Maurice
650451bdf7
A fourth built-in channel next to email, webhook and ntfy. Browsers register per device, the server encrypts per RFC 8291 and signs per RFC 8292 with node:crypto and sends only to known push services through the SSRF guard. The event matrix decides per category what arrives by push; admins switch the channel on under Notifications. VAPID keys come from the environment or are generated once, only while neither stored row exists, and kept encrypted. A pair that does not decrypt or match is never overwritten and never swapped for another one: push stays off with an error in the log and every device stays registered until the key is fixed. The subject is VAPID_SUBJECT, then an https APP_URL, then the project URL. Only chat messages collapse into one notification per trip, and a replacement still alerts. A 403 removes a device only after three failures in a row; 404 and 410 remove it at once. Password change, reset and an admin setting a password drop the user's devices with the other credentials. The request log redacts subscriptions and endpoints, boot errors print *** for every secret variable, and logout forgets the device with a plain fetch so an expired session cannot redirect midway. Addresses discussion #894.
3.4 KiB
Install: Unraid
Install TREK on Unraid via Community Applications or a direct template import.
Prerequisite
Docker must be enabled in Unraid (Settings → Docker → Enable Docker: Yes).
Install via Community Applications
- Open the Apps tab in Unraid.
- Search for TREK.
- Click Install on the TREK result.
If the app does not appear, you can install directly from the template URL. In Docker → Add Container, paste the template URL:
https://raw.githubusercontent.com/liketrek/TREK/main/unraid-template.xml
Template Fields
The Unraid template exposes the following fields in the container UI:
Ports & Paths
| Field | Container path | Default host value |
|---|---|---|
| Web UI Port | 3000/tcp |
3000 |
| Data | /app/data |
/mnt/user/appdata/trek/data |
| Uploads | /app/uploads |
/mnt/user/appdata/trek/uploads |
Core Variables (always visible)
| Variable | Default | Notes |
|---|---|---|
ENCRYPTION_KEY |
(empty) | Set on first install. Generate with openssl rand -hex 32 in the Unraid terminal. |
TZ |
UTC |
Timezone for logs, reminders, and scheduled tasks (e.g. Europe/Berlin) |
ALLOWED_ORIGINS |
(empty) | Comma-separated origins for CORS and email notification links, e.g. https://trek.example.com |
APP_URL |
(empty) | Public base URL; required when OIDC is enabled (must match the redirect URI registered with your IdP) |
ADMIN_EMAIL |
admin@trek.local |
Email for the first admin account (first-boot only; no effect once any user exists). Pre-filled by the template — must be set together with ADMIN_PASSWORD, otherwise both are ignored. |
ADMIN_PASSWORD |
(empty) | Password for the first admin account (first-boot only). Must be set together with ADMIN_EMAIL. If either is omitted, TREK creates the account with email admin@trek.local and a random password printed to the container log. |
Advanced Variables
Additional variables (PORT, NODE_ENV, LOG_LEVEL, TREK_WIKI_DIR, DEFAULT_LANGUAGE, FORCE_HTTPS, HSTS_INCLUDE_SUBDOMAINS, TRUST_PROXY, COOKIE_SECURE, ALLOW_INTERNAL_NETWORK, SESSION_DURATION, SESSION_DURATION_REMEMBER, all OIDC variables, MCP_RATE_LIMIT, MCP_MAX_SESSION_PER_USER, DEMO_MODE, UNSPLASH_ACCESS_KEY, VAPID_PUBLIC_KEY, VAPID_PRIVATE_KEY, VAPID_SUBJECT) are available under Advanced View in the template editor.
Setting the Encryption Key
Generate a key in the Unraid terminal (Tools → Terminal):
openssl rand -hex 32
Copy the output into the ENCRYPTION_KEY field before starting the container for the first time. If you skip this, TREK auto-generates a key and saves it to data/.encryption_key — your data is still protected, but you should record that file in your backups.
After Install
Once the container starts, open your browser at:
http://<unraid-ip>:<port>
On first boot, TREK automatically creates an admin account. The credentials are printed to the container log — check Docker → trek → Log in the Unraid UI. If you set both ADMIN_EMAIL and ADMIN_PASSWORD, those values are used; otherwise the email is admin@trek.local and a random password is generated.
Next Steps
- Environment-Variables — complete variable reference
- Updating — how to pull a new image on Unraid