Self-Hosted Quick Notes

Productivity

A quick notes system: write one note in a sentence, laid out on a timeline by date, with the data kept only on your own machine. You bring it up on your own machine with Docker Compose, the admin password is generated at random by a script, a one-off job creates the administrator after the first start and closes public sign-up, and it is private by default, so nobody who is not signed in sees any note. Derived from a frozen snapshot of an open-source notes service under the MIT licence; the delivery adds a Dockerfile that builds both the front end and the back end from source, an orchestration file, scripts that generate the password and create the administrator, and a quick-start guide in Traditional Chinese.

Subscribe & download See how to start

SubscriptionUS$49 per month

Last run2026-11-02

In practice

Readiness4 / 5

What you need

Few changes needed4 / 5

Who it is for

Individuals and small teams who want to jot down what comes to mind in a sentence and keep the data on their own machine.

How to start

$ sh scripts/quickstart/init-env.sh
$ docker compose up -d --build

Browse the files

Files in the product repository at the pinned commit. A few house files are left out of the zip.

File overview1,323 paths

▸cmd4

memos/

▸core20

README.md
access/
memoexport/
memopayload/
notification/
usagelimit/

▸docs10

design/

▸filter13

MAINTENANCE.md
README.md
doc.go
engine.go
engine_test.go
functions_test.go
helpers.go
ir.go
parser.go
render.go
…

▸internal43

README.md
clientip/
email/
httphandler/
identifier/
imagelimit/
linkmeta/
motionphoto/
profile/
random/
…

▸markdown26

ast/
doc.go
extensions/
link_reference.go
markdown.go
markdown_test.go
parser/
renderer/

▸proto64

README.md
api/
buf.gen.yaml
buf.lock
buf.yaml
gen/
openapi_embed.go
store/

▸provider22

README.md
ai/
idp/
storage/

▸scripts12

Dockerfile
build.sh
entrypoint.sh
entrypoint_test.go
entrypoint_test.sh
install.sh
install_test.go
quickstart/
release_smoke_test.sh
release_version.sh
…

▸server181

api/
auth/
cors.go
cors_test.go
doc.go
fileserver/
frontend/
http_compat_test.go
mcp/
server.go
…

▸store192

attachment.go
attachment_delete.go
auth_config.go
cache.go
cache/
common.go
custom_icon.go
db/
demo_seed_test.go
deployment_config.go
…

▸web701

.gitignore
biome.json
components.json
docs/
index.html
package.json
patches/
pnpm-lock.yaml
pnpm-workspace.yaml
public/
…

▫AGENTS.md

▫ATTRIBUTION.md

▫CODEOWNERS

▫CONTEXT.md

▫Dockerfile.quickstart

▫Dockerfile.quickstart.dockerignore

▫LICENSE

▫LICENSE-99LL.md

▫PRODUCT.md

▫QUICKSTART.md

▫README.md

▫SECURITY.md

▫SECURITY.upstream.md

▫compose.yaml

▫delivery-manifest.txt

▫go.mod

▫go.sum

▫Config and hidden files 18

Latest passing run

Clone → Checkout → Toolchain → Build images → Bootstrap admin and notes

Pre-purchase Disclosure

What you are buying

A self-hosted quick notes system: write one note in a sentence, laid out on a timeline by date, with the data kept only on your own machine. After the first start it creates the administrator and closes public sign-up on its own. You bring it up with Docker Compose.

Derived from an open-source notes service under the MIT licence, and not the original project itself. Our work: a Dockerfile that builds the front end and back end from source, an orchestration file, a password generation script and a quick-start guide in Traditional Chinese.

Delivery is a frozen snapshot: one zip, taken from the product repository at revision 16c2f3d.

Known limitations

The service serves plain HTTP on port 5230 of the local machine; TLS and a reverse proxy are yours to bring
The administrator is created only after the first start, and changing .env afterwards does not change the existing account
Public sign-up is off by default, and adding an account has to be done by the administrator in the settings
When you paste a single link, the service connects to that web page to fetch preview information
The map features load map tiles from OpenStreetMap
The data lives in a Docker named volume, and docker compose down -v deletes all of it
Restoring a backup overwrites all current notes
The first start builds the front end and back end from source, fetching from registries and package repositories during that time
Pinned to the delivered snapshot; it does not follow upstream.

The liability cap, the scope of what is promised and the statutory floor are governed by the Terms of Service.

Vetting record

Everything below was checked against the pinned commit 28719a9. Every verdict carries its full reasoning, an evidence link and the checker; failures are published, not hidden — do not take our word for it, verify it yourself.

5 PASS0 WARN0 FAIL

Source ReviewPASS

Execution surface of the delivery reviewed item by item. Our own additions were read line by line: compose.yaml (the service is bound to 127.0.0.1 only; the data is in a named volume; it refuses to start when the administrator credentials are missing), scripts/quickstart/init-env.sh (openssl generates random values, .env is mode 600, an existing .env is not overwritten), scripts/quickstart/bootstrap-admin.sh (it creates the administrator only while there is no user, closes public sign-up after signing in and reads the setting back to confirm; it refuses an account name or password containing a double quote or a backslash) and Dockerfile.quickstart (the front end and back end are both built from source, with base images pinned by digest). The upstream Go and front-end sources were not read file by file; the basis is the MIT licence and container isolation.

Script SafetyPASS

The scripts on the buyer’s delivery path were each inspected: init-env.sh and bootstrap-admin.sh are ours (read line by line); the build goes through Dockerfile.quickstart (read line by line: pnpm at a given version installing from the lock file, go mod download for the back end, system packages from apk, with no download piped straight into a shell; the one-off job image only adds curl to call the service’s own API); the container start goes through upstream’s scripts/entrypoint.sh (upstream’s own file, not read line by line).

RecencyPASS

This product is a frozen snapshot and does not follow upstream: the upstream source is pinned to the main-line revision taken on the day the product repository was created (see the evidence link), and the product repository is that snapshot plus our own commits.

LicensePASS

SPDX:LicenseRef-99LL-Product

Upstream LICENSE was checked word for word (the evidence link points at the file itself at the pinned version and matches the copy inside the product repository): the standard MIT text, copyright holder Memos. It allows commercial use, modification, derivative works, redistribution and sale; the duty is to keep the copyright notice and licence text (LICENSE and ATTRIBUTION.md ship in the zip); upstream has no NOTICE file. The decision does not rest on GitHub’s licence field. For the product as a whole the 99LL product licence template is attached: upstream’s LICENSE is kept as it is and LICENSE-99LL.md is added as the sale and liability terms for the part we built, with spdx recorded as LicenseRef-99LL-Product.

Dependency LicensesPASS

This records the declared side, not a scan result: the Go dependencies are declared in go.mod and locked by go.sum, the front end is declared in web/package.json and locked by the pnpm lock file, and the packages themselves are fetched from their own repositories when the buyer builds; the base images and system packages come from a registry and apk. These dependency trees were not scanned package by package for licences. Upstream has no submodule and no third-party dataset was copied in (see ATTRIBUTION.md).