This guide is for running OneCamp on your own server, which is what a
one-time licence entitles you to. OneCamp Cloud subscribers do not install
anything — the hosting is set up for you.

You need a Docker-capable server with a public IP, and a domain you control.

1. Download and unpack, on the server

Run this on the server, replacing the key with the one from your licence email:

/bin/bash -c "$(curl -fsSL https://backend.onemana.dev/onecamp/download/YOUR-LICENSE-KEY)"

The installer asks which edition you want — v2 with AI teammates, or v1
with no AI at all — then asks for your frontend and backend domains and unpacks
everything into a directory. Both editions come with your key.

2. Install

From that directory, one command does the rest — configuration, credentials,
database, and a health check:

make install EMAIL=you@example.com DOMAIN=example.com PASSWORD=<traefik-admin-password>

EMAIL becomes the workspace admin and the address Let's Encrypt notices go to.
PASSWORD protects the Traefik dashboard. You do not need to open .env — every
credential is generated for you.

It prints the DNS records to create. Add them, then re-run if certificates were
not yet issued.

3. Check it

make verify

make verify inspects the running system: every container up, migrations
applied, the backend connected to Postgres, Dgraph, Redis, MinIO, EMQX and
OpenSearch, and your domain answering over HTTPS. It reports every problem it
finds rather than stopping at the first, and is safe to re-run.

make doctor is the counterpart for configuration — it checks .env before you
start, where verify checks the result after.

4. Deploy the web app

The server you just set up runs the API and its datastores. The web app people
open is a separate deployment — host it wherever you prefer (Vercel, Netlify, or
your own server) from the frontend repository
(MIT licensed), pointing it at this backend:

NEXT_PUBLIC_BACKEND_URL=https://onecamp-backend.example.com/
NEXT_PUBLIC_FRONTEND_URL=https://onecamp.example.com/
NEXT_PUBLIC_MQTT_HOST=onecamp-emqx.example.com

Point onecamp.example.com at that deployment, not at this server.

5. Create the first admin

Open https://onecamp.example.com/admin-setup and create the account. That page
works once — after an admin exists it refuses.

Updating

Run the same command you installed with — the one from your licence email. It
compares what you are running against the current release on your edition, offers
the newer one, and after unpacking asks whether to apply it.

Applying it backs up the database first, migrates, rebuilds, restarts, and then
runs the same checks make verify does. Any step failing stops the rest, so a
migration never lands against an image that was not built.

If you decline, the files are staged and nothing has changed. Finish whenever you
like:

make update

Your .env, your data and your uploads are untouched by an update. The backup it
takes first is under ./data/backups — keep it until you are happy, then remove it.

Updating does not change your edition. To move from v1 to v2, or back, choose the
other one when the installer asks.

If you are locked out

Your admin password is set once and never stored anywhere we or you can read it
back from, so it cannot be looked up or resent. A new one is the only way in.

Every command below runs on the server, needs nothing but shell access, and
works whether or not email is switched on.

make reset-link EMAIL=you@example.com

Prints a one-time link that lets you choose a new password. Prefer this one:
nobody has to read a password out loud, and the link expires.

make reset-password EMAIL=you@example.com

Sets a password directly and prints it. For when the reset page itself cannot be
reached.

make clear-2fa EMAIL=you@example.com

Only when the authenticator and every recovery code are gone. Deliberately
separate from a password reset.

make change-email OLD=old@example.com NEW=new@example.com

When the mailbox itself is gone, so no link could ever reach you.

Each command tells you if the account has two-factor turned on, because a new
password alone will not sign you in then.

What you configure afterwards, in the admin panel

None of these need a config file.

Google / GitHub sign-in — add your own OAuth client id and secret.
Email — add a Resend API key. Do this first. Until you do, your
workspace cannot send anything, and it fails silently: an invitation is
created and never arrives, and "forgot password" answers "check your email"
either way, because that endpoint deliberately gives the same answer whether
or not an account exists. make verify reports this as a TODO.
AI — choose a provider and paste your key, or run models locally.

AI models

OneCamp does not ship a model. You choose where inference happens.

Use your own provider key. In the admin AI panel, pick openai,
anthropic, or openai_compatible and paste your key. The last covers
OpenRouter, Groq, Together, vLLM, LM Studio and any other /v1-compatible
endpoint. Keys are encrypted with AI_CONFIG_KEK, and the server refuses to
start if that key is unset — so a stored key is never protected by a value
someone else could know.

Or run models on this server (v2 only):

make ollama_up        start the engine and pull models
make ollama_update    move to the pinned version
make ollama_down      stop it; models stay on disk

Local models need real memory — budget 8 GB or more beyond the rest of the
stack. On a small server, a hosted provider key is the better choice.

Reaching the admin consoles

The EMQX dashboard, MinIO console and OpenSearch Dashboards are deliberately not
published to the internet. Reach them over an SSH tunnel:

make console-tunnel

That prints the exact ssh -L command and the localhost URLs to open.

If you downloaded before 22 August 2026

Re-run the installer. It always fetches the current release on whichever edition
you choose, so there is no version to look up.

Archives published before that date contained firebase-cred.json, a
service-account credential belonging to OneMana. It granted access to a OneMana
Firebase project — not to your workspace, your server, or your data — and it has
been rotated. Delete any older archive you kept.

Those releases also baked a copy of your .env into the container image, so your
own database password and encryption keys were sitting inside it. That is fixed
in the same update.

Installation