mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-20 14:06:27 +00:00
Maurice
650451bdf7
A fourth built-in channel next to email, webhook and ntfy. Browsers register per device, the server encrypts per RFC 8291 and signs per RFC 8292 with node:crypto and sends only to known push services through the SSRF guard. The event matrix decides per category what arrives by push; admins switch the channel on under Notifications. VAPID keys come from the environment or are generated once, only while neither stored row exists, and kept encrypted. A pair that does not decrypt or match is never overwritten and never swapped for another one: push stays off with an error in the log and every device stays registered until the key is fixed. The subject is VAPID_SUBJECT, then an https APP_URL, then the project URL. Only chat messages collapse into one notification per trip, and a replacement still alerts. A 403 removes a device only after three failures in a row; 404 and 410 remove it at once. Password change, reset and an admin setting a password drop the user's devices with the other credentials. The request log redacts subscriptions and endpoints, boot errors print *** for every secret variable, and logout forgets the device with a plain fetch so an expired session cannot redirect midway. Addresses discussion #894.
74 lines
3.4 KiB
Markdown
74 lines
3.4 KiB
Markdown
# Install: Unraid
|
|
|
|
Install TREK on Unraid via Community Applications or a direct template import.
|
|
|
|
<!-- TODO: screenshot: Unraid container template settings -->
|
|
|
|
## Prerequisite
|
|
|
|
Docker must be enabled in Unraid (**Settings → Docker → Enable Docker: Yes**).
|
|
|
|
## Install via Community Applications
|
|
|
|
1. Open the **Apps** tab in Unraid.
|
|
2. Search for **TREK**.
|
|
3. Click **Install** on the TREK result.
|
|
|
|
If the app does not appear, you can install directly from the template URL. In **Docker → Add Container**, paste the template URL:
|
|
|
|
```
|
|
https://raw.githubusercontent.com/liketrek/TREK/main/unraid-template.xml
|
|
```
|
|
|
|
## Template Fields
|
|
|
|
The Unraid template exposes the following fields in the container UI:
|
|
|
|
### Ports & Paths
|
|
|
|
| Field | Container path | Default host value |
|
|
|---|---|---|
|
|
| Web UI Port | `3000/tcp` | `3000` |
|
|
| Data | `/app/data` | `/mnt/user/appdata/trek/data` |
|
|
| Uploads | `/app/uploads` | `/mnt/user/appdata/trek/uploads` |
|
|
|
|
### Core Variables (always visible)
|
|
|
|
| Variable | Default | Notes |
|
|
|---|---|---|
|
|
| `ENCRYPTION_KEY` | *(empty)* | Set on first install. Generate with `openssl rand -hex 32` in the Unraid terminal. |
|
|
| `TZ` | `UTC` | Timezone for logs, reminders, and scheduled tasks (e.g. `Europe/Berlin`) |
|
|
| `ALLOWED_ORIGINS` | *(empty)* | Comma-separated origins for CORS and email notification links, e.g. `https://trek.example.com` |
|
|
| `APP_URL` | *(empty)* | Public base URL; required when OIDC is enabled (must match the redirect URI registered with your IdP) |
|
|
| `ADMIN_EMAIL` | `admin@trek.local` | Email for the first admin account (first-boot only; no effect once any user exists). Pre-filled by the template — must be set together with `ADMIN_PASSWORD`, otherwise both are ignored. |
|
|
| `ADMIN_PASSWORD` | *(empty)* | Password for the first admin account (first-boot only). Must be set together with `ADMIN_EMAIL`. If either is omitted, TREK creates the account with email `admin@trek.local` and a random password printed to the container log. |
|
|
|
|
### Advanced Variables
|
|
|
|
Additional variables (`PORT`, `NODE_ENV`, `LOG_LEVEL`, `TREK_WIKI_DIR`, `DEFAULT_LANGUAGE`, `FORCE_HTTPS`, `HSTS_INCLUDE_SUBDOMAINS`, `TRUST_PROXY`, `COOKIE_SECURE`, `ALLOW_INTERNAL_NETWORK`, `SESSION_DURATION`, `SESSION_DURATION_REMEMBER`, all OIDC variables, `MCP_RATE_LIMIT`, `MCP_MAX_SESSION_PER_USER`, `DEMO_MODE`, `UNSPLASH_ACCESS_KEY`, `VAPID_PUBLIC_KEY`, `VAPID_PRIVATE_KEY`, `VAPID_SUBJECT`) are available under **Advanced View** in the template editor.
|
|
|
|
## Setting the Encryption Key
|
|
|
|
Generate a key in the Unraid terminal (**Tools → Terminal**):
|
|
|
|
```bash
|
|
openssl rand -hex 32
|
|
```
|
|
|
|
Copy the output into the `ENCRYPTION_KEY` field before starting the container for the first time. If you skip this, TREK auto-generates a key and saves it to `data/.encryption_key` — your data is still protected, but you should record that file in your backups.
|
|
|
|
## After Install
|
|
|
|
Once the container starts, open your browser at:
|
|
|
|
```
|
|
http://<unraid-ip>:<port>
|
|
```
|
|
|
|
On first boot, TREK automatically creates an admin account. The credentials are printed to the container log — check **Docker → trek → Log** in the Unraid UI. If you set both `ADMIN_EMAIL` and `ADMIN_PASSWORD`, those values are used; otherwise the email is `admin@trek.local` and a random password is generated.
|
|
|
|
## Next Steps
|
|
|
|
- [Environment-Variables](Environment-Variables) — complete variable reference
|
|
- [Updating](Updating) — how to pull a new image on Unraid
|