Self-hosting guide

Run the complete GlassFolio app on your own computer or server with Docker. Your encrypted vault is written to a volume you control, nothing depends on our infrastructure, and the source code is public.

View the code on GitHub

Quick start

Clone the repository and start the container. The npm script checks your network settings first, then builds the image and starts it in the background.

$ git clone https://github.com/Damien-Esilv/GlassFolio.git$ cd GlassFolio$ npm run docker:up

Open http://localhost:3000 in your browser and create your vault. The first build takes a few minutes; later starts take seconds.

Everyday commands

Follow the container logs

$ npm run docker:logs

Stop the app (your data stays in the volume)

$ npm run docker:down

Requirements

Docker Engine 24 or later with Compose v2, or Docker Desktop on macOS and Windows (WSL 2).
Node.js 22, used by the start script to check your network settings before Docker starts.
Git, to download the code and later pull updates.
About 1 GB of disk space for the image. The container is capped at 512 MB of memory.

Configuration

Settings are environment variables. Put the stable ones in docker/docker.env, or prefix the start command with them for a one-off change. Keep the access token out of files: set it in your shell.

Variable	Default	What it does
GLASSFOLIO_PORT	3000	Port on your machine where the app answers.
GLASSFOLIO_BIND	127.0.0.1	Network address the port listens on. 127.0.0.1 keeps the app private to this computer.
GLASSFOLIO_DATA	glassfolio-data	Where your encrypted data is stored: the named Docker volume, or a host folder writable by user ID 1000.
GLASSFOLIO_ACCESS_TOKEN	(empty)	Password required by the browser when the app is reachable from the network. At least 16 characters.
GLASSFOLIO_ALLOWED_HOSTS	(empty)	Comma-separated domain names allowed to use the vault API, for example behind a reverse proxy. localhost and IP addresses always work.
GLASSFOLIO_CSP_CONNECT_SRC	(empty)	Extra origins the page may call, space-separated, such as a remote Ollama server.

Access from your network

By default only this computer can open the app. To reach it from a phone or another machine, bind it to every interface and set an access token; the start script refuses to expose the app without one.

$ export GLASSFOLIO_ACCESS_TOKEN="$(openssl rand -hex 16)"$ echo "$GLASSFOLIO_ACCESS_TOKEN"$ GLASSFOLIO_BIND=0.0.0.0 npm run docker:up

Your browser then asks for a user name and password: the user name is glassfolio and the password is the token printed by the second line, so keep it in your password manager. Start every later docker:up (updates included) with the same GLASSFOLIO_ACCESS_TOKEN and GLASSFOLIO_BIND, or the app goes back to this computer only. The /health endpoint stays open for monitoring.

For access from outside your home network, put the app behind a reverse proxy with HTTPS and list its domain in GLASSFOLIO_ALLOWED_HOSTS. Never expose port 3000 directly to the internet.

Back up and restore

Everything you enter is in the container's /data volume, already encrypted. This command writes a compressed copy to the current folder while the app keeps running.

$ docker run --rm --volumes-from glassfolio-app -v "$PWD":/backup alpine tar czf /backup/glassfolio-data.tgz -C /data .

To restore a backup, stop the container, replace the volume's content with the archive, then start it again.

$ docker stop glassfolio-app$ docker run --rm --volumes-from glassfolio-app -v "$PWD":/backup alpine sh -c "rm -rf /data/* && tar xzf /backup/glassfolio-data.tgz -C /data"$ docker start glassfolio-app

Update

Pull the latest code and run the start script again. The image is rebuilt and your data volume is kept as it is.

$ git pull$ npm run docker:up

Local AI with Ollama

The assistant can run entirely on your machine with Ollama, so no portfolio data leaves your network. Install Ollama, pull a model, then start it so that it accepts requests from the app's address.

$ OLLAMA_ORIGINS=http://localhost:3000 ollama serve

In GlassFolio, open Settings, choose Ollama as the AI provider and keep the default address http://localhost:11434.

If Ollama runs on another machine, add its address to GLASSFOLIO_CSP_CONNECT_SRC so the page is allowed to call it.