Self-host Coral Dash with Docker

Visit coraldash.com/self-hosting and either:

• Start a 7-day free trial — instant, no card required
• Purchase a permanent licence — £30 one-time via Stripe

Your key (a UUID) appears in your account settings. Copy it.

Clone the public setup repository:

git clone https://github.com/coraldash/self-hosted.git coraldash
cd coraldash
cp .env.example .env

You should now have docker-compose.yml, .env.example, docker/kong.yml, and docker/generate-keys.sh.

First generate three secrets in your terminal and keep the output of each:

openssl rand -hex 24     # -> POSTGRES_PASSWORD
openssl rand -base64 32  # -> JWT_SECRET
openssl rand -hex 16     # -> CRON_SECRET

Then edit .env and paste them in alongside your other values:

# Your licence key (trial or permanent)
LICENSE_KEY=xxxxxxxx-xxxx-4xxx-xxxx-xxxxxxxxxxxx

# Your domain (or http://your-server-ip:3000 for a LAN trial, v3.1.1+)
SITE_URL=https://coraldash.yourdomain.com

# Paste the secrets generated above
POSTGRES_PASSWORD=paste-hex-output-here
JWT_SECRET=paste-base64-output-here
CRON_SECRET=paste-hex-output-here

# Google OAuth (see the Google OAuth section below)
GOOGLE_OAUTH_CLIENT_ID=your-google-client-id
GOOGLE_OAUTH_CLIENT_SECRET=your-google-client-secret

POSTGRES_PASSWORD must contain only letters and digits — it is embedded in postgres:// connection URLs, so characters like / + @ : # ? break the stack (base64 output usually contains / or +). Note that .env files are read literally: $(...) commands are not executed there, which is why you generate the values in the terminal first.

The bundled script derives ANON_KEY and SERVICE_ROLE_KEY from the JWT_SECRET in your .env:

chmod +x docker/generate-keys.sh
./docker/generate-keys.sh

Copy the two output keys into .env. (You can also pass the secret directly: ./docker/generate-keys.sh YOUR_JWT_SECRET.)

docker compose up -d

This starts five services: PostgreSQL, GoTrue (Supabase auth), PostgREST, Kong (API gateway), and the Coral Dash app.

On first boot, the app activates your licence (one HTTPS call to coraldash.com), runs database migrations, and starts the web server plus cron scheduler. After activation, the container runs fully offline — no telemetry, no phone-home.

Just trying it out? From v3.1.1 you can skip the reverse proxy entirely: set SITE_URL=http://your-server-ip:3000 in .env, open that address, and create an account with email and password. The app routes the Supabase API internally. A domain, HTTPS, and the reverse proxy below are only needed for Google sign-in and production use.

Optional for a LAN trial with email/password (see step 5, v3.1.1+), but Google sign-in and production use need HTTPS on a domain. Your reverse proxy must route both the Next.js app (port 3000) and the Supabase API gateway (port 8000) through the same domain — the browser reaches Supabase auth and REST APIs at /auth/v1/ and /rest/v1/ on your domain.

We recommend Caddyfor automatic Let's Encrypt certificate management:

sudo apt install -y caddy

sudo tee /etc/caddy/Caddyfile << 'EOF'
coraldash.yourdomain.com {
    # Supabase Auth API
    handle /auth/v1/* {
        reverse_proxy localhost:8000
    }

    # Supabase REST API
    handle /rest/v1/* {
        reverse_proxy localhost:8000
    }

    # Next.js application
    handle {
        reverse_proxy localhost:3000
    }
}
EOF

sudo systemctl reload caddy

For Nginx or Traefik, see docker/nginx.conf.example in the setup repository — the rule is the same: /auth/v1/* and /rest/v1/* must proxy to Kong (port 8000), everything else to Next.js (port 3000).

Visit https://coraldash.yourdomain.com, sign in with Google, and follow the onboarding flow to pick the Google Sheet holding your Monzo export. The first sync runs immediately, then daily at 06:00 UTC by default (configurable via SYNC_SCHEDULE).