Running it on your own server

This page is for people who run their own servers. If that is not you, the hosted version does the same thing without the setup. You need PostgreSQL, a web server in front to handle HTTPS, and a domain you are not going to change later. There is no licence check and nothing phones home.

1 · start it

$ docker compose up -d

$ curl --fail http://127.0.0.1:3000/healthz

2 · read a secret

$ passoword read "ow://Personal/GitHub/password"

$ passoword inject --input app.env --output .env

$ passoword run -- terraform apply

The bundled Compose file is a local stack: fixed realm, loopback ports, development credentials. Do not put it on the internet. For a real deployment keep allow_plain_http off and leave Postgres, the metrics port and attachment storage on private networks. Defaults are in passoword.example.toml.

Things that bite later

Run passoword-server sweep on a schedule under a separate maintenance role. It clears expired authentication state, applies retention and retries attachment cleanup.

Put durable storage behind five things: the Postgres data, the stored files, and three keys. The OPAQUE key created during bootstrap, the ceremony-state key, and the email key.

The OPAQUE key is the one to worry about. Lose it and nobody can sign in again, on any account, and it cannot be regenerated. Back it up somewhere separate from the database.