This repository provides the Docker Compose configuration and deployment files needed to configure and run the AppFlowy Self-Hosted server on your own infrastructure.
To get started, follow our comprehensive Step-by-Step Self-Hosting Deployment Guide.
We also provide a series of self-hosting video tutorials on YouTube covering deployment, configuration, and administration.
Check out our release notes for the latest updates, improvements, and fixes.
For audit configuration, event review, and CSV export in the Admin console, see the illustrated Audit Logging guide.
For Google Drive and Google Calendar setup in Admin and account connections from web and desktop, see the illustrated Connections guide.
AppFlowy's production services are powered by our commercial AppFlowy Cloud codebase, which is actively developed and maintained by the AppFlowy team.
It supports two deployment models:
- AppFlowy Managed Cloud (SaaS): AppFlowy instances hosted on AWS and fully deployed, operated, upgraded, and maintained by the AppFlowy team.
- AppFlowy Self-Hosted: AppFlowy services deployed on your own infrastructure, giving your organization control over its data, authentication, storage, backups, and deployment environment. It is designed for teams and enterprises that require data sovereignty, private infrastructure, or greater control over their deployment.
Both deployment models are powered by the same commercial AppFlowy Cloud codebase.
AppFlowy Self-Hosted includes a Free Tier for experienced IT professionals, developers, and self-hosting enthusiasts who want to evaluate and deploy AppFlowy on their own infrastructure.
You can start with the Free Tier and upgrade the same deployment to a paid self-hosted plan as your requirements grow.
The Free Tier includes:
- One User Seat (per instance)
- AppFlowy Web App access (via your hosted domain, e.g., https://appflowy.com)
- Up to 3 Guest Editors who can be added to selected pages to collaborate in real-time with granular permissions (Can View / Comment / Edit)
- Version history
- Publish Pages functionality
- Unlimited Workspaces
For detailed pricing, plan limits, and feature comparisons, see:
- Self-Hosted Plans and Pricing
- The Admin Panel of your self-hosted deployment
- The official AppFlowy Pricing page
This repository is distributed under the AppFlowy Self-Hosted Commercial License. Please review the license terms before deploying or redistributing the software.
Commercial self-hosting helps fund the continued development, maintenance, and security of AppFlowy and its open-source projects.
- PDF and Word imports (Desktop) — Added imports of PDF and DOCX files into editable pages in workspaces connected to a server, with batch progress and warnings for unsupported content.
- Database version history (Desktop, opt-in) — Added previews and restoration of saved database versions, with a recovery checkpoint before restoring.
- Formulas and rollups (Desktop) — Added formulas that read properties from related rows, rollups of formula results, and counts or percentages matching multiple selected options.
- MCP database tools — Added creation of Timeline and Form views and creation or editing of Formula properties. Formula results remained calculated by clients.
- Formula editing (Desktop) — Opened the editor below the selected cell, added property-reference chips, and improved editing and copying of long formulas.
- Timeline views (Desktop) — Added resizable table columns with saved widths and improved settings layouts.
- Import controls — Added runtime configuration of document and ZIP upload limits through the Admin API. Enforced a shared limit of three ongoing imports per user across workspaces;
MAXIMUM_IMPORT_PENDING_TASKno longer changed that limit.
- Fixed database restores so sidebar entries, relations, row metadata, and published-page cleanup followed the restored state, and connected clients recovered from stale updates.
- Fixed Desktop linked-database recovery, tab refreshes, and spurious missing-database errors when switching workspaces; corrected self-hosted feature availability and cloud upgrade prompts.
- Fixed interrupted import delivery and cleanup so retries recovered unfinished work without creating duplicate document pages.
- Service rollout — Let Cloud's migrations finish before starting updated Worker, Search, and optional MCP services. Use matching self-hosted builds throughout, resume import traffic only after the updated Worker is running, and update the Desktop companion client separately.
- Database history — To enable the Desktop feature, set
APPFLOWY_DATABASE_HISTORY_ENABLED=trueon Cloud and restart it after rollout. Keep page-history generation and database blob storage enabled, and use Desktop0.14.6or newer. The oldAPPFLOWY_DATABASE_HISTORY_RESTORE_PERMISSION_FENCE_READYflag was removed. - Import storage permissions — Ensure Cloud's S3 credentials can list and abort multipart uploads so interrupted imports can be cleaned up.
Baseline: 3066747196d8e39a1b9fe1b2b9eff3f697be3707
Desktop Baseline: 781e514d5e6b75e8a9d5b69e8fb685bbaa728ae1
- Fixed integration authorization in AppFlowy Web so connection popups returned results to the browser and avoided unwanted desktop launches.
- Web connections — When using Connections in AppFlowy Web, deploy Cloud alongside a Web build that supports the browser OAuth callback.
Baseline: ac05c6f4988e8b76c1b003b35076e9564d25841d
- Database history previews and recovery — Added APIs to preview saved database views and rows without changing live data, and to require a recovery checkpoint before restoring so the previous database state could be recovered.
- Formula fields — Added server support for Formula properties, preserving expressions and display settings for calculation in compatible clients.
- Confluence CSV imports — Added single-space CSV ZIP imports with page hierarchy and attachments, preserved source metadata and comments as document content, and reported omitted or unsupported content.
- Timeline views — Expanded saved settings for dependencies, separate start and end dates, progress, and weekend-aware scheduling, and included embedded Timeline content in PDF exports.
- Fixed database duplication so self-relations, saved relation filters, and Timeline dependencies referenced the copied rows correctly.
- Fixed inconsistent initialization of new row documents that could cause content loss when client and server initialized the same document independently.
- Service rollout — Upgrade Cloud and Worker together, and let Cloud's database migrations finish before deploying clients that use the new history preview and recovery APIs.
- Row-document sync — Deploy desktop/mobile clients containing the matching document-initialization fix alongside the server. This prevented new conflicting histories; it did not repair previously damaged documents.
Baseline: fa6a37bee7bb1e5380e51cdceb909da17022c95e
- Confluence imports — Added Confluence HTML ZIP imports into new or existing workspaces, with page hierarchy, attachments, internal links, and editable tables.
- Admin audit APIs — Added audit search and CSV export across workspaces, plus coverage for space, group, sharing, and directory permission changes when auditing was enabled.
- Fixed legacy row-document access for users with read-only permissions and enforced page and space restrictions on Notion import destinations.
- Fixed stale snapshots and incomplete template copies, preserved pending updates through temporary storage failures, and reduced excessive retries in sync recovery and search indexing.
Baseline: 61160e37c6c790baff826183837b392cbcb7875c
- Saved publishing preferences — Added an API to manage comment and duplication settings while pages were unpublished, preserving each page's choices across republishing and public URL reuse.
- Publishing diagnostics — Added failure-stage, page, and asset details to server logs to help operators diagnose publishing errors.
- Fixed publishing failures caused by missing document child blocks or file metadata; missing files no longer blocked the rest of a page from publishing.
- Fixed database publishing failures from repeated file references and preserved references to existing public files during republishing.
- Publishing settings clients — If deploying clients that use the new publishing settings API, upgrade Cloud and let its database migrations finish first.
Baseline: 0314742175473683ab18d5b86147108d0a007fad
- Database forms — Added form views with public sharing, anonymous submissions, and file uploads, with responses automatically saved as database rows.
- Legacy database upgrades — Added an upgrade API that organized eligible legacy database views under a tab container while preserving database and view identities and existing content.
- Search — Preserved document headings, table context, and database field names in semantic indexing, bounded retained indexing memory, and improved queue backlog draining.
- Automatic row repair — Enabled paced, resumable repair of verified missing database-row parent records so members regained access to affected row documents.
- Web compatibility — Added an independent minimum Web client version through
APPFLOWY_MIN_WEB_CLIENT_VERSION, defaulting to0.17.1, and exposed it alongside the server version.
- Fixed page-permission precedence and inconsistent sharing details, and prevented access increases through self-revocation.
- Fixed account deletion and member removal involving owned private spaces, and authentication responses with missing identity sign-in timestamps.
- Fixed recoverable Folder stalls, stale mutation replay, and missing or misordered sidebar updates.
- Service rollout — Upgrade Cloud, Worker, and Search together, allowing Cloud's migrations to finish before starting the updated Worker and Search. Custom
APPFLOWY_WORKER_DATABASE_MAX_CONNECTIONSsettings must allow at least three connections.
Baseline: e01e7f2a96c6f7acc3b19d0c3a2687fb18cdaadb
- Permission caching — Isolated access-detail group projections from realtime authorization and added a rollout-gated per-object Folder inventory, reducing broad cache invalidation without weakening access checks.
- Restore capacity — Added auto-sized memory and disk staging profiles that bounded restore memory, row, object, and temporary-storage use to the Cloud container's configured limits.
- Search summaries — Separated long AI-summary requests from ordinary interactive search timeouts so provider timeouts could return a structured response instead of an empty HTTP timeout.
- Fixed CSV imports so inferred field types were preserved, a later Rich Text column could become the title, and typed-only CSVs received a populated title without changing the source columns.
- Fixed commercial seat enforcement so creating or joining another workspace did not double-count an existing person, while genuine distinct-user increases still respected the license limit after legacy overages or downgrades.
- Fixed collaboration recovery by containing exact pending-gap resend loops, guaranteeing manifest repair after quarantine, repairing drained Folder projection wedges on Worker cold start, and backing off failed database-blob reconciliation.
- Fixed legacy row-document access so pages created before provenance tracking safely inherited their parent database permission on first open without a migration.
Baseline: 7cc1303f1254e1001de7d85e9c46132f64bd1b65
- Structured space permissions — Added Public, Private, and Custom spaces with owner, member, and everyone-else access levels, access requests, safe visibility transitions, and controls for invitations, sidebar editing, guests, public links, and exports.
- Workspace groups — Added manual group management and group-based access to spaces and individual pages; SCIM groups were projected into the same permission model.
- Admin recovery and diagnostics — Added restoration of permanently deleted document and database views when their underlying collabs survived, plus secure download of database blobs selected through the database inspector.
- Database attribution — Added read-only Created by and Last edited by fields and a row-by-ID update API that maintained editor attribution.
- Fixed workspace imports, exports, and CSV completion so recoverable content and row ordering were preserved instead of failing or reporting completion too early.
- Fixed published database duplication and unpublishing across multi-view databases, relation dependencies, legacy relation identifiers, and incomplete database payloads.
- Fixed realtime recovery issues involving Redis awareness reconnects, dependent updates, orphaned views, Folder create retries, and database-row template uploads.
- Fixed space ownership and guest and group visibility edge cases, inline-comment anchoring and cross-device notifications, and renewed-license rebind consistency.
- Fixed a SQL injection vulnerability in the Quick Note API endpoint.
Baseline: d07810bafe7cc24925d0d20eda2028919fbfd517
- Collaboration & sync — Improved realtime diagnostics, queue performance, replay recovery, and full-state synchronization.
- Data integrity — Strengthened snapshots, database row recovery, private folder repair, and transient-write handling.
- Administration — Added client diagnostic log upload and download, collab snapshot previews, and cloud invite and license management.
- Publishing & templates — Unpublished trashed page trees automatically and fixed legacy, large-ID, and nested template publishing.
- Additional fixes — Improved permissions, authentication rate-limit handling, workspace exports, folder-only chat attachments, and self-hosted Ollama Qwen documentation.
Baseline: 359e02ed78e825908e912376f586b4abebe7b4bb
- SCIM 2.0 directory sync — Provision and deprovision users and Groups from Microsoft Entra ID, Okta, Authentik, and other compatible identity providers. Directory Groups can be mapped to AppFlowy workspace roles.
- LDAP login — Authenticate against configured LDAP directories and, when automatic provisioning is enabled, add users to their workspace on first login.
- Enterprise identity administration — Configure LDAP, SCIM, and custom OIDC connections through AppFlowy Admin.
These enterprise-authentication features require the Seed plan or higher. SCIM handles directory provisioning only; users continue to sign in through LDAP, SAML, or OIDC.
Use these component versions with the v0.17.3 enterprise identity features:
| Component | Version | Purpose |
|---|---|---|
| Admin Frontend | 0.16.5 |
Configure LDAP, SCIM, and custom OIDC connections |
| AppFlowy | 0.17.1 |
Desktop LDAP and custom OIDC sign-in |
| AppFlowy Web | 0.16.5 |
Web LDAP and custom OIDC sign-in |
SCIM is served at /scim/v2/*. The standard self-host deployment bind-mounts this repository's docker/nginx/nginx.conf into the Nginx container, so upgrading only the appflowy_cloud image does not update its routes.
In a copied or customized Nginx configuration, add this sibling location alongside the location / frontend catch-all:
location /scim {
# The bundled Nginx terminates TLS itself. Never redirect a bearer request
# after its credential has already crossed plaintext.
if ($scheme != https) {
return 403;
}
# SCIM filters can contain email addresses and external IDs.
access_log off;
error_log /dev/null;
# No trailing slash or rewrite: preserve /scim/v2/* for AppFlowy Cloud.
proxy_pass $appflowy_cloud_backend;
}LDAP also needs a trusted client address for per-IP rate limiting. In the existing location /api, add this directive, replacing any existing X-Forwarded-For directive rather than adding a duplicate:
proxy_set_header X-Forwarded-For $remote_addr;For rollout:
- Upgrade
appflowy_cloudand wait for its migrations and health checks to complete. - Reload or recreate Nginx with the SCIM route.
- In Admin Frontend
0.16.5, create the SCIM connection and copy the bearer token when it is returned. Configure the identity provider to usehttps://<host>/scim/v2. AppFlowy stores only the token hash, and the token must be rotated before its 90-day expiry.
The bundled Nginx listens on 443 ssl, which is why the block above checks $scheme. Replace its development certificate with a valid certificate trusted by the identity provider. If a trusted load balancer terminates TLS before Nginx, enforce HTTPS at that outer edge and configure Nginx's trusted real-client-IP boundary explicitly instead of copying the guard unchanged. Do not redirect SCIM bearer-token requests from HTTP to HTTPS.
No additional Docker Compose service, port, SCIM environment variable, CORS rule, or proprietary header is required. Nginx forwards the standard Authorization header by default. If another edge applies browser login or external authentication, exempt /scim so it does not consume that header; do not cache SCIM responses or automatically retry non-idempotent POST or PATCH requests. For new and existing installations, ensure these directives are present in the local bind-mounted configuration.
- Hardened workspace imports to improve data integrity.
- Made degraded workspace exports tolerate inactive collabs.
- Upgraded RocksDB to prevent file descriptor leaks.
- Improved sync speed and performance, especially under heavy workloads.
- Fixed retained Folder tail recovery when the frontier is missing.
- Improved the Folder frontier migration so it converges on stalled backlogs.
- Shared active-identity evidence across sessions during the SLO window.
- Workspace export — Fixed failures for large workspaces, stalled tasks, and workspaces with missing or inconsistent data, while preserving all readable content.
- Database blob diff API — Added opt-in paginated responses with bounded page sizes and resumable continuation cursors for
POST /api/workspace/{workspace_id}/database/{database_id}/blob/diff, while preserving compatibility with existing clients. - Search indexing — Made workspace index repair bounded and progressive so one problematic document cannot stall indexing for the rest of the workspace.
- Client compatibility — Added
APPFLOWY_MIN_CLIENT_VERSIONso operators can configure the minimum supported client version.
- More reliable realtime collaboration — Stronger sync and reconnection handling keeps documents in sync, recovers cleanly after interruptions, and monitors for stalls.
- More durable snapshots and version history — Improved snapshot recovery and gating so saved versions and history stay dependable.
- Stronger permissions — Explicit per-page permissions for workspace members, with revocations now taking effect immediately.
- Better database integrity — More consistent row identity and safer handling of concurrent edits.
- Faster, leaner search and AI — Lower CPU and memory usage in search and AI indexing, with better prioritization and grounding.
- Improved WebSocket reconnection and recovery after interruptions.
- More reliable convergence so everyone sees the same, correct document state.
- Fixed syncing of restored versions.
- Improved handling of missing or out-of-order updates, including quarantine of problematic gaps.
- Added explicit page-level permissions for workspace members.
- Permission revocations now take effect immediately.
- Fixed cases where stale permissions could linger.
- Editors can now resolve comments.
- Isolated notifications per user so people only see what is meant for them.
- Improved snapshot recovery and worker reliability.
- Version history now relies on durable snapshots.
- More consistent database row identity for reliable parent/child relationships.
- Safer database migrations.
- Support for concurrent workspace updates.
- Improved row-permission performance.
- Reduced memory usage when comparing large database entries.
- Lower CPU usage and better backpressure handling in search.
- Smarter query prioritization.
- Provider-aware AI indexing with support for dynamic embedding dimensions.
- Improved mention notifications.
- Isolated the recent-pages cache to prevent cross-contamination.
- This release includes database identity migrations.
- Deploy AppFlowy Cloud and AppFlowy Worker together.
- Deploy AppFlowy Cloud before AppFlowy AI and Admin Frontend.
- Changing embedding models or dimensions requires re-embedding existing content.
- Signup whitelist — Admins can control who is allowed to register by managing domain and email allowlists from the admin dashboard. Signup whitelisting can be toggled on or off at any time without redeployment.
- System-wide AI toggle — A single admin setting now disables all AI functionality across the platform. When turned off, all AI features become unavailable instantly across every service.
- Guest-invite admin approval — Workspace owners can now queue guest invitations that require admin approval before the invite email is sent. Admins receive email notifications for new pending requests and can review, approve, or reject invites from the admin dashboard. Clients can distinguish between invites waiting on admin approval and those waiting on the invitee to accept.
Admins can restrict new user registrations by enabling the signup whitelist in the admin dashboard. When enabled, only users whose email matches the configured allowlist (by domain or individual address) can sign up.
By default, the signup whitelist is disabled, so anyone can register.
To enable it:
- Set the environment variable
GOTRUE_DISABLE_SIGNUP=false. The signup whitelist only takes effect when signups are enabled at the GoTrue level — ifGOTRUE_DISABLE_SIGNUP=true, all signups are blocked regardless of the whitelist. - In the admin dashboard, toggle on Enable Signup Whitelist.
- Add allowed email domains (e.g.,
@yourcompany.com) or specific email addresses.
From the admin frontend, navigate to Users → Guest Invite to view pending guest invitations. You can approve or reject each request; approved invites trigger the invitation email automatically.
To require admin approval for all guest invites, toggle on Require admin approval for guest invites. This setting is off by default.
Example — admin approval disabled:
A workspace owner invites user_a@appflowy.io. The guest receives the invitation email immediately and can accept it without admin intervention.
Example — admin approval enabled:
A workspace owner invites user_b@appflowy.io. The invitation is marked Pending Admin Approval. Once an admin approves it, the guest receives the invitation email and can accept it to access the workspace.
This release requires upgrading the following services to 0.15.0:
appflowy-cloudgotrueadmin-frontend
- Added server-side database row duplication, including row document cloning
- Improved published database pages so sibling database views are surfaced more consistently in published outlines and page metadata
- Fixed unpublished collabs to return
RecordNotFoundinstead of stale publish metadata - Fixed PDF export title and spacing issues
- Fixed relation rendering in PDF export to use relation titles instead of raw UUIDs
- Fixed hidden database fields appearing in PDF exports
- Fixed duplicate-row metadata so failed row-document duplication does not leave dangling document references
Platform Compatibility
- Replaced
aws-lc-rswithringto preventSIGILLcrashes on ARM64 Raspberry Pi deployments
- Fix Notion import issues: handle inaccessible databases/documents, restore missing database row pages, and abort import gracefully when the zip file is corrupted
- Fix miscellaneous application logic bugs
- Optimize Redis connection handling for different usage scenarios
- Optimize Redis connection
- Fix missing access to pages after importing a Notion zip file
AppFlowy Search
- Support cancellable search requests
- Pipeline search requests with automatic cancellation of in-flight previous requests
AppFlowy Worker
- Fix Notion import bug: corrected embedded database view links and mention database links
- Fix additional Notion import bugs
AppFlowy Search
A new dedicated search service (appflowy_search) is now available, enabling both keyword and semantic (vector) search across your documents. It runs as a standalone service on port 4002.
Setup:
- Pull the latest
docker-compose.ymlfrom this repository, as it has been updated to include this service APPFLOWY_SEARCH_SERVICE_URLdefaults tohttp://appflowy_search:4002and works out of the box. You only need to set it if you have a custom deployment configuration
AppFlowy AI
AI chat now leverages the search service for context retrieval, delivering more relevant and accurate responses by drawing from your workspace content.
Admin Frontend
A new AI tab has been added to the admin panel, allowing you to configure AI models and switch providers on the fly — no redeployment required.
If you are using a custom Nginx configuration, you need to add the following location block:
location /ai/ {
proxy_pass $appflowy_cloud_backend;
proxy_set_header X-Request-Id $request_id;
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}Note: If you are using this repository's default
docker/nginx/nginx.conf, this change is already included — no action needed.
- Added AI Meeting feature for intelligent meeting assistance
- Requires: Set the
ASSEMBLYAI_API_KEYenvironment variable. Get your API key here
- Requires: Set the
- Enhanced Web API with improved database creation capabilities
- Improved performance by caching user and member profiles in Redis
- Optimized the Publish Page for faster loading and smoother performance
- Made file and image URLs private across the app, with access allowed only on the Publish Page
- Fixed an issue in the join-by-invite-code flow where an already-seated Member/Owner was incorrectly counted again. The system now properly avoids consuming an extra seat
- Deprecated the ws v1 API endpoint in preparation for future cleanup and migration