Maurice
44c92052a3
Every page was read against the code on dev. What changed: - Pages that described 4.2 behaviour: satellite view on the vector maps, the mobile journal timeline, Collab with its fifth tab, the Review badge, clustered pins on the share page, the Leaflet preset list, the strict guard on fe80::/10, the invite link tools and their scopes, the Public API scope rules, the permission count in the plugin SDK. - Features of this release that no page mentioned: videos in a journal entry, receipts on an expense, the Google transit backend, routing counters, the rating on a place, the navigation menu, car stops, the manual school holiday catalogue and its MCP tools, the Dawarich panel in the Atlas, the release notes modal, plugin frames going fullscreen, the corridor call into the search provider hook. - Statements that sent an admin the wrong way: DEFAULT_LANGUAGE is not in the Helm ConfigMap, env.PORT cannot be changed on the chart alone, the rotation script does not cover the document sync credentials, event handlers cannot broadcast, there is no per user MFA reset in the admin panel, the demo user can edit, an unparsable APP_URL stops the server. - Updating gets a section for 4.3.0: the TREK Places API as the new default, the new variables, the Overpass timeout, SSO sessions on an OIDC only instance, the migration that puts booked nights on the drive.
3.6 KiB
Install: Docker
Single-container Docker run — suitable for testing or simple personal installs.
Run Command
docker run -d \
--name trek \
-p 3000:3000 \
-v ./data:/app/data \
-v ./uploads:/app/uploads \
-e ENCRYPTION_KEY=<your-32-byte-hex-key> \
--restart unless-stopped \
mauriceboe/trek:latest
ENCRYPTION_KEY is strongly recommended but not strictly required. If omitted, a key is auto-generated on first start and persisted to data/.encryption_key. Setting it explicitly means you can recreate the container from scratch (e.g. on a new host) without losing access to stored encrypted data (API keys, SMTP credentials, OIDC secrets, MFA secrets).
Generate an encryption key with:
openssl rand -hex 32
Common optional variables
Pass additional -e flags for timezone and CORS/email link support:
-e TZ=Europe/Berlin \
-e ALLOWED_ORIGINS=https://trek.example.com \
See Environment-Variables for the full list.
Image Tags
| Tag | Example | Behavior |
|---|---|---|
latest |
mauriceboe/trek:latest |
Always the newest release across all major versions |
| Major version | mauriceboe/trek:4 |
Latest release pinned to that major version |
| Full version | mauriceboe/trek:4.0.0 |
Exact release; never changes |
Replace mauriceboe/trek:latest in the run command with your chosen tag to pin to a major version or exact release.
Volume Reference
| Volume | Container path | What lives there |
|---|---|---|
./data |
/app/data |
travel.db (SQLite database), logs/trek.log, .jwt_secret, .encryption_key |
./uploads |
/app/uploads |
Uploaded files (photos, documents, covers, avatars) |
Both volumes must survive container replacement — they are your persistent state. Never remove them before pulling a new image.
Named Volumes
The run command above uses bind mounts (./data, ./uploads). You can use Docker named volumes instead, which are fully managed by Docker and not tied to a host path:
docker run -d \
--name trek \
-p 3000:3000 \
-v trek_data:/app/data \
-v trek_uploads:/app/uploads \
-e ENCRYPTION_KEY=<your-32-byte-hex-key> \
--restart unless-stopped \
mauriceboe/trek:latest
Docker creates trek_data and trek_uploads automatically on first run. Named volumes are easier to manage with docker volume commands and work better in some NAS or container-management environments.
Health Check
The container exposes a health endpoint at:
http://localhost:3000/api/health
Docker polls it automatically (interval: 30 s, timeout: 5 s, retries: 3, start period: 15 s). You can check it manually:
curl -s http://localhost:3000/api/health
Verify the Container Is Running
docker ps --filter name=trek
docker logs trek
Limitations of docker run
A bare docker run command has no built-in secret management and is harder to reproduce after a system reboot. For production, see Install-Docker-Compose, which adds security hardening (read_only, cap_drop, cap_add, no-new-privileges, tmpfs) and makes it easy to manage environment variables through a .env file.
Next Steps
- Reverse-Proxy — HTTPS is required for PWA install and the
trek_sessioncookiesecureflag - Install-Docker-Compose — recommended for production
- Environment-Variables — full list of configurable variables
- Updating — how to pull a new image without losing data