Getting started

LogSure is one process that keeps its data in SQLite today, with Postgres and MySQL on the way. The image ghcr.io/logsure/server holds the engine and the web console, so one container is the whole service: the console, its API, the ingest API your apps call, and the MCP server for AI assistants.

This page gets a server running on your machine and your first app counting. The full guide, with HTTPS, backups, upgrades and every setting, is docs/self-hosting.md in logsure/server.

Docker Compose

You need Docker with Compose 2.24 or later.

git clone https://github.com/logsure/server && cd server
cp .env.example .env

Fill in .env:

ADMIN_PASSWORD: the root password, 20 characters or more.
DATA_KEY: the output of openssl rand -hex 32. It seals email addresses at rest; keep it with your backups.

docker compose up -d

Open http://localhost:8080 and sign in with any username and ADMIN_PASSWORD. The data lives in the logsure-data volume: docker compose down keeps it, docker compose down -v deletes it.

Docker

The quickest start: generate a password and run the image. Sign in at http://localhost:8080 with any username and that password.

PASSWORD=$(uuidgen); echo "Password: $PASSWORD"
docker run -d --name logsure -p 8080:8080 -e ADMIN_PASSWORD=$PASSWORD \
  -e CONSOLE_HOST=localhost:8080 -e COOKIE_SECURE=0 ghcr.io/logsure/server

That container keeps its data only while it exists. For an install you keep, add a named volume for the data, a DATA_KEY that seals email addresses at rest, and a restart policy (remove the quick-start container first with docker rm -f logsure):

export ADMIN_PASSWORD=$(uuidgen) DATA_KEY=$(openssl rand -hex 32)
echo "ADMIN_PASSWORD=$ADMIN_PASSWORD DATA_KEY=$DATA_KEY"   # keep both
docker run -d --name logsure --restart unless-stopped -p 8080:8080 -v logsure-data:/data \
  -e ADMIN_PASSWORD -e DATA_KEY -e CONSOLE_HOST=localhost:8080 \
  -e COOKIE_SECURE=0 -e TRUST_PROXY=0 ghcr.io/logsure/server:latest

The image runs as uid 1000, keeps everything in /data, listens on 8080 and has a health check on /_care/health. It is built for amd64 and arm64. Tags: latest and a version such as 0.1.0 for releases, main for the newest commit.

The binary

Build with Rust 1.88 or later, fetch the console, and run:

git clone https://github.com/logsure/server && cd server
cargo build --release -p logsure-server
git clone https://github.com/logsure/web
ADMIN_PASSWORD=… DATA_KEY=… CONSOLE_HOST=localhost:8080 COOKIE_SECURE=0 TRUST_PROXY=0 \
  DATA_DIR=./data WEB_DIR=./web ./target/release/logsure-server

It stops cleanly on SIGINT or SIGTERM. Run it under systemd or another supervisor that restarts it. Without WEB_DIR the engine serves only its APIs, for installs that use only the apps or host the console elsewhere.

On a real domain

Put LogSure behind a proxy that terminates TLS, set CONSOLE_HOST to the console's host (for example logsure.example.com) and leave COOKIE_SECURE at its default, 1. The repository has a Caddy file for Compose that gets the certificate for you:

# in .env: DOMAIN=logsure.example.com
docker compose -f docker-compose.yml -f docker-compose.caddy.yml up -d

See HTTPS in the self-hosting guide for other proxies and TRUST_PROXY.

How far does one server go?

One server handles most teams comfortably. At very high volume, tens of millions of events a month, or when you need high availability, the multi-node Cloud and Enterprise plans are the path: a cluster that is managed automatically, run by us or in your own infrastructure. Both are offered on request; see Pricing.

LogSure on one server is open source under the MPL-2.0, with every feature. The managed multi-node cluster is a commercial offering, as Cloud or as an Enterprise self-hosted licence.

The main settings

Variable	Default
`ADMIN_PASSWORD`		The root password (20 characters or more); without it the console is closed
`CONSOLE_HOST`		The console's host, required with `ADMIN_PASSWORD`
`DATA_KEY`		32 bytes (64 hex characters) that seal email addresses at rest
`DATA_DIR`	`./data`	`care.db`, attachments, app icons and backups
`PORT`	`8080`	Where to listen
`PUBLIC_PREFIX`	`/_care`	The ingest API's path on every host
`TRUST_PROXY`	`cloudflare`	Whose headers give the visitor's address and country; `0` for none
`COOKIE_SECURE`	`1`	`0` for plain http in development
`NOTIFY_WEBHOOK`		An https:// webhook for new requests and signups

Retention, daily caps, attachment sizes and backups have settings too; every variable is in the self-hosting guide.

Your first app

Sign in. The first time, any username works with ADMIN_PASSWORD.
Under Settings › Apps, add an app: an id such as acme-notes, a name, and the domains it runs on (localhost:5173 while developing).
Open the app's page in Settings: its Setup section has every snippet filled in for that app. Add the script tag to your site; see Add the tracker.
Open your site. The visit shows on the overview within a few seconds.

Under Settings › Security, set your own username and password and turn on two-factor sign-in. The iPhone, Mac and terminal apps and AI connections need two-factor sign-in on, because they skip the password.

Locked out

Start the engine once with TOTP_RESET=1 (turns two-factor sign-in off) or PASSWORD_RESET=1 (deletes the username and password set in the console, so ADMIN_PASSWORD signs in again), then remove it.