Sure

Overview

Sure is a self-hosted personal finance and wealth management app (community fork of Maybe Finance). Track accounts, transactions, budgets, investments and net worth, with optional AI features. Full step-by-step guide: https://github.com/Yusseiin/Unraid-templates/blob/main/docs/sure-setup.md This is the WEB container. Sure needs FOUR containers, all available from this repository and pre-configured to talk to each other on the "sure-net" Docker network. Install them in this order: 1. postgres17_sure - database 2. redis_sure - job queue 3. Sure (this template) - web UI, runs database migrations on start 4. Sure-Worker - background jobs: bank syncs, imports, market data, emails BEFORE INSTALLING, open the Unraid terminal once and run: docker network create sure-net mkdir -p /mnt/user/appdata/sure/storage chown -R 1000:1000 /mnt/user/appdata/sure Also enable Settings > Docker > "Preserve user defined networks" (Advanced View, Docker must be stopped to change it) so sure-net survives reboots. Database Host and Redis URL are already set to postgres17_sure and redis_sure: do not rename those containers. If you use your own PostgreSQL/Redis instead, change Network Type and these two fields. You only need to fill in: Secret Key Base (generate with: openssl rand -hex 64) and Database Password (the same one set in postgres17_sure). Sure and Sure-Worker MUST use the same Secret Key Base, database and Redis settings, and the same Storage path. Active Record Encryption keys (Primary Key, Deterministic Key, Key Derivation Salt) are optional: if left blank they are derived from the Secret Key Base. Set all three or none (Sure refuses to start if only some are set). If you set them, generate three random values (e.g. openssl rand -hex 32 three times) and use EXACTLY THE SAME three values in Sure and Sure-Worker. Set them before first start and never change them afterwards, or encrypted data (API keys, provider credentials) becomes unreadable. After creating your first account (it becomes the super admin), restrict new signups from Settings > Self-Hosting > Onboarding. If you expose Sure through an HTTPS reverse proxy, set Assume SSL to true.

Readme

View on GitHub

Ask DeepWiki View performance data on Skylight

The Sure dashboard in two columns (cashflow, net worth, spending and outflows) beside the AI assistant answering a question about savings

Sure: The personal finance app for everyone

Get involved: Discord • Website • Issues

[!IMPORTANT] This repository is a community fork of the now-abandoned Maybe Finance project.
Learn more in their final release doc.

Backstory

The Maybe Finance (archived/abandoned repo) team spent most of 2021–2022 building a full-featured personal finance and wealth management app. It even included an “Ask an Advisor” feature that connected users with a real CFP/CFA — all included with your subscription.

The business end of things didn't work out, and so they stopped developing the app in mid-2023.

After spending nearly $1 million on development (employees, contractors, data providers, infra, etc.), the team open-sourced the app. Their goal was to let users self-host it for free — and eventually launch a hosted version for a small fee.

They actually did launch that hosted version … briefly.

That also didn’t work out — at least not as a sustainable B2C business — so now here we are: hosting a community-maintained fork to keep the codebase alive and see where this can go next.

Join us!

Hosting Sure

Sure is a fully working personal finance app that can be self hosted with Docker. Sure can be accessed from a browser, the macOS desktop app, the mobile app, API clients, and LLM agents. See Sure Clients for an overview.

Forking and Attribution

This repo is a community fork of the archived Maybe Finance repo. You’re free to fork it under the AGPLv3 license — but we’d love it if you stuck around and contributed here instead.

To stay compliant and avoid trademark issues:

Be sure to include the original AGPLv3 license and clearly state in your README that your fork is based on Maybe Finance but is not affiliated with or endorsed by Maybe Finance Inc.
"Maybe" is a trademark of Maybe Finance Inc. and therefore, use of it is NOT allowed in forked repositories (or the logo)

Performance Issues

With data-heavy apps, inevitably, there are performance issues. We've set up a public dashboard showing the problematic requests seen on the demo site, along with the stacktraces to help debug them.

https://www.skylight.io/app/applications/s6PEZSKwcklL/recent/6h/endpoints

Any contributions that help improve performance are very much welcome.

Local Development Setup

If you are trying to self-host the app, read this guide to get started.

The instructions below are for developers to get started with contributing to the app.

Requirements

See .ruby-version file for required Ruby version
PostgreSQL >9.3 (latest stable version recommended)
Redis > 5.4 (latest stable version recommended)

Getting Started

cd sure
cp .env.local.example .env.local
bin/setup
bin/dev

# Optionally, load demo data
rake demo_data:default

Visit http://localhost:3000 to view the app.

If you loaded the optional demo data, log in with these credentials:

Email: user@example.com
Password: Password1!

For further instructions, see guides below.

Setup Guides

One-click Install

Render expects each button target branch to have a render.yaml at the repository root. The branch-ready Blueprint files live in branches/<branch-name>/render.yaml in a separate repo and can be copied to each corresponding branch root.

Option	What it deploys	`latest`	`stable`
Sure - No AI	Sure web, Sidekiq worker, Render Postgres, and Render Key Value. AI tokens are intentionally blank.	Deploy to Render	Deploy to Render
Sure - Simple AI	Sure with OpenAI-backed AI settings, pgvector-ready Postgres, Sidekiq, and Render Key Value. Render prompts for the OpenAI token.	Deploy to Render	Deploy to Render
Sure - External AI	Sure with external assistant settings plus AlphaClaw, which manages the OpenClaw gateway on Render.	Deploy to Render	Deploy to Render

Run on PikaPods

Deploy on Hostim

License and Trademarks

Maybe and Sure are both distributed under an AGPLv3 license.

"Maybe" is a trademark of Maybe Finance, Inc.
"Sure" is not, and refers to this community fork.

Requirements

The Docker network "sure-net" (docker network create sure-net), postgres17_sure, redis_sure and Sure-Worker.

Related apps

Explore more like this

Explore all

Productivity Utilities apps

Links

Projectgithub.com Supportgithub.com Registrygithub.com Templateraw.githubusercontent.com

Details

Repository

ghcr.io/we-promise/sure:stable

Registry

https://github.com/we-promise/sure/pkgs/container/sure

Last Updated2026-11-11

First Seen2025-09-24

Runtime arguments

Web UI: http://[IP]:[PORT:3000]
Network: sure-net
Shell: bash
Privileged: false

Template configuration

WebUI PortPorttcp

HTTP port for the Sure web interface.

Target: 3000
Default: 3000
Value: 3000

StoragePathrw

Uploaded files (attachments, statements, imports/exports, logos). Must be the same path used by Sure-Worker. Owned by 1000:1000.

Target: /rails/storage
Default: /mnt/user/appdata/sure/storage
Value: /mnt/user/appdata/sure/storage

Secret Key BaseVariable

Required. Random secret used to encrypt data. Generate with: openssl rand -hex 64. Must be identical in Sure-Worker. Never change it after first start or encrypted data becomes unreadable.

Target: SECRET_KEY_BASE

Encryption Primary KeyVariable

Optional (derived from Secret Key Base if blank). Set all three or none. If set, MUST be identical in Sure and Sure-Worker. Generate with: openssl rand -hex 32. Never change after first start.

Target: ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY

Encryption Deterministic KeyVariable

Optional (derived from Secret Key Base if blank). Set all three or none. If set, MUST be identical in Sure and Sure-Worker. Generate with: openssl rand -hex 32. Never change after first start.

Target: ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY

Encryption Key Derivation SaltVariable

Optional (derived from Secret Key Base if blank). Set all three or none. If set, MUST be identical in Sure and Sure-Worker. Generate with: openssl rand -hex 32. Never change after first start.

Target: ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT

Database HostVariable

PostgreSQL host. Pre-set to the postgres17_sure container on sure-net. Using your own PostgreSQL? Put its container name (same network) or IP here.

Target: DB_HOST
Default: postgres17_sure
Value: postgres17_sure

Database PortVariable

PostgreSQL port.

Target: DB_PORT
Default: 5432
Value: 5432

Database NameVariable

PostgreSQL database name. It is created automatically if the user has permission.

Target: POSTGRES_DB
Default: sure_production
Value: sure_production

Database UserVariable

PostgreSQL user.

Target: POSTGRES_USER
Default: sure_user
Value: sure_user

Database PasswordVariable

Required. The same password set in postgres17_sure.

Target: POSTGRES_PASSWORD

Redis URLVariable

Redis connection URL. Pre-set to the redis_sure container on sure-net. Using your own Redis? e.g. redis://CONTAINER_OR_IP:6379/1 (with password: redis://:password@host:6379/1).

Target: REDIS_URL
Default: redis://redis_sure:6379/1
Value: redis://redis_sure:6379/1

App DomainVariable

Host name Sure is reached at (e.g. sure.example.com). Used to build links in emails.

Target: APP_DOMAIN

Assume SSLVariable

Set to true when Sure is served over HTTPS by a reverse proxy (e.g. SWAG, Nginx Proxy Manager, Cloudflare Tunnel).

Target: RAILS_ASSUME_SSL
Default: false
Value: false

Force SSLVariable

Redirect all HTTP requests to HTTPS. Leave false when behind a reverse proxy.

Target: RAILS_FORCE_SSL
Default: false
Value: false

Self HostedVariable

Enables self-hosting features. Leave true.

Target: SELF_HOSTED
Default: true
Value: true

Onboarding StateVariable

Default signup mode: open, invite_only or closed. Can also be changed later in Settings > Self-Hosting > Onboarding.

Target: ONBOARDING_STATE
Default: open
Value: open

Exchange Rate ProviderVariable

yahoo_finance (free, no key) or twelve_data (needs Twelve Data API Key).

Target: EXCHANGE_RATE_PROVIDER
Default: yahoo_finance
Value: yahoo_finance

Securities ProviderVariable

yahoo_finance (free, no key) or twelve_data (needs Twelve Data API Key).

Target: SECURITIES_PROVIDER
Default: yahoo_finance
Value: yahoo_finance

Market Data Sync TimezoneVariable

IANA timezone for the daily price import (e.g. Europe/Rome). Unknown names fall back to UTC. Use the same value in Sure and Sure-Worker. Values saved in Settings > Self-Hosting take precedence.

Target: MARKET_DATA_SYNC_TIMEZONE
Default: UTC
Value: UTC

Market Data Sync TimeVariable

HH:MM (24h, in the Market Data Sync Timezone) for the daily price import, Monday to Friday. Use the same value in Sure and Sure-Worker.

Target: MARKET_DATA_SYNC_TIME
Default: 22:00
Value: 22:00

Market Data Sync EnabledVariable

1 = import security prices daily (Monday to Friday), 0 = off. Do not leave blank (blank means off). Values saved in Settings > Self-Hosting take precedence. Use the same value in Sure and Sure-Worker.

Target: MARKET_DATA_SYNC_ENABLED
Default: 1|0
Value: 1

Twelve Data API KeyVariable

Optional. API key from twelvedata.com for exchange rates and stock prices. Can also be set in the Self-Hosting settings page.

Target: TWELVE_DATA_API_KEY

Assistant TypeVariable

Forces the AI assistant type for the whole instance. Blank = each family chooses in Settings > Self-Hosting. builtin = in-app chat using the OpenAI fields. external = your own agent (also needs EXTERNAL_ASSISTANT_URL / EXTERNAL_ASSISTANT_TOKEN). mcp_only = no in-app chat at all (sidebar, toggle and mobile tab hidden), MCP stays available for your own agent; background categorization keeps working. Use the same value in Sure and Sure-Worker.

Target: ASSISTANT_TYPE
Default: |builtin|external|mcp_only

MCP API TokenVariable

Optional. Bearer token that lets your own AI agent use Sure's /mcp endpoint (e.g. with Assistant Type mcp_only or external). Generate with: openssl rand -hex 32. Needs MCP User Email too.

Target: MCP_API_TOKEN

MCP User EmailVariable

Optional. Email of an existing Sure user whose data the MCP token can access. Required together with MCP API Token.

Target: MCP_USER_EMAIL

OpenAI Access TokenVariable

Optional. Enables AI features (chat, rules) via OpenAI or any OpenAI-compatible API. Using OpenAI incurs costs - set spend limits.

Target: OPENAI_ACCESS_TOKEN

OpenAI ModelVariable

Optional. Model name to use (required for custom OpenAI-compatible endpoints).

Target: OPENAI_MODEL

OpenAI URI BaseVariable

Optional. Base URL of an OpenAI-compatible API (e.g. http://192.168.1.100:11434/v1 for Ollama).

Target: OPENAI_URI_BASE

WebAuthn RP IDVariable

Optional. For passkeys/security keys: your registrable domain (e.g. example.com), not a URL.

Target: WEBAUTHN_RP_ID

WebAuthn Allowed OriginsVariable

Optional. Comma-separated full origins where Sure is accessed (e.g. https://sure.example.com).

Target: WEBAUTHN_ALLOWED_ORIGINS

External Assistant URLVariable

Only for Assistant Type external: your agent's OpenAI-compatible chat endpoint, e.g. https://your-agent/v1/chat/completions. Use the same value in Sure and Sure-Worker.

Target: EXTERNAL_ASSISTANT_URL

External Assistant TokenVariable

Only for Assistant Type external: API token for your agent. Use the same value in Sure and Sure-Worker.

Target: EXTERNAL_ASSISTANT_TOKEN

External Assistant ModelVariable

Only for Assistant Type external: model name. Blank = openclaw/main. Use the same value in Sure and Sure-Worker.

Target: EXTERNAL_ASSISTANT_MODEL

LLM ProviderVariable

AI provider for chat and background AI jobs: openai (OpenAI or any OpenAI-compatible API such as Ollama) or anthropic (native Anthropic API, needs Anthropic API Key). Setting it here locks the choice on the Settings page. Use the same value in Sure and Sure-Worker.

Target: LLM_PROVIDER
Default: openai|anthropic
Value: openai

Anthropic API KeyVariable

Only for LLM Provider anthropic. Use the same value in Sure and Sure-Worker.

Target: ANTHROPIC_API_KEY

Anthropic ModelVariable

Only for LLM Provider anthropic. Blank = Sure's default Claude model. Use the same value in Sure and Sure-Worker.

Target: ANTHROPIC_MODEL

LLM Context WindowVariable

Token budget for OpenAI-compatible models. Blank = Settings page value or 2048. Raise it for larger local models (e.g. 8192). Use the same value in Sure and Sure-Worker.

Target: LLM_CONTEXT_WINDOW

OpenAI Request TimeoutVariable

Seconds per LLM request. Blank = Settings page value or 60. Raise for slow local models (e.g. 300 for Ollama on CPU). Use the same value in Sure and Sure-Worker.

Target: OPENAI_REQUEST_TIMEOUT

AI Response TimeoutVariable

Seconds the chat waits for a full answer before showing no response. Blank = Settings page value or 90 (minimum 30). Raise for slow local models. Use the same value in Sure and Sure-Worker.

Target: AI_RESPONSE_TIMEOUT

Vector Store ProviderVariable

AI document search. Blank = hosted OpenAI when an OpenAI token is set. pgvector = store embeddings in postgres17_sure (needs an embeddings endpoint below). Best set before the first start of Sure, as its table is created by a database migration. Use the same value in Sure and Sure-Worker.

Target: VECTOR_STORE_PROVIDER
Default: |pgvector|openai

Embedding URI BaseVariable

OpenAI-compatible embeddings endpoint for pgvector, e.g. http://ollama:11434/v1. Blank = OpenAI URI Base, then OpenAI. Use the same value in Sure and Sure-Worker.

Target: EMBEDDING_URI_BASE

Embedding ModelVariable

Embedding model name. Do not leave blank. Use the same value in Sure and Sure-Worker.

Target: EMBEDDING_MODEL
Default: mxbai-embed-large
Value: mxbai-embed-large

Embedding DimensionsVariable

Must match the embedding model (1024 for mxbai-embed-large). Do not leave blank or change after pgvector data exists. Use the same value in Sure and Sure-Worker.

Target: EMBEDDING_DIMENSIONS
Default: 1024
Value: 1024

Brandfetch Client IDVariable

Optional. Client ID from brandfetch.com for bank and merchant logos. Set it here rather than on the Settings page (a blank value here can clear a key saved there). Use the same value in Sure and Sure-Worker.

Target: BRAND_FETCH_CLIENT_ID

OIDC IssuerVariable

Optional single sign-on (Authentik, Authelia, Keycloak...). Issuer URL of your provider. All four OIDC fields are needed to enable it.

Target: OIDC_ISSUER

OIDC Client IDVariable

Optional single sign-on: client ID from your OIDC provider.

Target: OIDC_CLIENT_ID

OIDC Client SecretVariable

Optional single sign-on: client secret from your OIDC provider.

Target: OIDC_CLIENT_SECRET

OIDC Redirect URIVariable

Optional single sign-on: https://YOUR-SURE-DOMAIN/auth/openid_connect/callback (register the same URL in your provider).

Target: OIDC_REDIRECT_URI

Sidekiq Web UsernameVariable

Optional extra basic-auth login for the /sidekiq jobs page (already limited to the super admin). Needs Sidekiq Web Password too.

Target: SIDEKIQ_WEB_USERNAME

Sidekiq Web PasswordVariable

Optional extra basic-auth password for the /sidekiq jobs page. Needs Sidekiq Web Username too.

Target: SIDEKIQ_WEB_PASSWORD

Library

Curated

Categories

Sure

Overview

Readme

Sure: The personal finance app for everyone

Backstory

Hosting Sure

Forking and Attribution

Performance Issues

Local Development Setup

Requirements

Getting Started

Setup Guides

One-click Install

License and Trademarks

Requirements

Categories

Related apps

Links

Details

Runtime arguments

Template configuration