Memos

Collect notes, ideas, and everyday thoughts in Markdown.

Choose your deployment and the way you want to use Selfhost. The instructions below follow that choice.

Deployment Use Selfhost with

Set up Memos

Editable Compose files in your own directory.

Start Memos and create its initial administrator.
Set the canonical instance URL when introducing a domain.

selfhost app --directory ./memos init memos

Initialization writes portable files and does not start the app. Review compose.yaml, the private .env and any files in files/, then start it:

selfhost app --directory ./memos start

No Selfhost dashboard or background service is needed. You can also start these files directly:

cd memos
docker compose -f compose.yaml up -d

Connect an existing installation

Use Existing apps → Link an app in the dashboard, or the CLI’s existing-app commands. Choose Memos, its URL and, optionally, its exact Docker container on a connected server.

Save existing.json with your app URL. Add server_id and container for container inspection and actions.

{
  "profile": "memos",
  "name": "Memos",
  "url": "https://app.example.com"
}

selfhost existing link --file existing.json
selfhost existing list
selfhost existing inspect EXISTING_ID

Linking enables the existing-app profile’s supported inspection and actions. It does not import Compose or attach the new-deployment settings and onboarding profiles described below.

Existing app commands, permissions and unlinking

Before configuring integrations

Runtime configuration includes rate limits, trusted proxies and an explicit private-webhook allowlist.
Memos supports mounted protobuf JSON for provider and instance policy provisioning.
Database placement includes PostgreSQL, MySQL and MariaDB using app-specific connection settings. Select a fresh or already migrated database before first start; changing the engine does not convert existing data.
MySQL and MariaDB TLS uses server certificate verification whenever enabled. A source configured as require therefore still needs a certificate trusted by the app; private CA certificates must be installed in the app trust store.
Selfhost does not yet generate or edit Memos provider files. Configure those in Memos or add reviewed native files to your portable Compose project.

Memos integrations

Compose service: memos. These operations use the profile saved when this deployment is created.

Memos identity-provider and instance-policy provisioning uses protobuf JSON files under /etc/secrets. Runtime environment fields do not provision OAuth accounts or grant roles.

Native settings

Changes use the app’s Compose environment. Unrelated settings are preserved.

Supported fields (5)

Canonical instance URL public-url: string
Log level log-level: stringChoices: debug, info, warn, error
Request rate limiting rate-limit: stringChoices: true, false
Trusted forwarding proxies trusted-proxies: Comma-separated CIDRs or IPs; none disables forwarding headers. string
Allowed private webhook destinations private-webhooks: Allow only the required exact hosts, IPs or CIDRs, instead of granting access to every private network. string

Save a JSON map of the field IDs you want to change as changes.json. Replace FIELD_ID with an ID from the supported fields above, and use its declared value type. Review the plan and replace REVIEWED_REVISION with the revision it returns.

{
  "FIELD_ID": "YOUR_VALUE"
}

selfhost app --directory ./memos config memos
selfhost app --directory ./memos plan memos changes.json
selfhost app --directory ./memos apply memos changes.json --revision REVIEWED_REVISION

Saved changes need service recreation to become active. Existing interpolated environment values stay under your control in .env or Compose.

Database placement

This recipe supports postgres, mysql, mariadb. Workspace projects can choose a dedicated database, a shared source with a separate database and account, or an existing external database before their first start.

postgres adapter TLS modes: disable, require, verify-full. Use a private network for connections with TLS disabled.
mysql adapter TLS modes: disable, require, verify-full. Use a private network for connections with TLS disabled.
mariadb adapter TLS modes: disable, require, verify-full. Use a private network for connections with TLS disabled.

Standalone directories use the generated Compose and environment files directly. Configure the database there before first start. Selfhost’s source provisioning commands belong to workspace projects and are optional.

Database setup, CLI commands and backups

App configuration reference

Versions and updates

This deployment uses the following images. Existing projects retain their saved recipe and images. A new catalogue version does not silently update them.

memos: neosmemo/memos:0.31.0

Review compatibility and back up app data before an update. Choose an image version and review the change.

Keep control of your setup

Selfhost remains optional. Your app runs using ordinary Compose files, its own settings and persistent data. Keep the Compose project name and volumes to preserve storage. Configuration exports and setting backups do not include application data.

Standalone CLI guide · Backups and removal · Memos documentation