Your services, notes, maps and keys. On your own server.

• Services

  MOD 01

  Links to everything you run: the router, the NAS, the dashboards. Each service keeps an icon and a place in an order you choose, and opens in a new tab.

  • They fill the sidebar, the Services page and the command palette.
  • Icons in PNG, JPEG, WebP, GIF or SVG, checked by their content, never by their name.
  • The first page you see after signing in.

• Notes

  MOD 02

  A rich text editor with headings, lists, task lists, quotes, code blocks, links, tables and images. Notes save themselves while you type.

  • A revision history with restore, and a trash that empties itself after 30 days.
  • Changes from another tab or device are noticed instead of overwritten.
  • Images are uploaded straight into the note.

• Map Notes

  MOD 03

  Pins, lines and polygons on an OpenLayers map, each linked to a note, with the note editor right next to the map.

  • OpenStreetMap by default, or any raster tile server over https.
  • Stored in PostGIS and served as GeoJSON through the API.
  • Agents can place a pin and write its note in one call.

• Vault

  MOD 04

  Passwords and keys encrypted with AES-256-GCM. A value is revealed or copied only after you confirm your identity again.

  • Names, addresses and descriptions are searchable; values are not.
  • No API route and no MCP tool ever returns a value.
  • Rotate the encryption key from the command line.

• One owner, no sign-up

  The only account is created from your configuration on the first start. Nobody can register.

• Two-factor sign-in

  Authenticator codes that work once, backup codes of 120 bits and optional sign-in codes by email.

• Confirmation before it matters

  Revealing a secret, changing the password or ending sessions asks for your identity again.

• Careful password handling

  8 to 128 characters, checked against common passwords from SecLists and hashed with scrypt.

• Scoped, hashed API keys

  Stored as SHA-256 hashes, limited to the modules you choose, with an expiry date and a rate limit each.

• Strict browser policies

  A nonce-based Content Security Policy and security headers on every response, and a clean slate on sign-out.

• Append-only audit log

  Sign-ins, changes and every write through a key are recorded in a log the database refuses to rewrite.

• Limits everywhere

  Five sign-in attempts per minute, a rate limit per API key, sessions that end after 30 days and bounds on every input.

• Hardened container

  An unprivileged user, a read-only root filesystem and no capabilities. Each image carries a software bill of materials and a signed build attestation.

1. STEP 01

   Get the Compose file

   Clone the repository and create your configuration from the example file.

   Terminal

   git clone https://github.com/Rua-Systems/manifold.git
   cd manifold
   cp .env.example .env

2. STEP 02

   Set the secrets and the owner

   Generate BETTER_AUTH_SECRET and ENCRYPTION_KEY as two different outputs of openssl rand -base64 32, choose a URL-safe database password and fill in the owner. To try it locally, use ORIGIN=http://localhost:3000 and add ADDRESS_HEADER= and XFF_DEPTH= with empty values.

   .env

   MANIFOLD_VERSION=0.1
   ORIGIN=https://manifold.example.com
   POSTGRES_PASSWORD=<output of openssl rand -hex 32>
   BETTER_AUTH_SECRET=<output of openssl rand -base64 32>
   ENCRYPTION_KEY=<another output of openssl rand -base64 32>
   OWNER_USERNAME=you
   OWNER_EMAIL=you@example.com
   OWNER_PASSWORD=<8 to 128 characters>

3. STEP 03

   Start the containers

   Compose pulls the image in the version set by MANIFOLD_VERSION, where 0.1 follows the newest 0.1.x release, and starts the app next to its database. Open /login and sign in as the owner.

   Terminal

   docker compose up -d

• Migrations on start

  The database schema is brought up to date before the app accepts requests.

• Health check

  /healthz reports whether the database answers, for Docker and your monitoring.

• Backup and restore

  node cli.js backup and restore on the command line, and an export in the settings.

• Behind your proxy

  Documented setups for Caddy, Nginx and Coolify, where a release can deploy itself.

Keep copies of ENCRYPTION_KEY and BETTER_AUTH_SECRET outside the server: backups contain neither, and without the key the vault cannot be read. Manifold runs as a single instance, so never start more than one app container on the same database.

• SvelteKit
• Svelte 5
• TypeScript
• SCSS
• TipTap
• OpenLayers
• Better Auth
• Drizzle ORM
• PostgreSQL 17
• PostGIS
• Paraglide
• MCP TypeScript SDK
• Vitest
• Playwright
• Node.js 24