docs.domain.tld and docs-sandbox.domain.tld, but you're free to choose what you like.
- CryptPad uses a dual-(sub)domain structure, so you have a MAIN domain (docs.domain.tld in my example) and a SANDBOX domain (docs-sandbox.domain.tld). You can call them whatever you want, but be aware that the MAIN domain is what you'll put into your browser to navigate to the site, and the SANDBOX domain should be totally transparent to an end-user.

Create your docker-compose.yml file like the example. Be aware that the ports it uses could potentially conflict with something else (my Ente instance runs on port 3000 already, so I modified my ports to be 3060:3000 and 3063:3003, but you do you). Ultimately, mine looks like this:

# SPDX-FileCopyrightText: 2023 XWiki CryptPad Team <contact@cryptpad.org> and contributors
#
# SPDX-License-Identifier: AGPL-3.0-or-later

---
services:
  cryptpad:
    image: "cryptpad/cryptpad:latest"
    hostname: cryptpad

    environment:
      - CPAD_MAIN_DOMAIN=https://docs.domain.tld
      - CPAD_SANDBOX_DOMAIN=https://docs-sandbox.domain.tld
      - CPAD_CONF=/cryptpad/config/config.js

      # Read and accept the license before uncommenting the following line:
      # https://github.com/ONLYOFFICE/web-apps/blob/master/LICENSE.txt
      - CPAD_INSTALL_ONLYOFFICE=yes

    volumes:
      - ./data/blob:/cryptpad/blob
      - ./data/block:/cryptpad/block
      - ./customize:/cryptpad/customize
      - ./data/data:/cryptpad/data
      - ./data/files:/cryptpad/datastore
      - ./onlyoffice-dist:/cryptpad/www/common/onlyoffice/dist
      - ./onlyoffice-conf:/cryptpad/onlyoffice-conf
      - ./config:/cryptpad/config

    ports:
      - "3060:3000"
      - "3063:3003"

    ulimits:
      nofile:
        soft: 1000000
        hard: 1000000

Create a folder called config and within it, a file called config.js. Here's the example and what mine looks like. Note that httpUnsafeOrigin is your MAIN domain and httpSafeOrigin is your SANDBOX domain. Change your maxUploadSize as you see fit.

module.exports = {
  httpUnsafeOrigin: "https://docs.domain.tld",
  httpSafeOrigin: "https://docs-sandbox.domain.tld",
  httpAddress: "::",
  //adminKeys: [],
  //inactiveTime: false,
  maxUploadSize: 2 * 1024 * 1024 * 1024, // 2 GB
};

Create a folder called customize and within it, a file called application_config.js. Here's the example and what mine wound up looking like. Note that you need to replace <salt> with something; I used the output of the Linux command openssl rand -hex 32, as their guide recommends.

(() => {
  const factory = (AppConfig) => {
    // Example: If you want to remove the survey link in the menu:
    // AppConfig.surveyURL = "";

    // To inform users of the support ticket panel which languages your admins speak:
    //AppConfig.supportLanguages = [ 'en', 'fr' ];
    AppConfig.loginSalt = "<salt>";
    AppConfig.minimumPasswordLength = 10;

    return AppConfig;
  };

  // Do not change code below
  if (typeof module !== "undefined" && module.exports) {
    module.exports = factory(
      require("../www/common/application_config_internal.js"),
    );
  } else if (
    typeof define !== "undefined" &&
    define !== null &&
    define.amd !== null
  ) {
    define(["/common/application_config_internal.js"], factory);
  }
})();

Fire up Nginx Proxy Manager and create a new proxy host.
- You can put multiple domain names into a single entry, so go ahead and put both docs.domain.tld and docs-sandbox.domain.tld in there. Because I'm also using a Cloudflare Tunnel for this, I'll also throw in a couple of LAN-only domains: cryptpad.home (MAIN) and sandbox.cryptpad.home (SANDBOX).
- Point it at the relevant hostname along with whichever port you're using (by default it's 3000 and for me it's 3060). I'm running Pi-hole on the same machine and have a local IP assigned to the server, so I can just put in servername.home (which I assigned to it in Pi-hole), but 192.168.10.10 (or whatever your server's IP is) works great too.
- Ensure both "Block Common Exploits" and "Websockets Support" are enabled.
- Go to the "Custom locations" tab and add a new custom location. The location is /cryptpad_websocket and you should forward to the same hostname as before along with port 3003 (by default; 3063 for me).
- Because I'm using a Cloudflare Tunnel, I don't need to worry about SSL certs or anything here; so I just click "Save" and leave Nginx Proxy Manager.
If you're using a firewall, ensure that your ports of interest are open. All of this runs on a Ubuntu 24.04 LTS machine for me, so sudo ufw allow 3060 and sudo ufw allow 3063 do the trick.
Add your subdomains to your Cloudflare Tunnel in the web interface, and point docs.domain.tld to cryptpad.home and docs-sandbox.domain.tld to sandbox.cryptpad.home.
Run your Docker container.
In the logs, it'll eventually spit out a URL you should go to in order to create your admin account and finish setup. It should look something like https://docs.domain.tld/#37wufue273r2rgufhwr373r278382fqgsueif.
Once you put in your admin credentials and save them in your password manager (it'll double-check with you that you recorded your credentials), it'll finish setting up your instance. When I did this, it stayed on the "hashing your password" screen indefinitely. I eventually opened a new tab, went to docs.domain.tld, and everything was fine, so I closed out of that other tab.

Additional notes

If you want to increase the overall storage limit on a per-user basis, go to docs.domain.tld/admin, and in the User Storage tab on the left, you can increase the amount of storage. It's recorded in MB. NOTE that you need to click "Set Limit" and then click the same button again after it changes to "Are you sure?" If you don't do it quickly, it might time out and/or error out. Just doing it again but more quickly should actually do the thing correctly.
You can open registration if you want under the User Directory tab of the Admin interface (not recommended), or you can manually create invitation links for individual users. It won't email anything to anyone, so make sure you just copy and paste the link to them.