Windshift

Your data. Your server. Your call.

Start with Docker and SQLite. Move to the setup your team needs.

Run Windshift locally with Docker and SQLite using the installer at https://windshift.sh/install.sh. It generates and stores your SSO secret and persists your data in a Docker volume or a host directory you choose.

When you are ready to share it, follow the production guide for HTTPS, authentication, outbound network rules, backups, monitoring, and upgrades.

Set the two values Windshift needs

The installer handles the local container setup. For any shared or public instance, set the secret and public URL first, then follow the production guide.

The installer creates the SQLite database and stores the generated secret for you. The other security settings belong in the production guide.

  • Generate SSO_SECRET with a cryptographic tool. Never commit it to source control.
  • Set BASE_URL to the address where people will use Windshift.
  • Persist the database and attachments outside the container.

Pick how to run it

Run the single Windshift binary directly, or use the official container image with Docker or Podman.

Both options listen on port 8080

Create the secret and URL

Generate SSO_SECRET once and keep it stable. Set BASE_URL to the address your team will use for links, SSO, WebAuthn, and callbacks.

The only required configuration

Start with SQLite or use PostgreSQL

SQLite is a good fit for a small, single-server team. Choose PostgreSQL for heavier writes or existing database operations.

Switch databases when your needs change

Put HTTPS in front of it

Use a reverse proxy for HTTPS, or let Windshift handle TLS. Keep the backend private when a proxy is in front.

Use the URL your team sees

Keep your files between restarts

Store the database, attachments, and plugins on durable storage. Back up the attachments as well as the database.

Mount /data in your container runtime

Decide what Windshift can reach

Review every server-side integration. The production guide shows how to block private network destinations when you do not need them.

Protect outbound connections

Plan for the next upgrade

Pin releases, back up before upgrades, test a restore, and check health after every change.

Backups before upgrades

Use the one-command installer

It checks Docker or Podman and OpenSSL, pulls Windshift, generates and stores your SSO secret, and starts the server.

Copy and run in Terminal

curl -fsSL https://windshift.sh/install.sh | sh

The script uses a Docker or Podman volume by default. It asks if you want to use a host directory instead. This setup is for local evaluation. Use the production guide before you expose Windshift.

Inspect the install script

Keep the server healthy

Windshift gives you the software. You choose the host, protect access, keep backups, and decide when to upgrade.

  • Back up the data: Keep copies outside the server and test that you can restore the database and attachments.
  • Protect the front door: Use HTTPS, keep secrets private, restrict backend access, and connect the identity provider your team trusts.
  • Keep it healthy: Watch health and readiness, read release notes, and test upgrades before you make them live.

Pick the setup that fits you

Try the local installer first. When your team is ready, choose a database, add HTTPS and SSO, and follow the production checklist.

  • Download the binary, set the secret and URL, and open a local SQLite instance.
  • Start the quick setup
  • Use the official image with Docker or Podman, persistent storage, and the required temporary filesystem.
  • Open the container guide
  • Use your existing PostgreSQL server and its backup tools when SQLite is no longer enough.
  • Set up PostgreSQL
  • Set up HTTPS, authentication, outbound network rules, backups, and monitoring in the right order.
  • Open the production guide

Ready to run Windshift?

Start locally, then move Windshift to the infrastructure your team already trusts.