Self-Hosted Start Page Dashboard

Productivity

A self-hosted start page: your everyday websites and the services you host yourself arranged as icon links in sections, with settings you can edit right on the page. You bring it up on your own machine with Docker Compose, the login account and password are generated at random by a script, and the server checks the login as well. Derived from a frozen snapshot of open-source start page software under the MIT licence; the delivery adds an orchestration file that builds the image from source, a script that creates the settings file on the first start, a script that generates the password, and a quick-start guide in Traditional Chinese.

Subscribe & download See how to start

SubscriptionUS$49 per month

Last run2026-11-02

In practice

Readiness4 / 5

What you need

Few changes needed4 / 5

Who it is for

Individuals and small teams who run several self-hosted services at home or at work and want their addresses on one page.

How to start

$ sh scripts/quickstart/init-env.sh
$ docker compose up -d --build

Browse the files

Files in the product repository at the pinned commit. A few house files are left out of the zip.

File overview604 paths

▸docs65

alternate-views.md
api.md
assets/
authentication.md
authentication/
backup-restore.md
configuring.md
contributing.md
credits.md
deployment.md
…

▸public33

.nojekyll
favicon.ico
fonts/
index.html
initialization.html
item-icons/
loading-screen.css
manifest.json
robots.txt
theme-fonts.css
…

▸scripts3

quickstart/

▸services25

app.js
endpoints/
healthcheck.js
serverless-functions/
utils/

▸src384

App.vue
assets/
components/
directives/
main.js
mixins/
plugins/
router.js
store.js
styles/
…

▸tests43

components/
docker-smoke-test.sh
fixtures/
locales/
server/
setup.js
unit/

▸user-data1

conf.yml

▫ATTRIBUTION.md

▫CNAME

▫Dockerfile

▫LICENSE

▫LICENSE-99LL.md

▫PRODUCT.md

▫QUICKSTART.md

▫README.md

▫SECURITY.md

▫delivery-manifest.txt

▫docker-compose.yml

▫eslint.config.mjs

▫index.html

▫netlify.toml

▫package.json

▫render.yaml

▫server.js

▫tsconfig.json

▫vite.config.mjs

▫vitest.config.mjs

▫yarn.lock

▫Config and hidden files 29

Latest passing run

Clone → Checkout → Toolchain → Build images → Start page and server side login

Pre-purchase Disclosure

What you are buying

A self-hosted personal start page: your everyday websites and the services you host yourself arranged as icon links in sections, with settings you can edit right on the page. After running the password generation script you bring it up with Docker Compose, and the server checks the login as well.

Derived from open-source start page software under the MIT licence, and not the original project itself. Our work: an orchestration file that builds the image from source, a script that creates the settings file on the first start, a script that generates the password, and a quick-start guide in Traditional Chinese.

Delivery is a frozen snapshot: one zip, taken from the product repository at revision d9eebca.

Known limitations

The service serves plain HTTP on port 4000 of the local machine; TLS and a reverse proxy are yours to bring
The built-in login has no limit on login attempts and no two-step verification
The password is stored in the settings file as a SHA-256 hash, which is not a hash made for storing passwords
The home page itself loads without signing in, and the links and settings can only be read after signing in
The account and password are written into the settings file at the first start only, and changing .env afterwards does not change the login
Some themes load background images from outside websites
At every start it reads the latest upstream version number from GitHub once, and the result is only written to the container log
Widgets and outside icons you add to the page may send requests to their own services
The settings live in a Docker named volume, and docker compose down -v deletes all settings and edits
The first start builds the image from source, fetching from the registry, npm and apk during that time
Pinned to the delivered snapshot; it does not follow upstream.

The liability cap, the scope of what is promised and the statutory floor are governed by the Terms of Service.

Vetting record

Everything below was checked against the pinned commit 93a33d9. Every verdict carries its full reasoning, an evidence link and the checker; failures are published, not hidden — do not take our word for it, verify it yourself.

5 PASS0 WARN0 FAIL

Source ReviewPASS

Execution surface of the delivery reviewed item by item. Our own additions were read line by line: docker-compose.yml (the published port is bound to 127.0.0.1 only; it refuses to start when the login account or password hash is missing; server-side sign-in is on and the relaying feature is off), scripts/quickstart/entrypoint.sh (it creates the settings file on the first start only; the account may use only letters, digits, underscore and hyphen and the hash must be 64 hexadecimal characters, otherwise it refuses to start), conf.template.yml, and scripts/quickstart/init-env.sh (openssl generates the random password and its hash, .env is mode 600, an existing .env is left alone). The upstream front-end and server sources were not read file by file; the basis is the MIT licence and container isolation.

Script SafetyPASS

The scripts on the buyer’s delivery path were each inspected: init-env.sh and the entry script are ours (read line by line); the build goes through the Dockerfile (read line by line: a multi-stage build with yarn install from the lock file, system packages from apk, with no download piped straight into a shell). At start-up the entry script runs first and then the upstream server.

RecencyPASS

This product is a frozen snapshot and does not follow upstream: the upstream source is pinned to the main-line revision taken on the day the product repository was created (see the evidence link), and the product repository is that snapshot plus our own commits.

LicensePASS

SPDX:LicenseRef-99LL-Product

Upstream LICENSE was checked word for word (the evidence link points at the file itself at the pinned version and matches the copy inside the product repository): the standard MIT text, copyright holder Alicia Sykes. It allows commercial use, modification, derivative works, redistribution and sale; the duty is to keep the copyright notice and licence text (LICENSE and ATTRIBUTION.md ship in the zip); upstream has no NOTICE file. The decision does not rest on GitHub’s licence field. For the product as a whole the 99LL product licence template is attached: upstream’s LICENSE is kept as it is and LICENSE-99LL.md is added as the sale and liability terms for the part we built, with spdx recorded as LicenseRef-99LL-Product.

Dependency LicensesPASS

This records the declared side, not a scan result: the front-end and server dependencies are declared in package.json and locked by yarn.lock, the packages themselves are fetched from their own repositories when the buyer builds, and the base image and system packages come from a registry and apk. These dependency trees were not scanned package by package for licences. Upstream has no submodule and no third-party dataset was copied in (see ATTRIBUTION.md).