Docker Self-Hosting#

Docker Compose is the primary recommended method for self-hosting Sure. Two compose templates are provided: a standard setup (compose.example.yml) and an AI-extended setup (compose.example.ai.yml). The official setup guide lives at docs/hosting/docker.md.

Services#

The standard compose file defines five services on a shared sure_net bridge network:

• web and worker share the same image; worker overrides command: bundle exec sidekiq 1.
• Both web and worker mount the app-storage volume and depend on db and redis health checks 2.
• db and redis each have health checks and dedicated named volumes (postgres-data, redis-data) 3.
• The backup service is opt-in via --profile backup and retains 7 daily, 4 weekly, and 6 monthly snapshots by default 4.

Both web and worker use Google and Cloudflare DNS (8.8.8.8, 1.1.1.1) to avoid IPv6-first resolution issues with external services like Yahoo Finance 5.

Key Environment Variables#

Shared Rails config is set via a YAML anchor &rails_env 6:

For hardened deployments, generate a custom SECRET_KEY_BASE with openssl rand -hex 64 and set POSTGRES_PASSWORD in a .env file 7.

Setup Quickstart#

Full instructions are in docs/hosting/docker.md. The abbreviated flow:

# 1. Download the compose file
curl -o compose.yml https://raw.githubusercontent.com/we-promise/sure/main/compose.example.yml

# 2. (Recommended) Create .env with SECRET_KEY_BASE and POSTGRES_PASSWORD
curl -o .env https://raw.githubusercontent.com/we-promise/sure/main/.env.example

# 3. Start
docker compose up -d
# App is available at http://localhost:3000

Updates: Pull the new image, rebuild, and restart only the app containers 8:

docker compose pull
docker compose build
docker compose up --no-deps -d web worker

Image tags available at ghcr.io/we-promise/sure: stable (latest release) and latest (latest alpha) 9.

Optional: HTTPS, IPv6, WebAuthn#

• HTTPS behind a reverse proxy: Set RAILS_ASSUME_SSL: "true" in compose.yml 10.
• IPv6 dual-stack: Add "[::]:${PORT:-3000}:3000" to web ports and set BINDING: "::" in its environment 11.
• WebAuthn MFA (passkeys): Pin WEBAUTHN_RP_ID and WEBAUTHN_ALLOWED_ORIGINS in .env before enabling passkeys 12.
• Signup control: After first-account creation, configure open / invite-only / closed registration under Settings > Self-Hosting > Onboarding 13.

AI Compose Extension (compose.example.ai.yml)#

compose.example.ai.yml extends the standard setup with AI-focused services 14:

• In this compose file db uses pgvector/pgvector:pg16 instead of plain postgres:16 to support vector embeddings 15.
• Pipelock runs on port 8888 (forward proxy for outbound HTTPS) and port 8889 (MCP reverse proxy for inbound AI agent traffic) 16. External AI clients should target port 8889 rather than Sure's /mcp endpoint directly.
• See docs/hosting/docker.md — AI features section for full AI setup instructions.

Troubleshooting#

• ActiveRecord::DatabaseConnectionError on first start: Postgres volume may be initialized with a different role. Reset with docker compose down && docker volume rm sure_postgres-data 17.
• Slow CSV import: Requires the worker to communicate with Redis; check worker logs for Redis timeouts 18.
• Yahoo Finance / IPv6 TCP errors: The dns override in compose.yml to 8.8.8.8/1.1.1.1 mitigates most cases; alternatively add extra_hosts entries for specific Yahoo Finance IP addresses 19.