Ghostfolio — a self-hosted wealth-management and investment-portfolio tracker: monitor stocks, ETFs, crypto, and cash across accounts, with performance analytics, allocation charts, and dividend tracking. Deployed as an all-in-one host-networked Nomad job: the Ghostfolio app plus PostgreSQL and Redis sidecars with a persistent database volume.
Needs nomad-pack on PATH. The script only adds the nomploy registry and runs this pack.
Source ↗ Project ↗ ★ 9.3k ⚑ Report an issue
Save as values.hcl, edit, then run:
# The name of the Nomad job.
job_name = "ghostfolio"
# The Nomad namespace to deploy into.
namespace = "default"
# The datacenters to deploy to.
datacenters = ["*"]
# The Ghostfolio app image. Pin a tag in production.
image = "ghostfolio/ghostfolio:latest"
# The PostgreSQL image for the bundled database.
postgres_image = "postgres:16-alpine"
# The Redis image for the cache and job queues.
redis_image = "redis:7-alpine"
# Host port for the Ghostfolio web app (PORT).
port = 3333
# Host port for the co-located PostgreSQL.
db_port = 5432
# Host port for the co-located Redis.
redis_port = 6379
# Password for the Ghostfolio PostgreSQL user.
db_password = "ghostfolio"
# Password for the co-located Redis (REDIS_PASSWORD).
redis_password = "ghostfolio"
# Salt used to hash security/access tokens (ACCESS_TOKEN_SALT). CHANGE THIS — generate with: openssl rand -hex 16.
access_token_salt = "change-me-access-token-salt"
# Secret used to sign JWTs (JWT_SECRET_KEY). CHANGE THIS — generate with: openssl rand -hex 32.
jwt_secret_key = "change-me-jwt-secret-key"
# Named volume for PostgreSQL data (/var/lib/postgresql/data). Holds all accounts and activities.
db_data_volume = "ghostfolio_db_data"
# Placement constraints. Pin to the node holding the volume. On a nomploy cluster: attribute = "$${meta.nomploy_control_plane}", operator = "=", value = "true".
constraints = []
# Resources for the Ghostfolio app task.
resources = {
cpu = 1000
memory = 1024
}
# Resources for the PostgreSQL task.
postgres_resources = {
cpu = 300
memory = 256
}
# Resources for the Redis task.
redis_resources = {
cpu = 200
memory = 128
}
| Name | Type | Default | Description |
|---|---|---|---|
| job_name | string | "ghostfolio" | The name of the Nomad job. |
| namespace | string | "default" | The Nomad namespace to deploy into. |
| datacenters | list | ["*"] | The datacenters to deploy to. |
| image | string | "ghostfolio/ghostfolio:latest" | The Ghostfolio app image. Pin a tag in production. |
| postgres_image | string | "postgres:16-alpine" | The PostgreSQL image for the bundled database. |
| redis_image | string | "redis:7-alpine" | The Redis image for the cache and job queues. |
| port | number | 3333 | Host port for the Ghostfolio web app (PORT). |
| db_port | number | 5432 | Host port for the co-located PostgreSQL. |
| redis_port | number | 6379 | Host port for the co-located Redis. |
| db_password key | string | "ghostfolio" | Password for the Ghostfolio PostgreSQL user. |
| redis_password key | string | "ghostfolio" | Password for the co-located Redis (REDIS_PASSWORD). |
| access_token_salt set me | string | "change-me-access-token-salt" | Salt used to hash security/access tokens (ACCESS_TOKEN_SALT). CHANGE THIS — generate with: openssl rand -hex 16. |
| jwt_secret_key set me | string | "change-me-jwt-secret-key" | Secret used to sign JWTs (JWT_SECRET_KEY). CHANGE THIS — generate with: openssl rand -hex 32. |
| db_data_volume | string | "ghostfolio_db_data" | Named volume for PostgreSQL data (/var/lib/postgresql/data). Holds all accounts and activities. |
| constraints | list | [] | Placement constraints. Pin to the node holding the volume. On a nomploy cluster: attribute = "$${meta.nomploy_control_plane}", operator = "=", value = "true". |
| resources | object | {
cpu = 1000
memory = 1024
} | Resources for the Ghostfolio app task. |
| postgres_resources | object | {
cpu = 300
memory = 256
} | Resources for the PostgreSQL task. |
| redis_resources | object | {
cpu = 200
memory = 128
} | Resources for the Redis task. |
No variables match.
This pack stores data in one Docker named volume:
ghostfolio_db_data
⚠ This pack bundles a database. A cold copy of the volume can be inconsistent — for a reliable backup, dump the DB (pg_dump / mysqldump) or stop the job while backing up.
restic
# Run on the node hosting this pack. Point restic at your repo first: # export RESTIC_REPOSITORY="s3:https://<account>.r2.cloudflarestorage.com/<bucket>" # export RESTIC_PASSWORD="<repo-password>" # export AWS_ACCESS_KEY_ID=<key> AWS_SECRET_ACCESS_KEY=<secret> restic backup \ /var/lib/docker/volumes/ghostfolio_db_data/_data
rclone (sync to S3/R2)
rclone sync /var/lib/docker/volumes/ghostfolio_db_data/_data backup:<bucket>/ghostfolio_db_data
Paths assume the default Docker volume location (/var/lib/docker/volumes). Restore by stopping the job, restoring files into the same volume, and re-running the pack.
Ghostfolio — a self-hosted wealth-management and investment-portfolio tracker. Follow stocks, ETFs, cryptocurrencies, and cash across multiple accounts, with performance analytics, asset-allocation charts, dividend tracking, and a privacy-first design (no ads, no account linking).
All-in-one host-networked Nomad job: the Ghostfolio app plus PostgreSQL and Redis sidecars. Database migrations run automatically on boot.
nomad-pack registry add nomploy https://github.com/Nomploy/nomad-packs
nomad-pack run ghostfolio --registry=nomploy
| Variable | Default | Description |
|---|---|---|
port |
3333 |
Web app port (PORT). |
access_token_salt |
change-me-… |
ACCESS_TOKEN_SALT — hashes access tokens. Change it (openssl rand -hex 16). |
jwt_secret_key |
change-me-… |
JWT_SECRET_KEY — signs JWTs. Change it (openssl rand -hex 32). |
db_password |
ghostfolio |
PostgreSQL password. |
redis_password |
ghostfolio |
Redis password (REDIS_PASSWORD). |
db_port / redis_port |
5432 / 6379 |
Host ports for the bundled services. |
db_data_volume |
ghostfolio_db_data |
/var/lib/postgresql/data — accounts and activities. |
image |
ghostfolio/ghostfolio:latest |
App image. Pin a tag in production. |
resources / *_resources |
see variables.hcl |
Per-task resources. |
Open the app, create your account, and start adding holdings. Keep ACCESS_TOKEN_SALT and
JWT_SECRET_KEY stable and secret. Serves plain HTTP — front it with a reverse proxy for TLS. Pin the
job to the node holding the volume with constraints.