Install SynckHub Free Self-Hosting

SynckHub Free Self-Hosting is the supported customer-operated product for up to five active human users, including the owner. All five may write when their repository role permits it.

The supported topology is deliberately small: one SynckHub API process, PostgreSQL, filesystem blob storage, the matching web application, and a same-origin TLS edge. Kubernetes, multiple API replicas, external object storage, Common password login, and vendor remote access are not part of this release.

Before you start

You need:

a Linux host with Docker Engine and Docker Compose v2;
a public DNS name whose ports 80 and 443 reach the host;
outbound HTTPS to SynckHub Common and the admitted federation service;
a modern browser;
durable local storage and an off-host backup destination.

Use one released version that exists for both the synckhub-server and synckhub-web images. Never deploy latest.

Initialize the installation

Download the release’s env/self-hosted directory, then create the non-secret environment file and the owner-only PostgreSQL password:

cd env/self-hosted
cp env.example .env
chmod 600 .env
editor .env

mkdir -m 700 secrets
openssl rand -base64 48 > secrets/postgres-password
chmod 600 secrets/postgres-password
docker compose pull

Run the interactive initializer:

set -a
. ./.env
set +a
docker compose run --rm platform selfhost initialize \
  --owner-email "$SYNCKHUB_OWNER_EMAIL" \
  --company-name "$SYNCKHUB_COMPANY_NAME" \
  --slug "$SYNCKHUB_SLUG" \
  --origin "https://$SYNCKHUB_HOST" \
  --common-url "$SYNCK_COMMON_URL" \
  --secret-dir /run/synckhub-secrets

Common emails a six-digit verification code. The initializer creates the installation’s private signing key and Common infrastructure credential locally; Common receives only public identity and the credential hash. If the command stops or its 15-minute owner capability expires, rerun the exact same command. It resumes the same installation rather than creating new identities.

Create the owner password

Start the stack:

docker compose up -d

Open the printed bootstrap URL, or open https://<your-host>/login and paste the capability. The browser removes a capability supplied in the URL fragment before submitting the password. Common passwords and SynckHub administrator credentials cannot sign in to this installation.

The owner can then invite four more active users from self-hosting settings. Invitations bind a fixed recipient and repository role. A sixth active human is rejected by the free entitlement; repository data is not deleted if you later change plans.

Operate it

The release’s env/self-hosted/README.md is the normative operator runbook. It contains the exact upgrade, owner recovery, cold backup and restore, local signing-key rotation, and Common credential rotation procedures. Keep that runbook and the pinned deployment files with each backup.

Do not add vendor SSH keys, reverse tunnels, Common notify tokens, clearinghouse administrator tokens, support credentials, or plaintext secrets in .env. Explicitly federated content is still disclosed to its admitted federation route; local data that is not shared remains on the customer host.

Read the managed federation model for the trust boundary, benefits, limitations, and comparison with email-style decentralization.

Documentation

Manage Infrastructures