Self-hosted knowledgebase with first-class AI access. One container: web, API, MCP.
885
A self-hosted knowledgebase for the things you actually need to remember — built to be read by you and your AI. Permissioned Markdown spaces, document attachments with in-browser viewers, sandboxed JavaScript automations, a REST API and MCP server, and an optional bring-your-own-model AI assistant (Anthropic, OpenAI, Gemini, or local Ollama).
Source, issues and full documentation: https://github.com/MattLarritt/notesetc
This image contains the whole application (API + web) in one container. It publishes a single port and needs a Postgres database.
Create a docker-compose.yml:
services:
db:
image: postgres:16-alpine
restart: unless-stopped
environment:
POSTGRES_USER: notesetc
POSTGRES_PASSWORD: change-me
POSTGRES_DB: notesetc
volumes:
- notesetc_db:/var/lib/postgresql/data
healthcheck:
test: ['CMD-SHELL', 'pg_isready -U notesetc -d notesetc']
interval: 5s
timeout: 5s
retries: 10
app:
image: mlarritt/notesetc:latest
restart: unless-stopped
depends_on:
db:
condition: service_healthy
environment:
WEB_ORIGIN: http://localhost:3100
DATABASE_URL: postgresql://notesetc:change-me@db:5432/notesetc?schema=public
MASTER_ENCRYPTION_KEY: change-me-32-bytes-base64-or-hex
SESSION_SECRET: change-me-long-random-string
BREAKGLASS_ADMIN_EMAIL: [email protected]
BREAKGLASS_ADMIN_PASSWORD: change-me-please-12+
STORAGE_DIR: /app/storage
ports:
- '3100:3000'
volumes:
- notesetc_storage:/app/storage
volumes:
notesetc_db:
notesetc_storage:
Then:
docker compose up -d
Open http://localhost:3100 and sign in with the BREAKGLASS_ADMIN_* credentials you set. Add RUN_SEED: "true" to the app environment for a small demo workspace on first boot.
| Variable | Purpose |
|---|---|
DATABASE_URL | Postgres connection string |
MASTER_ENCRYPTION_KEY | 32-byte key; encrypts secrets at rest (AES-256-GCM) |
SESSION_SECRET | Signs web session cookies |
WEB_ORIGIN | The public origin users browse to (CORS + cookies) |
STORAGE_DIR | Attachment store root — bind it to storage you back up (local disk, NAS) |
BREAKGLASS_ADMIN_* | Bootstrap local admin; remove to disable |
Everything else — AI provider and model, web search, automations, API tokens — is configured in the app under Admin.
WEB_ORIGIN to the public URL./api/v1/mcp; the OpenAPI console at /docs. Both share the app's single port.STORAGE_DIR, one folder per workspace — bind-mount it somewhere durable.latest — current release0.1.0 — first public releaseContent type
Image
Digest
sha256:531cc4f5d…
Size
418.1 MB
Last updated
14 days ago
docker pull mlarritt/notesetc