Choose a path
| Systemd installer | Containers (Dokploy) | |
|---|---|---|
| Best for | A Linux server you manage by hand | A Dokploy or Docker Compose host |
| Database | SQLite on owner-only paths | SQLCipher, encrypted at rest |
| PDF reading | In the app | A sandboxed parser with no network |
| Guide | self-hosting.md | deploy-containers.md |
What you need
- Linux on amd64 or arm64.
- A hostname whose DNS and TLS you control, or loopback-only access.
- A Plunk sender and API key for password and invitation emails.
- Somewhere safe, off the server, for the master key and your backups.
Install with the systemd installer
Download the release files as a normal user, verify them, and only then run the installer. Replace the release tag and the values in the last command.
release=vX.Y.Z
stage=$(mktemp -d)
base="https://github.com/glnarayanan/mithra/releases/download/$release"
for name in RELEASE-MANIFEST RELEASE-MANIFEST.sig release-public-key.pem install.sh; do
curl --proto '=https' --tlsv1.2 --fail --silent --show-error --location \
--output "$stage/$name" "$base/$name"
done
fingerprint=$(openssl pkey -pubin -in "$stage/release-public-key.pem" -pubout -outform DER | sha256sum | awk '{print $1}')
test "$fingerprint" = 044843e7944e940c1dfe513f61425902fde751348bd4d7dedb4f10d8a0f720c9
openssl pkeyutl -verify -pubin -inkey "$stage/release-public-key.pem" -rawin \
-in "$stage/RELEASE-MANIFEST" -sigfile "$stage/RELEASE-MANIFEST.sig"
expected=$(awk '$1=="artifact" && $2=="install.sh" {print $4}' "$stage/RELEASE-MANIFEST")
test "$(sha256sum "$stage/install.sh" | awk '{print $1}')" = "$expected"
sudo env MITHRA_VERSION="$release" sh "$stage/install.sh" \
--domain mithra.example.com \
--proxy caddy \
--allowed-emails owner@example.com,partner@example.com \
--plunk-from 'Mithra <hello@mithra.example.com>' \
--plunk-key-file /secure/path/plunk.key
Run sudo mithra-installer plan with the same flags first if you want a
read-only preview. It never writes anything.
Install with containers
The repository’s docker-compose.yml runs two services from one image: the
app and a sandboxed PDF parser. Generate the master key once, store a copy
off the server, and mount it as a file, never as an environment variable.
openssl rand 32 | base64 | tr '+/' '-_' | tr -d '=\n'
The container guide covers the Dokploy settings, volumes, key mounts and admin commands.
After you install
- Open your hostname and use Set or reset your password for the first allowlisted adult. That person becomes the household owner.
- Invite the second adult from Settings.
- Optionally add an AI provider in Settings to turn on capture and import mapping.
- Confirm a backup exists, and keep one copy with the master key somewhere else.
More: user guide, operations, backup and restore.