Deploying Glassy with Docker

git clone https://github.com/0Reliance/glassy-selfhost.git
cd glassy-selfhost

cp .env.example .env

Edit .env and fill in four required fields:

GLASSY_MEMBER_EMAIL=your@glassy-account-email
GLASSY_SELFHOST_TOKEN=<pairing token from Settings → Self-hosting on app.glassy.fyi>
JWT_SECRET=$(openssl rand -hex 32)
API_KEY_ENCRYPTION_KEY=$(openssl rand -hex 32)

The GLASSY_SELFHOST_TOKEN is a pairing token you generate in Settings → Self-hosting on app.glassy.fyi. It prevents anyone who merely knows your email from spinning up an unlocked instance using your membership — the cloud checks both your email and your token on first boot.

Generate the secrets on the command line:

echo "JWT_SECRET=$(openssl rand -hex 32)"
echo "API_KEY_ENCRYPTION_KEY=$(openssl rand -hex 32)"

docker compose up -d

Wait for initialization:

docker compose logs -f

When you see the server listening, the appliance is ready.

On first boot, the appliance verifies your membership, creates your local admin account, and prints a random initial password once:

# First boot only — the password is printed to the logs once:
docker compose logs glassy | grep -A2 "Default admin created"

# Survives container recreation (deleted after your first password change):
docker exec glassy cat /app/data/.initial_admin_password

Open http://localhost:3000 in your browser. Sign in with your membership email and the password from the logs. You will be immediately prompted to set a permanent password on first login.

Registration is permanently disabled — this is a single-owner appliance.

curl http://localhost:3000/ready

Returns JSON: {"status":"ready",...} when healthy. If you get HTML, the container is still starting — wait a few seconds.

The dashboard should show no upsells, no “upgrade” prompts, and no marketing surfaces. All features are unlocked.