Docker Compose (the only supported self-hosting path)

Trove ships one deployment: trove-core (the monolith), the web SPA container and PostgreSQL behind Traefik (which reaches Docker through a read-only socket proxy), defined in deploy/docker-compose.yml, driven by the ./trove wrapper script. There is no Kubernetes manifest and no supported bare-metal install — see ADR-0020 for why one deployment shape is enough for a single-household install.

deploy/README.md is the canonical, step-by-step guide — requirements and sizing, the 10-minute install, TLS modes, day-to-day commands, backup/restore, troubleshooting by symptom, and exactly what is and is not secured. This page exists only to point you there and stays short on purpose: duplicating that document here is how documentation like this drifted from the shipped system before the 2026-09 collapse (see ADR-0020).

The short version

git clone https://github.com/Harnoor6693/trove && cd trove/deploy
./trove bootstrap   # writes .env (0600) from .env.example, asks for domain, ACME email, admin email and country, generates the secrets
./trove up          # preflight, build from source, start, wait for readiness

./trove bootstrap asks for your domain, an email for certificate notices, the first admin address and country, generates every secret, and prints the admin password and backup passphrase once. If a deploy/.env already exists it only fills in the placeholder settings and empty secrets, and never overwrites a value you set. TLS mode is set in deploy/.env (TROVE_TLS_MODE). ./trove up then builds and starts the stack. ./trove status, ./trove logs, ./trove backup, and ./trove doctor cover day-to-day operation. Full detail, including the three TLS modes (acme-http, acme-dns, off/Tailscale) and the backup/restore mechanics, is in deploy/README.md.

Optional profiles

COMPOSE_PROFILES in deploy/.env turns on:

• ai — a local Ollama container on an internal network. Nothing calls it until a user points their own account at http://ollama:11434/v1 from Settings → AI. Also set TROVE_EGRESS_ALLOW_PRIVATE=true in deploy/.env (the server otherwise refuses plain-http and private targets) and enable the allow-private-endpoint option on the user's AI endpoint in Settings → AI.
• monitoring — Prometheus and Grafana, bound to 127.0.0.1 only (reach them over an SSH tunnel; they are never routed through Traefik). Set GRAFANA_ADMIN_PASSWORD in deploy/.env first; ./trove up refuses to start with this profile and no password.

Neither is required. See deploy/.env.example for every variable both profiles read.

For local development instead

If you're building Trove from source rather than deploying it, see the local development guide instead — it does not use deploy/docker-compose.yml.