Mault / Self-hosting guide

Run Mault on your own server

Run Mault on your own hardware. Pick your setup and the guide shows only the steps you need. Progress is saved in this browser.

01 / Your setup

Choose your setup

Your choices are saved in the URL, so you can bookmark or share this guide.

Where are you hosting?

Accounts and database

02 / Requirements

0/4

Before you start

What to have ready.

02.01Docker with Compose v2. This should print a version.
```
docker compose version
```
02.02Git.
02.03Outbound access to huggingface.co for the scanner's model. Allowlist it in DNS blockers such as Pi-hole.
02.04Optional: a domain and an HTTPS reverse proxy for access outside your network.

03 / Configure

0/5

Configure

All settings live in one .env file in the repository root.

03.01Clone the repository.

git clone https://github.com/dishwasher-detergent/mault.git
cd mault

03.02Copy the self-hosted example config.
```
cp .env.docker.example .env
```
03.03Set POSTGRES_PASSWORD, OWN_AUTH_TOKEN_PEPPER, IMPERSONATION_SECRET and MONITOR_LINK_SECRET, each to its own random value.
```
openssl rand -hex 32
```
Run the command once per secret.
03.04Set WEB_URL to the address people will open, without a trailing slash. Keep http://localhost:8080 for a single machine.
03.05Set CARD_API_USER_AGENT to a name unique to your install, such as MyMault/1.0. Sources block names that overuse them.

04 / Start

0/3

Start the stack

Compose builds the images and starts every service.

04.01Build and start in the background.
```
docker compose up --build -d
```
04.02Watch the server start. It runs the database migrations itself.
```
docker compose logs -f server
```
04.03Web app :8080, API docs :8081, API :3001. Postgres listens only on 127.0.0.1:5433.

05 / First sign-in

0/3

Create your account

05.01Open your WEB_URL and sign up. The first account becomes platform admin with a Home organization.
Email verification, password editing, multi-session management and social sign-in need Neon.
05.02In /app/admin, add a game in the Games Manager and run its sync. Scans can't match until one has synced.

05.03Optional: make another user platform admin. There's no screen for it yet.

INSERT INTO platform_user_roles (user_id, role)
VALUES ('<own_auth_users.id>', 'admin')
ON CONFLICT (user_id) DO UPDATE SET role = 'admin';

06 / Prices

0/2

Schedule price sync

Prices come from TCGplayer, Cardmarket and Card Kingdom. Sync once a day, never more often: sources block installs that poll harder.

06.01Add this with crontab -e, replacing /opt/mault with your docker-compose.yml folder.

0 4 * * * cd /opt/mault && docker compose exec -T server sh -c 'if [ "$AUTH_PROVIDER" = local ]; then export DATABASE_URL="${DATABASE_URL:-postgresql://mault:$POSTGRES_PASSWORD@postgres:5432/mault}" DATABASE_SSL="${DATABASE_SSL:-false}"; fi; exec node packages/server/dist/scripts/sync-prices.js' >> /var/log/mault-prices.log 2>&1

Failed runs aren't retried. The next daily run catches up.

06.02After your first game sync, run the command once by hand. Cards have no price until then. Logs go to /var/log/mault-prices.log.

07 / Extras

0/4

Optional features

Each stays off until its variables are set. Restart or redeploy after changes.

07.01Discord bot: set DISCORD_BOT_TOKEN, DISCORD_CLIENT_ID and BOT_API_SECRET, then start with the bot profile.
```
docker compose --profile bot up --build -d
```
07.02File storage: point SCAN_IMAGE_BUCKET and the AWS_* variables at any S3-compatible bucket. Otherwise files are kept in Postgres.
07.03Email: set RESEND_API_KEY and RESEND_FROM_EMAIL for password resets and invites. Otherwise invites are link-only.
07.04Wi-Fi sorters: set SORTER_LINK_URL (or API_URL) to an address the sorter board can reach.

08 / Maintenance

0/3

Updates and backups

Stay current and protect your data.

08.01Pull and rebuild. Migrations run on start-up.
```
git pull
docker compose up --build -d
```

08.02Back up the mault-postgres volume regularly.

docker compose exec -T postgres pg_dump -U mault mault > mault-backup.sql

08.03Don't rotate secrets casually. A new OWN_AUTH_TOKEN_PEPPER signs everyone out, and changing POSTGRES_PASSWORD doesn't update the existing database.