Run Rebalio on your own host

Requirements

• Docker with Docker Compose installed and running. Use Docker Desktop on macOS/Windows, or Docker Engine and the Compose plugin on Linux.
• An amd64 (x86-64) or arm64 host, internet access to pull the image and connect to exchanges, and a terminal that supports the commands below (use WSL on Windows).

For access from another device, we recommend Tailscale. It is optional; you can use Rebalio on the same computer or through an SSH tunnel instead.

Option 1: install script

Create an installation folder on the computer or server that will run Rebalio, then enter it and run the script. You can choose any folder name. The script installs into your current directory. It checks Docker and the required cookie name, creates an encryption key for a new installation, and starts the app. It prints the URL, setup token and next steps. Existing configuration and keys are preserved.

mkdir -p ~/rebalio
cd ~/rebalio
curl -fsSL https://rebalio.app/install.sh | REBALIO_SESSION_COOKIE_NAME=rebalio_session sh

You can inspect the script before running it. After it finishes, open the printed URL and use the setup token to create your local owner account. Keep a secure backup of .env in your installation directory.

Multiple installations on one server

Each installation needs a distinct Compose project, host port, session cookie name, encryption key and volume. For a second installation:

mkdir -p ~/rebalio-second
cd ~/rebalio-second
curl -fsSL https://rebalio.app/install.sh | COMPOSE_PROJECT_NAME=rebalio-paper REBALIO_PORT=8089 REBALIO_SESSION_COOKIE_NAME=rebalio_paper_session sh

The installer saves these settings in .env. It refuses project names associated with another directory. Keep each existing project name unchanged across upgrades, since it identifies the data volume. Never copy another installation's key or data volume.

For two installations on the same Tailscale hostname, use separate HTTPS listeners:

tailscale serve --bg --https=443 http://127.0.0.1:8088
tailscale serve --bg --https=8443 http://127.0.0.1:8089
tailscale serve status

Set the first installation's REBALIO_ORIGIN=https://YOUR-HOST.YOUR-TAILNET.ts.net and the second's REBALIO_ORIGIN=https://YOUR-HOST.YOUR-TAILNET.ts.net:8443, using the exact hostname printed by Serve. Run docker compose up -d --wait --wait-timeout 120 in each directory.

443 and 8443 are public HTTPS listener ports; 8088 and 8089 are VPS loopback ports; both containers listen on 8088 internally. Cookies are shared across ports, so names must differ. Sign into both URLs in one browser and verify that logout, recovery and container recreation for one leave the other operational.

Use separate exchange accounts/environments and API credentials/signers. Trading locks, nonces and rate limits are local to each installation; instances still share the VPS outbound IP. Shared databases, shared login and path-based hosting are not supported.

Required cookie configuration

REBALIO_SESSION_COOKIE_NAME is required. Use 1–128 letters, digits, underscores or hyphens, without __Host- or __Secure- prefixes. There is no automatic default. Before upgrading an existing installation, add its unique cookie name to .env and forward it under services.rebalio.environment in the existing Compose file:

REBALIO_SESSION_COOKIE_NAME: ${REBALIO_SESSION_COOKIE_NAME:?Required}

The installer preserves existing files and stops if configuration is missing. Keep project names, volumes, keys, ports and origins unchanged. Retaining the current cookie name preserves sessions; choosing a different name requires a fresh login. Previously the name was rebalio_session, or rebalio_session_PORT with the recent public-port naming fix. Cookie names prevent overwrites but do not make ports a cookie confidentiality boundary.

Option 2: manual installation

Prefer to run each step yourself? Follow the steps below instead of the script.

1. Download the Compose file

Run these commands on the computer or server that will run Rebalio. Docker selects the correct architecture from the single latest image.

mkdir -p ~/rebalio
cd ~/rebalio
curl -fSL https://rebalio.app/compose.yaml -o compose.yaml
docker pull ghcr.io/digitalcentral/rebalio:latest

You can inspect the Compose file before starting. Docker selects amd64 or arm64 automatically.

2. Create the encryption key

For a new installation, run the following once. If .env already exists, preserve it and skip this step.

umask 077
docker run --rm --entrypoint node ghcr.io/digitalcentral/rebalio:latest -e "console.log('REBALIO_MASTER_KEY=' + require('node:crypto').randomBytes(32).toString('hex'))" > .env
printf 'REBALIO_SESSION_COOKIE_NAME=rebalio_session\nCOMPOSE_PROJECT_NAME=rebalio\nREBALIO_PORT=8088\n' >> .env

Keep a secure backup of .env. This key unlocks the encrypted database; it is separate from your login password and cannot be recovered if lost.

3. Start Rebalio and create your owner account

docker compose up -d --wait --wait-timeout 120
docker compose exec rebalio cat /data/setup-token

Open http://127.0.0.1:8088 on that computer. Enter the setup token printed by the second command, choose a username, and set a password of at least 12 characters. The token can be used only once.

All features are included. No cloud account, subscription or activation key is needed. The default port is accessible only on the host. If this is a remote server, use the optional access steps below to reach it.

Optional: access from another device

With Tailscale installed and connected on the host and your other device, use Tailscale Serve to provide private HTTPS access:

tailscale serve --bg http://127.0.0.1:8088

Follow any Tailscale HTTPS setup prompt. Add REBALIO_ORIGIN=https://your-host.your-tailnet.ts.net to .env, using the exact HTTPS origin printed by Tailscale, without a trailing slash. Apply it with docker compose up -d, then open that HTTPS address. Keep the Compose port bound to loopback. Your local Rebalio username and password are still required. No callback registration is needed.

Alternatively, keep the default origin and run ssh -N -L 8088:127.0.0.1:8088 user@your-server on your own computer. Keep that terminal open and browse to http://127.0.0.1:8088.

Updates and recovery

When upgrading an older Compose configuration, keep container port 8088 and preserve your chosen host port. Match the loopback REBALIO_ORIGIN and any proxy or tunnel upstream to that host port. Keep an existing HTTPS origin unchanged. The installer preserves existing configuration; it does not rewrite these settings.

Run all operations from the intended installation directory. Back up its stopped data volume and .env together before updates. Then run docker compose pull and docker compose up -d --wait --wait-timeout 120. For rollback, set REBALIO_IMAGE in that installation’s .env to the previous revision tag, then repeat the pull and startup commands. Do not delete the data volume or regenerate the encryption key.

If you forget your password, run docker compose exec rebalio node /app/api/admin.js reset-owner on the host. Reload Rebalio and use the returned setup token to set new owner credentials. This revokes sessions and agent credentials while preserving portfolio data.

Check startup with docker compose ps and docker compose logs --tail=100 rebalio. Once signed in, follow Connect your exchange account.