Your family's diary, on your own server.

Starting in three steps

The image lives in the GitHub Container Registry, for amd64 and arm64. It holds the interface and the server together; nexdiary needs no second database and no web server of its own.

1. Create the compose file

   Make a folder, for example nexdiary, and put this file in it.

   docker-compose.ymlCopy

   services:
     nexdiary:
       image: ghcr.io/derkezorm/nexdiary:latest
       container_name: nexdiary
       restart: unless-stopped
   
       ports:
         # Only this machine reaches nexdiary (127.0.0.1). Put a reverse proxy
         # with https in front and let it forward to http://127.0.0.1:8550.
         # Straight from your home network: write "8550:8000", but only on a
         # network you trust. Without https, passwords cross it in the clear.
         - "127.0.0.1:8550:8000"
   
       # Nothing it does not need: the start only sets the owner of /data,
       # then drops from root to the user nexdiary.
       security_opt:
         - no-new-privileges:true
       cap_drop:
         - ALL
       cap_add:
         - CHOWN
         - DAC_READ_SEARCH
         - SETUID
         - SETGID
   
       volumes:
         # A local disk, never an SMB or NFS share.
         - ./data:/data
   
       environment:
         PUID: 1000
         PGID: 1000
         TZ: Europe/Berlin
         # Behind a proxy: the address people use, and the proxy's.
         # NEXDIARY_PUBLIC_URL: https://diary.example.com
         # NEXDIARY_TRUSTED_PROXIES: 172.16.0.0/12
         # Choose the setup code yourself instead of finding it in the log.
         # NEXDIARY_SETUP_TOKEN: choose-a-long-one

2. Start it
   ShellCopy

   docker compose up -d

3. Create the first account

   On that machine, open http://127.0.0.1:8550. The page “Set up nexdiary” asks for a name, a password and the setup code. nexdiary writes the code to its log on every start until it is set up:

   ShellCopy

   docker logs nexdiary

   That way nobody takes over a fresh instance just because they found it first. Whoever creates the first account becomes the operator. The password needs at least twelve characters, and straight afterwards the account sets up its second factor. nexdiary then shows eight recovery codes; keep them somewhere safe.

What the machine needs

nexdiary is built for a household, not a data centre. There is no measured minimum for memory; what takes a lot is listed here with figures from the code.

• Docker with Compose on Linux, amd64 or arm64. That covers a NAS with Intel, AMD or ARM and a computer with 64-bit ARM.
• A local disk for the data folder. On an SMB or NFS share SQLite does not lock reliably, and the database can break.
• Memory: a password check takes up to 64 MiB, and at most four run at once. A photo takes about 150 MB while it is unpacked, and by default only one is unpacked at a time (NEXDIARY_DECODE_SLOTS). The server sets one year as a book at a time.
• Space: nexdiary stores photos redrawn as WebP, at most 2560 pixels on the long side, plus a small preview. By default each person may use 5 GB; you change that under Settings, Accounts, “Storage per person”, where 0 means no limit.
• https through a reverse proxy as soon as anyone comes in from outside. Push and passkeys need it in the home network too.
• Phones: nexdiary is a web app and can be added to the home screen from the browser. There is no app in a store. On an iPhone, push only arrives in the app on the home screen, from iOS 16.4.

Behind a proxy, with https

Many people will want to open nexdiary when they are out and about, and it is made for that. Before you open it to the outside, go through this list.

1. Set up first, then open up

   Create the first account from your own network, with the code from the log. Only after that do you forward a port.

2. https at the proxy, nexdiary only through it

   Leave the port on 127.0.0.1, or keep the proxy and nexdiary on a Docker network with no published port. HSTS comes from the proxy, not from nexdiary.

3. Name the address and the proxy

   NEXDIARY_PUBLIC_URL is the address at which the family reaches nexdiary. Invitation links, the return from the sign-in provider, passkeys and the contact for push are built from it; the setting “Public address” in the interface wins when it is set. NEXDIARY_TRUSTED_PROXIES names the address or network of the proxy. Without it every sign-in seems to come from the proxy, and the protection against guessing takes everybody for one person.

4. Cookies over https only

   NEXDIARY_COOKIE_SECURE is auto by default and also recognises https from the proxy's X-Forwarded-Proto header. on suits a nexdiary that is reached over https only; over plain http nobody can sign in any more.

5. The second factor stays required

   By default every account with a password sets one up right after signing in, a code from an authenticator app; a passkey can be added afterwards. The operator could switch that off. For a server on the internet, leave it on.

6. Leave off what you do not need

   The AI, Immich and API tokens are off by default, and so is writing up automatically in the morning. Switch on only what the family really uses.

7. Keep the operator settings at home

   With NEXDIARY_OPERATOR_NETWORKS: "192.168.0.0/16", nexdiary accepts changes to the operator's settings only from that network, behind a proxy together with NEXDIARY_TRUSTED_PROXIES.

8. Pin a version

   Use a fixed version such as ghcr.io/derkezorm/nexdiary:0.5.0 instead of latest, update on purpose and back up first.

nexdiary checks itself

Under Settings, Sign-in, the card “Ready for the internet?” sits right at the top. Every time you open the page, nexdiary checks eight points itself and says for each one what to do if it is not met.

• “Public address with https” and “Sessions and cookies”
• “Second factor for everybody” and “Your own account”, meaning whether you have one yourself
• “Protection against guessing”, which nexdiary tries out on a copy, and “Behind the proxy”, whether the visitors' real addresses arrive
• “Entries encrypted” and “Master key saved”

Settings

On Unraid

What you need to back up

Two things, kept apart from each other: the data folder with its backups, and the master key. Without the master key no backup can be read, not even by you.

Updating

docker compose pull
docker compose up -d

When someone has forgotten their password

Nobody sets a password for somebody else, the operator included. Whoever forgot theirs gets a link and uses it to choose a new one. The link works once and for 24 hours.

docker exec -it -u nexdiary nexdiary python -m app.reset_link your-name

All environment variables

Only what has to be fixed before the first start is listed here. The operator sets everything else in the interface.