Skip to main content
Community Community runs Nitsor on your infrastructure. It is free; you pay for hosting, storage and compute.
Community is a single-node deployment. You own its operation and backups. Billing and telemetry are off.
Community installs the Nitsor backend. The stack has no Nitsor web app, so there is no sign-in page to open. Anonymous HTTP calls such as GET /api/v1/capabilities work. Authenticated API calls and the Python SDK need an agent credential, which a Community deployment cannot issue (see Connect API clients).

​
Requirements

  • An arm64 or x86_64 Linux or macOS host.
  • Docker Engine or Docker Desktop with Docker Compose v2.
  • At least 10 GiB free on the installation volume.
  • Ports 3210, 3211 and 6791 free on 127.0.0.1.
  • An OIDC client registered in your own identity provider, with its issuer URL, client ID and client secret.
  • minisign, to verify the download.

​
Download the bundle

Nitsor publishes each Community bundle as an immutable release at github.com/nitsor/self-host/releases. Download the latest nitsor-self-host-<commit>.tar.gz and SHA256SUMS with its signature SHA256SUMS.minisig. <commit> is the first 12 characters of the Nitsor commit the bundle was built from.

​
Verify the download

SHA256SUMS is signed with minisign. Save this public key as nitsor-release.pub. Its key ID is F1819173358F3BE4:
Check the signature, then the archive:
Both commands must succeed before you unpack the archive. On macOS, shasum -a 256 -c SHA256SUMS replaces sha256sum.

​
Install

Unpack the bundle and run the installer from its directory:
The installer asks for the OIDC issuer URL, client ID and client secret, and hides the secret as you type. For automation, set NITSOR_OIDC_ISSUER, NITSOR_OIDC_CLIENT_ID and NITSOR_OIDC_CLIENT_SECRET, then run ./install.sh --non-interactive. The installer never takes these values as arguments, because other users of the host can see arguments. Start Nitsor from the same directory:
Run Compose for this stack with -f compose.yaml, from a shell that exports no COMPOSE_* variable and none of the settings in .env. A variable exported in your shell overrides .env. Ports 3210, 3211 and 6791 are fixed for the first install. To use others, change them in .env afterwards and restart.

​
Installer checks

install.sh refuses to run when:
  • compose.yaml or .env.example does not match the SHA-256 in release.txt;
  • the bundle was built more than 30 days ago, unless you pass --allow-stale;
  • the bundle is older than the release already installed in the directory;
  • a port is taken by another process, Docker is missing, or less than 10 GiB is free. While this directory’s own stack is running, its ports are not probed, so an upgrade can run with Nitsor up;
  • a Nitsor data volume exists but .env is missing;
  • an override file such as compose.override.yaml is in the directory;
  • another install.sh holds the .install.lock directory. If no install is running, a crashed run left it behind: remove it with rm -r .install.lock.

​
Files in the bundle

release.txt only proves that compose.yaml and .env.example match the release. The signature on SHA256SUMS is what proves the download.

​
Back up .env

The installer writes .env with mode 600. It holds INSTANCE_SECRET, the OIDC client secret and the backend admin key. Keep a copy in secure storage: a new INSTANCE_SECRET cannot open existing data.

​
What runs

Every port binds to 127.0.0.1 only. Scheduled cleanup jobs run inside the stack without an external scheduler.

​
Configure storage

For Nitsor’s own artifacts, set STORAGE_PROVIDER=s3-compatible and S3_ENDPOINT together. For example, a MinIO endpoint can be http://minio:9000. The provider and endpoint must agree; a mismatch refuses instead of guessing. S3_ENDPOINT covers only Nitsor’s own artifacts. A storage connection to a source bucket follows its own endpoint rules: https, and a hostname rather than a private, loopback or link-local address. To connect a bucket served over plain http, such as a local MinIO, set NITSOR_STORAGE_HTTP_ENDPOINTS=local-development as a backend environment variable in the operator dashboard. That value is the only one that allows http, and it is meant for local development. Source volumes stay in your S3-compatible buckets and register by reference, as on hosted plans. Follow Register a source to configure a storage connection and register object keys.

​
Configure retention

Set retention windows through backend environment variables in the operator dashboard:

​
Connect API clients

The public API is served under /api/v1 at the deployment’s own site URL, recorded as NITSOR_CONVEX_SITE_URL in .env. Use that origin for your clients instead of api.nitsor.com. Community uses the same public API contract and Python SDK as hosted plans. Agent credentials are issued on the Nitsor dashboard’s Team settings, then Service accounts. The self-host stack does not include the Nitsor dashboard, so a Community deployment has no supported way to issue one. Credentials are issued in the hosted app on Team and Enterprise.

​
Upgrade

  1. Download the new bundle and verify it as above.
  2. In the directory that holds nitsor-self-host, unpack the new bundle with tar -xzf nitsor-self-host-<commit>.tar.gz. The bundle has no .env, so yours is kept.
  3. Run ./install.sh from nitsor-self-host. It repeats the bundle checks, pulls the new images and deploys the new functions.
  4. Run docker compose -f compose.yaml up -d.
The installer refuses a downgrade. It also refuses a bundle built more than 30 days ago unless you pass --allow-stale; that flag does not allow a downgrade.

​
Backups

You own backups. Nitsor has no backup or restore command, and the data volume is not a backup. Back up both the volume and .env yourself.

​
Limits

Community runs on one node. Nitsor provides no Helm, Kubernetes, high-availability or multi-node configuration. The stack sends no email. Invitations, the Members page and the SMTP settings belong to the Nitsor web app, which the bundle does not include. Auto-label stages do not run on a Community deployment: its run plane is off, and Nitsor runs no hosted compute for Community. Nitsor does not run model inference in the browser. See Capabilities and limits for the shared product limits.

​
License

Nitsor’s SDKs and application code are source-available under FSL-1.1-ALv2, not open source. The bundled Convex backend is licensed separately by Convex under its own FSL-1.1-ALv2. Read the license text shipped with each package.

​
Next step

Follow the Quickstart to connect a client, then Plan your first project.
PlansCommunity
Last verified2026-10-21