Tagaris on Unraid
One self-contained container from Community Applications, with the database inside it, two appdata folders to back up, and a setup wizard on the first visit.
What the template sets up
Add the Tagaris template from Community Applications. It installs the self-contained image and asks for two values.
One container
The template runs goodhallsolutions/tagaris-bundled, which has
PostgreSQL built in, so there is no separate database container to add. It uses
the bridge network and serves the web interface on port 3000.
Two required values
An auth secret, which signs sessions and encrypts stored secrets, and the public URL, which is the address people actually reach Tagaris on. Both are on the form and both are explained below.
Two appdata folders
Data at /mnt/user/appdata/tagaris/data holds the database and the
asset photos. Uploads and backups at
/mnt/user/appdata/tagaris/uploads holds other uploads and the
built-in backups folder.
The template itself is a short XML file. It is published for reference at unraid/tagaris.xml. If you would rather run the standard two-container stack, or point the app at a PostgreSQL server you already run, those are covered in the standard and dedicated-database guides.
The settings that matter
Everything else on the form has a working default.
Auth secret (BETTER_AUTH_SECRET)
A strong random value. Generate one with openssl rand -base64 32
and paste it in. It signs session cookies and encrypts the secrets Tagaris stores,
so keep a copy somewhere safe. Change it and everyone is signed out.
Public URL (BETTER_AUTH_URL)
The address people reach the app on, including the port, for example
http://192.168.1.20:3000. Printed QR labels, invite links and sign-in
all depend on it. If you put Tagaris behind a reverse proxy later, change it to the
https:// address.
Timezone (TZ)
Under the advanced settings, defaulting to Europe/London. It sets when
the scheduled jobs run: the daily renewals digest, backups and device syncs.
If you run a separate database instead
The self-contained image has no database password to set. If you choose the
two-container stack, use letters and digits only in the PostgreSQL password: it is
spliced into the connection URL, and characters such as : or
@ break it.
First run
Start the container
On the first start the container sets up its database, applies migrations and then listens on port 3000. Allow a minute or two for the image pull.
Open the setup wizard
Visit http://your-unraid-ip:3000. The first visit creates your
organisation and the first administrator account. That account owns the install and
is the break-glass login, so give it a strong password.
Add HTTPS when it leaves the LAN
Plain HTTP is fine for a first look on a private network. For anything reached from outside, put Tagaris behind a reverse proxy that terminates TLS and update the public URL to match.
Where the data lives and what to back up
The container is disposable. Everything that must survive a rebuild is in the two appdata folders: the data folder holds the PostgreSQL database, asset photos, thumbnails and attachments, and the uploads folder holds other uploaded files and the backups folder. Back up both. Updating or rebuilding the container never touches them.
Tagaris also backs itself up from Application settings: a database dump plus, optionally, the photos and attachments, in one archive, on a daily or weekly schedule with a retention count. Set a passphrase and new backups are encrypted. Each backup can also be copied to S3-compatible storage, which is the copy that survives a failed array. Restore is built in, behind a typed confirmation. Details are in Backups and restore.
Upgrading
An upgrade is a newer image and the same folders and variables. Pull the new image, recreate the container, and the app applies any pending migrations itself on start. Take a backup first; it makes a rollback trivial.
The template uses the latest tag, which will cross a major version on its
own. For anything beyond a trial, change the repository to
goodhallsolutions/tagaris-bundled:2 so pulls stay within version 2.
One thing to know about the self-contained image: its database is PostgreSQL 16, and the container refuses to start against data written by a different major version. When a future image moves to a newer PostgreSQL, the path is a full backup in Application settings, the new image on an empty data folder, then a restore. The upgrading guide covers tags, steps and rollback.
Questions
Why do QR labels or invite links point at the wrong address?
The public URL is still at its default, or at localhost. Set it to the address in the browser's URL bar when you use Tagaris, then recreate the container. Labels already printed encode the old address and need reprinting.
Everyone was signed out after I edited the container. Why?
The auth secret changed. It signs every session, so a new value invalidates them all. Keep it the same across restarts and edits.
Can I run the two-container version on Unraid instead?
Yes. The standard install is the app plus a postgres:16-alpine
container, run with Docker Compose or two plain docker run commands,
with the database password in letters and digits only. The self-contained image is
simply the one-click option.
Try it before you install it
The live demo runs the current release in your browser. The Unraid install is one template and two values.