Quick start

Save the file below as docker-compose.yml and run:

docker compose up -d

Then open http://localhost:3000. The first user to sign in becomes the server owner, see First run.

docker-compose.yml

services:
  norish:
    image: norishapp/norish:latest
    container_name: norish-app
    restart: always
    ports:
      - "3000:3000"
    user: "1000:1000"
    volumes:
      - norish_data:/app/uploads
    environment:
      AUTH_URL: http://localhost:3000
      DATABASE_URL: postgres://postgres:norish@db:5432/norish
      MASTER_KEY: REPLACE_WITH_A_RANDOM_KEY
      OBSCURA_ENDPOINT: ws://obscura:9222
      OBSCURA_CDP_TOKEN: REPLACE_WITH_A_RANDOM_TOKEN
      REDIS_URL: redis://redis:6379
      UPLOADS_DIR: /app/uploads
    depends_on:
      - db
      - redis

  db:
    image: postgres:17-alpine
    container_name: norish-db
    restart: unless-stopped
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: norish
      POSTGRES_DB: norish
    volumes:
      - db_data:/var/lib/postgresql/data

  # Renders recipe pages for URL imports
  obscura:
    image: norishapp/obscura:0.2.4-norish.1
    container_name: norish-obscura
    restart: unless-stopped
    environment:
      OBSCURA_CDP_TOKEN: REPLACE_WITH_A_RANDOM_TOKEN

  redis:
    image: redis:8.4.0
    container_name: norish-redis
    restart: unless-stopped
    volumes:
      - redis_data:/data

volumes:
  db_data:
  norish_data:
  redis_data:

Generating the secrets

The compose above has a random MASTER_KEY and OBSCURA_CDP_TOKEN, generated in your browser when you loaded this page. To make your own, run:

openssl rand -base64 32 # MASTER_KEY
openssl rand -hex 32    # OBSCURA_CDP_TOKEN, the same value on both services

Keep them secret. Norish derives its encryption keys from MASTER_KEY, so changing it makes previously encrypted data unreadable.

Production template

The repository has a longer, commented template at docker-compose.example.yml.

What's in the stack

Service	What it does
norish	The Norish app server.
db	PostgreSQL database.
redis	Real-time events and background jobs.
obscura	Headless browser that loads pages for imports.

First run

The first user to sign in becomes the server owner and admin. Registration then turns off, and server settings live under Settings => Admin.

Email and password sign-in works out of the box. You can add OIDC, GitHub or Google, see Authentication.

Next steps

AuthenticationSign in with a password, OIDC, GitHub or Google.AI providerConnect an AI provider for AI imports, recipe enrichment, images and video.Server & runtimeCore server settings, the encryption key, networking, logging, uploads and the scheduler.Admin settingsWhat the server owner and admins can change from the app.