FJRG2007/polaris

Polaris

Your home lab, one control plane.

Why   •   Install   •   What's in it   •   Integrations   •   Usage   •   Developers   •   Español

---

Polaris is a self-hosted platform to run your servers and your team from one place: deploy apps and databases to your own machines, manage files across every NAS and cloud drive, host game servers, and work together with chat, calls, tasks, calendar, mail and documents.

It replaces the separate tools a home lab or a small team ends up running - deployments, file sharing, a password manager, uptime checks, analytics, chat, a task tracker - with one install and one set of accounts. The apps share data: a task links the deploy it is about, and a file in Drive attaches to a message without being uploaded again.

It runs in Docker and manages the host it is installed on plus any machine you add over SSH. After the install, updates and settings are handled from the web interface.

Screenshots of the real interface with sample data. Most link to a page with the full feature list. Mobile versions are in docs/assets/media.

Chat: spaces, channels, threads and direct messages

Calls: voice channels, meetings and calls in any chat

Tasks: lists, boards, sprints and goals	Calendar: every calendar you have, synced both ways
Mail: every mailbox in one inbox	Office: documents, sheets, slides and diagrams

Drive: your drive and every storage you own

Vault: passwords and one-time codes, Bitwarden compatible

Deploy: apps, databases and domains on your machines	Marketplace: apps installed with one press
Game servers: Minecraft, ARK and FiveM on your own machines

App launcher: every app, and what is waiting in each	Settings: the deployment's, and your own account's
The soundboard in a call: Polaris's own sounds and the space's

What Polaris replaces, on your own hardware and with one account:

One command installs the dashboard, database, reverse proxy and host daemon, and generates the secrets:

# macOS / Linux
curl -fsSL https://raw.githubusercontent.com/FJRG2007/polaris/main/dashboard/scripts/install.sh | sh

# Windows (PowerShell)
irm https://raw.githubusercontent.com/FJRG2007/polaris/main/dashboard/scripts/install.ps1 | iex

Linux is the recommended host - Ubuntu Server is what Polaris is run against. Windows works, but Docker there runs inside WSL and the host Polaris manages is that virtual machine rather than the machine itself; see Requirements.

Prefer to do it by hand? Clone the repo and run Compose directly:

git clone https://github.com/FJRG2007/polaris.git
cd polaris/dashboard/docker
cp .env.example .env                  # then replace every REPLACE_ME value in it
docker network create polaris-proxy   # compose expects both to exist already
docker network create polaris-hub
docker compose --profile full up -d

Then open https://127.0.0.1/oauth/setup?token= followed by the POLARIS_SETUP_TOKEN you put in .env, and create the administrator. The certificate is self-signed until a domain points here, so the browser warns once.

To update, use the Update button in Settings.

Each app is enabled per account and per role.

Files and secrets

• Drive - a private drive per account and a shared one per organization, across local disks, SFTP, S3-compatible storage, SMB/NFS, UniFi UNAS, Google Drive, OneDrive and Dropbox (WebDAV, Synology, QNAP and TrueNAS are coming). Streaming transfers for large files; sharing with people and groups by role and expiry; public links with password and expiry; drop points for people without an account; viewers and editors for documents, spreadsheets, PDFs and media; thumbnails in the grid.
• Vault - a password manager compatible with the Bitwarden apps and extensions. Encrypted in the browser; the server never sees the master password.

Running things

• Deploy - deploy an app from a Git repository or an image, with databases, volumes, environment variables, logs, a terminal, a file browser and a domain. Public access through your own domain, a Cloudflare tunnel or DuckDNS.
• Servers - enrol a machine over SSH with one generated command, then use its terminal, files, metrics and Docker engine from here.
• Containers and Backups - what is running on every host, and scheduled backups of it with restore.
• Marketplace - one-click installs of self-hosted apps.
• Game servers - Minecraft, ARK and FiveM, with worlds, mods, resources, players, schedules, crash detection, and Minecraft challenges (daily, weekly, season pass, bingo and community goals). Worlds can live on a NAS.
• Runners - GitHub Actions compatible CI on your own machines, with per-repo policy and budgets.
• Agents - coding agents on your repositories: headless runs that open pull requests and answer reviews with your own model keys, and live sessions of Claude Code, Codex and other CLIs in a terminal you can watch and steer. A task can be assigned to an agent, which updates it through Polaris's MCP server.
• Code - the pull requests and issues you have open on GitHub, read as you.
• Databases - Postgres, MySQL, MariaDB, MongoDB and Redis: browse, query and back up what you deployed, or connect to one elsewhere - directly or through an SSH tunnel, via a registered server or a login typed into the connection.

Work and people

• Tasks - spaces, lists, boards, sprints, goals, docs, custom fields, automations, forms and time tracking.
• Calendar - day, week, month and year views, sharing and public links, two-way sync with Google, Microsoft 365 and any CalDAV server or ICS feed, reminders, invitations, free/busy, meeting rooms and booking pages other people can reserve a slot on, plus a Time area with alarms, timers, focus cycles, a stopwatch and a world clock.
• Chat - servers and channels, direct messages and groups, calls, meetings, screen sharing, voice messages, screen clips and scheduled messages.
• Notes - nested notes; imports an Obsidian vault or a folder of Markdown.
• Inbox - Telegram, WhatsApp, Discord and Slack conversations in one place.
• Organizations - teams with their own members and roles.

Keeping an eye on it

• Watch - alerts on app health, spikes and outages, with webhooks, plus uptime history and a 90-day heatmap.
• Analytics - cookieless web analytics for the sites you host.
• Firewall - a rule per protection: allow and deny lists, country and network rules, bot and scraper defences, injection scanning, and automatic bans.
• Domain security - every domain Polaris knows, audited for spoofable mail (SPF, DKIM, DMARC, MTA-STS), DNS exposure (DNSSEC, CAA, open zone transfers, dangling records), registration (expiry, transfer lock) and web hardening (TLS, HSTS, security headers), with one-click fixes where Polaris manages the domain and an alert when the daily check finds a regression.
• Places - cameras and smart devices per location: live views, clips, detections and alerts delivered as messages; switches, plugs, lights, locks, air conditioners and purifiers from Tuya, TP-Link, Shelly, Hue, IKEA, Gree, Philips (Air+, HomeID and Dynalite), Home Assistant and SwitchBot; automations across all of them; an alert when a camera goes offline.

The account itself

Passwords, passkeys, two-factor, trusted devices, QR sign-in from another device, sessions, API keys, access rules, privacy and notification settings. Claude, ChatGPT, Cursor, VS Code and any other MCP client can connect as you, limited to what you approve - see docs/connecting-ai-assistants.md.

What is built versus in progress is tracked in dashboard/ROADMAP.md.

The interface is in English and Spanish (en español), and each account picks its own.

The services Polaris already talks to. Each one is switched on from the interface.

	Google: sign in, two-way Calendar and Tasks sync, Gmail as a mailbox, Google Drive as storage, Docs and Sheets imported into Office
	Microsoft 365: Outlook calendar sync, Outlook mail, OneDrive as storage
	GitHub: sign in, deploy repositories, run Actions on your own runners, read pull requests and issues
	Linear and Jira: issues mirrored into Tasks, status pushed back
	CalDAV: iCloud, Nextcloud, Fastmail, Yahoo or any CalDAV server, plus ICS feeds
	Inbox: conversations from Telegram, WhatsApp, Discord and Slack in one place
	Storage and hosts: Dropbox, UniFi UNAS, S3, SFTP, SMB and NFS in Drive; the Docker engine of every server you enrol
	Deploy elsewhere: Vercel, Railway and AWS (ECS, Amplify) projects next to your own
	Networking: DNS records and tunnels with Cloudflare, ngrok tunnels, DuckDNS names
	Models: your own keys for these and over 50 more providers
	Coding agents: Claude Code, Codex, Gemini CLI, Copilot CLI, Cursor CLI, OpenCode and 9 more in live sessions; MCP clients connect as you
	Places: plugs, lights, locks and climate from these brands; cameras from Tapo, VIGI, Reolink, Hikvision, Dahua, Amcrest, or any ONVIF or RTSP camera
	Game servers: players link their game accounts so servers recognise them
	Chat: listen along on Spotify, GIFs from Tenor and GIPHY, Krisp noise filtering in calls
	Security: uploads scanned by VirusTotal, known-bad addresses blocked with Criminal IP or Dymo
	Vault: Bitwarden apps and extensions point at it; imports from Bitwarden, KeePass or any CSV
	Notes: an Obsidian vault, or any folder of Markdown, imported with its links
	Databases: deployed or external, browsed, queried and backed up

Mail also takes any IMAP account and imports .mbox and .eml archives.

Something made in one app is reachable from the others without copying it.

• Mention it. Type # in a chat message, an email, a task or a note to link a task, a doc or a note. A pasted link to a task, event, channel or message becomes a card that shows its current state.
• Attach from Drive. Chat, Mail, Tasks and Office take a file straight from Drive, with no download and re-upload.
• Plan it in Calendar. Create a task due at a slot, or give an event a Polaris meeting link.
• Hand it to an agent. A task goes to a coding agent from its panel; the agent reads it and moves it through Polaris's MCP server.
• Hear about it in Chat. Camera and device alerts from Places arrive as messages.

flowchart LR
    Drive -- attach --> Chat
    Drive -- attach --> Mail
    Drive -- attach --> Tasks
    Drive -- open as a document --> Office
    Chat -- "mention with #" --> Tasks
    Mail -- "mention with #" --> Tasks
    Notes -- "mention with #" --> Tasks
    Calendar -- new task due here --> Tasks
    Calendar -- meeting link --> Chat
    Tasks -- hand to agent --> Agents

These work for any service Polaris deploys, with no SDK, agent or change to the app's code: they run at the edge or on the host.

	Instead of	Polaris
	Google Analytics, Plausible	Analytics read from the edge's access log, with no script tag
	Cloudflare WAF and Access	Firewall in front of every route: country and network rules, bot defences, injection scanning, bans, and an optional sign-in wall
	Beekeeper Studio and other database GUIs	Databases: browse and query Postgres, MySQL, MariaDB, MongoDB and Redis
	Uptime Kuma and other uptime checkers	Watch: every domain probed, a sustained outage alerted
	Datadog and other metrics agents	Metrics for every container and server, read over SSH and Docker
	Certbot	HTTPS: Let's Encrypt certificates issued and renewed for each public domain

Error tracking is the exception: Telemetry takes events from the Sentry SDK your app already uses, so the one change is the DSN.

The Update button in Settings is how an installed Polaris is updated. The limited edition has no host daemon, so there the button reports that updates are unavailable.

flowchart LR
    A[Update button] --> B[dashboard]
    B -- full edition: POST /v1/update --> C[polaris-hostd]
    B -- limited edition: no hostd --> Y[updates unavailable]
    C -- update command set --> D[polaris-updater]
    D --> E[scripts/update.sh]
    E --> F[pull the release]
    F --> G[add new settings to .env]
    G --> H[start the new dashboard, retire the old one]
    C -- no update command --> X[501: not available]

Every router has an explicit priority, highest first. Routes with firewall rules pass through the guard before reaching the app.

flowchart LR
    R[request] --> T[Traefik]
    T -- "110: call path, guarded" --> L[LiveKit]
    T -- "100: /livekit, /api/deploy/ws" --> P[LiveKit, terminal]
    T -- "50: dashboard hostnames" --> D[dashboard]
    T -- "40: deployed app hostnames" --> G{firewall guard}
    G -- allowed --> S[app container]
    G -- denied --> B[block page]
    T -- "10: catch-all" --> D
    T -- "1: unrouted name" --> V[vacant page]

flowchart LR
    A[Git repository] --> B[build on the server or a chosen build machine]
    U[upload] --> B
    I[image] --> C
    B --> C
    C[container on the Polaris host or an enrolled server] --> E[that server's Traefik: route and firewall]
    E --> F[your domain, a Cloudflare or ngrok tunnel, or DuckDNS]

flowchart TB
    subgraph dashboard
        web[apps/web: Next.js dashboard]
        apps[apps/calendar, places, game-servers, crm]
        ext[apps/extension: browser extension]
        pkgs[packages: core, db, ui, storage, deploy, ...]
        svc[services: edge-guard, messaging-bridge, camera-relay, vision, face, hytale]
        cli[packages/cli: developer CLI]
    end
    hostd[crates/polaris-hostd: Rust host daemon]
    desk[desktop: Electron app]
    plug[plugins/unifi-unas]
    web --> pkgs
    apps --> pkgs
    cli --> web
    desk --> web
    ext --> web
    web -- unix socket --> hostd

Once it is up, open the dashboard and create your account - the first account becomes the administrator.

On your local network it is also reachable at http://polaris.local (mDNS), and at http://polaris from the machine running it.

The desktop app (Windows, macOS, Linux) opens an instance in its own window with system notifications; see desktop/README.md.

Docker Engine with the Compose v2 plugin. For local development without containers, see the developer guide.

Run it on Linux (Ubuntu Server is the tested target). Polaris uses privileged mounts, the host's Docker engine and host networking, which are native there.

Windows is not recommended as the host: Docker runs inside WSL, so Polaris manages that virtual machine instead of the machine itself, and mounts and host networking behave differently or not at all. A Windows machine works fine as an additional server managed from a Linux install.

How to report a bug, propose a change and open a pull request is in CONTRIBUTING.md; everyone taking part follows the code of conduct. The monorepo layout, the development loop, how to build and test the dashboard and the Rust components, and the release flow all live in the developer guide.

Polaris is licensed under the GNU AGPL-3.0 with the additional terms in NOTICE.md:

• Use it, change it and share it, commercially too, under the AGPL-3.0.
• A modified version - distributed, or offered to people over a network - must publish its full source under the same license. Closed-source forks are not allowed.
• A modified version must say visibly that it is based on Polaris.

To use Polaris outside those terms, for example in a closed-source product or a hosted service whose source you do not publish, ask for a commercial license (see NOTICE.md). Releases published before this change remain under Apache-2.0.

To cite Polaris, use CITATION.cff.