TREK
Docker app from TREK's Repository
Overview
Readme
View on GitHub
Every part of your trip. One app you own.
TREK has grown from a travel planner into a whole ecosystem for trips: plan together in real time on a live map, build hikes, tours and road trips, keep bookings and shared costs in order, pack, write the journal, lay out the photo book and hand the busy work to the built-in AI. Self-hosted, on the web, on your phone and offline.
Demo Docker Sonar Quality Gate GitHub Actions Workflow Status Discord Roadmap Ko-fi BMAC License Latest Release Docker Pulls Stars
PUBLIC SERVICES PROUDLY SPONSORED BY
What you get
See all features
Most of what follows is an addon an admin switches on or off. Lists, Costs, Documents, Collab, Tours, Vacay and Atlas ship on; Journey, Collections, MCP, the AI assistant, AI Parsing, Road trip, Dawarich and AirTrail ship off and are marked below.
🧭 Planning
|
🥾 Tours
|
🧳 Bookings and money
|
👥 Collaboration
|
📔 Journey and TREK Studio
|
🗺️ Atlas, Vacay and Collections
|
🤖 AI assistant and MCP
|
🧩 Plugins
|
📱 Mobile and offline
|
⚙️ Admin, accounts and security
|
Powered by dataforest cloud
Every TREK installation in the world searches through servers that dataforest cloud sponsors.
The place index with over 88 million places, the address search in every TREK language and the planet-wide routing all run on dataforest cloud in Frankfurt, Germany, free of charge for everyone who self-hosts TREK. Without this sponsorship, these services would not exist in this form.
Thank you, dataforest, for backing open source this generously. 💚
Looking for a server for your own TREK? dataforest cloud is where TREK's own services live.
AI usage
We use LLM-assisted coding tools across parts of this codebase. Nothing ships that a maintainer has not read and understood: every change goes through a pull request, is reviewed and tested, and has a human who can answer for it. "The AI wrote that" is not an answer any of us would accept from ourselves.
See How we use AI in TREK for the details.
Get started in 30 seconds
ENCRYPTION_KEY=$(openssl rand -hex 32) docker run -d --name trek -p 3000:3000 \
-e ENCRYPTION_KEY=$ENCRYPTION_KEY \
-e COOKIE_SECURE=false \
-v ./data:/app/data -v ./uploads:/app/uploads mauriceboe/trek
Open http://localhost:3000, or http://<server-ip>:3000 from another machine. On first boot TREK seeds an admin account — if you set ADMIN_EMAIL/ADMIN_PASSWORD those are used, otherwise the credentials are printed to the container log (docker logs trek).
COOKIE_SECURE=false is only for trying TREK over plain HTTP: without it the browser drops the session cookie and the login does not stick. Once TREK sits behind HTTPS (see Reverse Proxy), remove it.
[!TIP] No server yet? TREK's own public services run on dataforest cloud, our infrastructure sponsor. A small seed is plenty for a TREK instance and is ready within a minute.
Tech stack
Node.js NestJS SQLite React Vite TypeScript Tailwind Leaflet Docker
Real-time sync via WebSocket (ws). Backend on NestJS 11. State with Zustand. Auth via JWT + OAuth 2.1 + OIDC + Passkeys (WebAuthn) + TOTP MFA. Weather via Open-Meteo (no key required). Maps with Leaflet and Mapbox GL.
Docker Compose (production)
The repository ships a ready-to-use docker-compose.yml
with secure defaults and every option documented inline. Download it, then:
docker compose up -d
See Install with Docker Compose for the full walkthrough.
Helm (Kubernetes)
helm repo add trek https://chart.liketrek.com
helm repo update
helm install trek trek/trek
See charts/README.md for values.
Install as App (PWA)
TREK works as a Progressive Web App, and the TREK Travel Planner app for iPhone, iPad and Android connects to the same server (Native Apps). To install the web app instead:
- Open TREK in the browser (HTTPS required)
- iOS: Share ▸ Add to Home Screen
- Android: Menu ▸ Install app (or Add to Home Screen)
TREK then launches fullscreen with its own icon, just like a native app.
Updating
See Updating — Docker Compose, Docker run, Helm, Portainer, Unraid and Proxmox, plus the encryption-key note.
Reverse Proxy
For production, put TREK behind a TLS-terminating reverse proxy. TREK uses WebSockets for real-time sync, so the proxy must support WebSocket upgrades on /ws.
If you use the MCP addon, the proxy must also pass the Mcp-Session-Id header through in both directions on /mcp — Nginx and Caddy do this by default, but a proxy that strips it makes every tool call open a new session instead of reusing one. See the Reverse Proxy wiki page for details.
Nginx
server {
listen 80;
server_name trek.yourdomain.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl http2;
server_name trek.yourdomain.com;
ssl_certificate /etc/ssl/fullchain.pem;
ssl_certificate_key /etc/ssl/privkey.pem;
# 500 MB covers backup-restore uploads (capped at 500 MB server-side).
client_max_body_size 500m;
location / {
proxy_pass http://localhost:3000;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
location /ws {
proxy_pass http://localhost:3000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_read_timeout 86400;
}
# Only needed if you use the MCP addon. Responses are Server-Sent Events,
# so buffering must be off or tool results arrive late.
location /mcp {
proxy_pass http://localhost:3000;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_buffering off;
proxy_read_timeout 3600s;
}
}
Caddy
trek.yourdomain.com {
reverse_proxy localhost:3000
}
Caddy handles TLS and WebSockets automatically.
Environment variables
Every variable, its default and what it does: see Environment Variables.
Data sources
The Atlas map's country and sub-national (province/county) boundaries come from geoBoundaries (Runfola et al., 2020), licensed CC BY 4.0. See NOTICE.md for full third-party attributions.
License
TREK is AGPL v3. Self-host freely for personal or internal company use. If you modify and offer TREK as a network service to third parties, your modifications must be open-sourced under the same licence.
Categories
Download Statistics
Total Downloads Over Time
Related apps
Explore more like this
Explore allDetails
mauriceboe/trekRuntime arguments
- Web UI
http://[IP]:[PORT:3000]- Network
bridge- Privileged
- false
Template configuration
Port for the web interface
- Target
- 3000
- Default
- 3000
- Value
- 3000
Database and app data
- Target
- /app/data
- Default
- /mnt/user/appdata/trek/data
- Value
- /mnt/user/appdata/trek/data
Uploaded files (photos, documents)
- Target
- /app/uploads
- Default
- /mnt/user/appdata/trek/uploads
- Value
- /mnt/user/appdata/trek/uploads
At-rest encryption key for stored secrets (API keys, MFA, SMTP, OIDC). Recommended: generate with: openssl rand -hex 32. If unset, falls back to data/.jwt_secret (existing installs) or auto-generates a key (fresh installs).
Internal server port (must match the container port mapping above).
- Default
- 3000
- Value
- 3000
Node environment (production / development).
- Default
- production
- Value
- production
Timezone for logs, reminders and scheduled tasks (e.g. Europe/Berlin).
- Default
- UTC
- Value
- UTC
Log verbosity: info = concise user actions, debug = verbose admin-level details.
- Default
- info
- Value
- info
Where the in-app Help pages (/help) read their content from. Leave empty: the container ships the wiki at /app/wiki and finds it automatically. Only set this to serve your own docs from a mounted path. If the path does not exist, Help falls back to fetching the public GitHub wiki (needs outbound network, and tracks the latest release rather than your version).
Default language shown on the login page for users with no saved preference. Browser/OS language is auto-detected first; this is the fallback when no match is found. Supported: ar, az, br, ca, cs, de, en, es, et, fr, gr, hu, id, it, ja, ko, nl, pl, ru, sk, sv, th, tr, uk, vi, zh, zh-TW.
- Default
- en
- Value
- en
Comma-separated origins allowed for CORS and used as base URL in email notification links (e.g. https://trek.example.com).
Public base URL of this instance (e.g. https://trek.example.com). Required when OIDC is enabled — must match the redirect URI registered with your IdP. Also used as base URL for email notification links.
Optional. When true: HTTPS redirect, HSTS header, CSP upgrade-insecure-requests, and secure cookies. Only useful behind a TLS-terminating proxy. Requires TRUST_PROXY.
- Default
- false
- Value
- false
When true: adds includeSubDomains to the HSTS header, extending HTTPS enforcement to all subdomains. Only effective when HSTS is active (FORCE_HTTPS=true or NODE_ENV=production). Leave false if you run other services on sibling subdomains over plain HTTP.
- Default
- false
- Value
- false
Auto-derived (true in production or when FORCE_HTTPS=true). Set to false to force session cookies over plain HTTP. Not recommended for production.
- Default
- true
- Value
- true
Trusted proxy hops for X-Forwarded-For/X-Forwarded-Proto. Defaults to 1 in production; off in development unless set. Required for FORCE_HTTPS.
- Default
- 1
- Value
- 1
Allow outbound requests to private/RFC-1918 IP addresses. Set to true if Immich or other integrated services are hosted on your local network.
- Default
- false
- Value
- false
How long a login session stays valid when 'Remember me' is unchecked (the default): trek_session JWT exp + a browser-session cookie cleared when the browser closes. Accepts 1h, 12h, 7d, 30d, 90d. Defaults to 24h.
- Default
- 24h
- Value
- 24h
Session length when 'Remember me' is ticked at login: a longer-lived JWT + persistent cookie that survives browser restarts. Same format as SESSION_DURATION. Defaults to 30d.
- Default
- 30d
- Value
- 30d
Email for the first admin account created on initial boot. Has no effect once any user exists.
- Default
- admin@trek.local
- Value
- admin@trek.local
Password for the first admin account created on initial boot. If omitted a random password is generated and printed to the server log. Has no effect once any user exists.
OpenID Connect provider URL (e.g. https://auth.example.com).
OIDC client ID registered with your identity provider.
OIDC client secret registered with your identity provider.
Label shown on the SSO login button.
- Default
- SSO
- Value
- SSO
Set to true to force SSO-only mode. Disables password login and password registration — overrides the granular toggles in Admin > Settings and cannot be changed at runtime. First SSO login becomes admin.
- Default
- false
- Value
- false
OIDC claim used to identify admin users (e.g. groups).
Value of the OIDC claim that grants admin role (e.g. app-trek-admins).
Space-separated OIDC scopes to request. Fully overrides the default — always include openid email profile plus any extra scopes you need (e.g. add groups when using OIDC_ADMIN_CLAIM).
- Default
- openid email profile
- Value
- openid email profile
Override the auto-constructed OIDC discovery endpoint. Useful for providers with a non-standard path (e.g. Authentik).
Enable demo mode (resets all data hourly). Not intended for regular use.
- Default
- false
- Value
- false
Max MCP API requests per user per minute.
- Default
- 300
- Value
- 300
Max concurrent MCP sessions per user.
- Default
- 20
- Value
- 20
Optional. Web Push key pair, public half (base64url). Leave empty and TREK generates a pair on first start and keeps it in its database. Set it together with VAPID_PRIVATE_KEY to use your own pair; changing the pair later means every device has to turn push on again.
Optional. Web Push key pair, private half (base64url). Only used together with VAPID_PUBLIC_KEY; a pair whose halves do not belong together, or only one half, turns push off with an error in the log until it is fixed, and every device stays registered.
Optional. The contact push services see with every Web Push message: a mailto: address or an https:// URL. Defaults to APP_URL when it is https, else the TREK project page.
Optional Unsplash Access Key for trip-cover and place-image search. Without one, TREK uses Unsplash's unauthenticated endpoint, which some datacenter/VPS IPs are blocked from. Get a free key at unsplash.com/developers. Can also be set per-admin in Admin > Settings; this env var overrides that.