Self-hosting guide

Teasynaer runs as the app container plus a Postgres 16 database, wired together by a single compose file. No SaaS, no seats, no telemetry — evidence and the database live in volumes you own.

The compose file

# docker-compose.yml
services:
  teasynaer:
    image: git.allotmentology.tech/allotment-technology-ltd/teasynaer:latest
    restart: unless-stopped
    ports: ["8080:8080"]
    environment:
      DATABASE_URL: postgres://teasynaer:teasynaer@db:5432/teasynaer
      TEASYNAER_ADMIN_PASSWORD: ${TEASYNAER_ADMIN_PASSWORD:?set it in .env}
      TRACKER_CREDENTIALS_KEY: ${TRACKER_CREDENTIALS_KEY:-}   # openssl rand -hex 32
    depends_on:
      db:
        condition: service_healthy
    volumes: ["evidence:/data/evidence"]
  db:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: teasynaer
      POSTGRES_PASSWORD: teasynaer
      POSTGRES_DB: teasynaer
    volumes: ["db-data:/var/lib/postgresql/data"]
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U teasynaer"]
      interval: 5s
      timeout: 5s
      retries: 10
volumes:
  db-data:
  evidence:

The repository ships the full file — change the Postgres credentials from the defaults for anything beyond a laptop. The database is deliberately not published to the host; only the app's 8080 is exposed.

Volumes & backups

Two volumes hold your state: db-data (Postgres) and evidence (the captured bundles under /data/evidence). Back them up as a consistent pair — evidence first, then the database — with the scripts/backup.sh / scripts/restore.sh helpers documented in the repo's docs/runbooks/backup-restore.md runbook.

Upgrades

Pull a newer image tag and docker compose up again. Migrations run forward automatically at container start; the entrypoint fails loudly rather than serving a half-migrated app. Releases are semver-tagged with a CHANGELOG and a documented, forward-only upgrade path.

Auth & reverse proxy

Teasynaer authenticates with a built-in local-admin account (scrypt hashing, DB-backed opaque sessions, login rate-limiting and lockout, forced first-login password change, CSRF and SSRF guards). You can put it behind your own reverse proxy for TLS; set TEASYNAER_PUBLIC_URL so absolute redirects resolve. OIDC and trusted reverse-proxy (forwarded-header) auth are on the roadmap, not shipped yet — today the local-admin account is the only sign-in path.