All templates

Umami

v1.0.0

Privacy-focused website analytics with dashboards and event tracking.

analytics by getarcaneapp
x-arcane:
  icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/svg/umami.svg
  urls:
    - https://github.com/umami-software/umami/blob/master/docker-compose.yml

services:
  umami:
    image: ghcr.io/umami-software/umami:latest
    restart: unless-stopped
    init: true
    ports:
      - "${BIND_ADDRESS:-127.0.0.1}:${APP_PORT:-3005}:3000"
    environment:
      DATABASE_URL: postgresql://umami:${DB_PASSWORD}@database:5432/umami
      APP_SECRET: ${APP_SECRET}
      TWO_FACTOR_ENCRYPTION_KEY: ${TWO_FACTOR_ENCRYPTION_KEY}
    depends_on:
      database:
        condition: service_healthy
    labels:
      com.getarcaneapp.arcane.icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/svg/umami.svg

  database:
    image: postgres:15-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: umami
      POSTGRES_USER: umami
      POSTGRES_PASSWORD: ${DB_PASSWORD}
    volumes:
      - umami-db:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
      interval: 5s
      timeout: 5s
      retries: 10
    labels:
      com.getarcaneapp.arcane.icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/svg/postgresql.svg

volumes:
  umami-db:

README

The web interface binds to loopback by default. Open it on the Docker host or through an SSH tunnel. For LAN access, set BIND_ADDRESS to a trusted interface after completing account setup; use an authenticated HTTPS reverse proxy for remote access.

Generate independent values for all three secrets with openssl rand -hex 32. The two-factor key must be exactly 64 hexadecimal characters; keep it stable and back it up. A hexadecimal database password avoids URL-encoding issues in DATABASE_URL.

Open http://localhost:3005. The upstream initial login is admin / umami; change it immediately. Add your website in the UI and install its tracking script. Use HTTPS when collecting analytics from HTTPS sites.

PostgreSQL is bundled and persists in umami-db; its port is not published. Back up the database and both application secrets.

Upstream deployment documentation.