Guided install

Choose how Keel should live.

Use it on one computer, keep it running at home, or put it on a server. These routes use the same application and can move the same workspace between them.

Current release: 1.2.1Node.js 20+ for server installsSQLite by default

Recommended for Windows

Use the desktop installer.

Download the setup file, run it, and open Keel. Windows SmartScreen may show an unrecognized-publisher warning because this release is not code-signed yet. Confirm the file came from the official GitHub release before continuing.

Download Windows setupSee every step
Data locationYour Windows user profile under Keel's application data folder.
Expected resultA Keel window opens and the local server remains available for scheduled backups.
AlternativeUse the PowerShell installer below to run Keel as an always-on service.

Before you start

Decide whether Keel should be available only on this machine, privately on your own devices, or publicly on the internet. Local and Tailscale installs have fewer moving parts. A public server needs deliberate access control and HTTPS.

GoalBest routeWhat you manage
Try Keel on one computerDesktop packageUpdates and backups
Use it across your own devicesHome server + TailscaleThe server, Tailscale, backups
Use a NAS or container hostDocker ComposeVolume, HTTPS, updates, backups
Reach it from anywhere without TailscaleVPS + reverse proxyDomain, server, HTTPS, access, backups
Account ownership: the first registered account becomes the instance owner. On a shared or public server, set KEEL_OWNER_EMAIL before the first start.

Windows

Desktop setup

  1. Download Keel Setup 1.2.1.exe from the official release.
  2. If SmartScreen appears, check that the file name and GitHub origin are correct, select More info, then Run anyway. Stop if the source is not the official release.
  3. Complete setup and open Keel. The first start can take longer while the local database is created.
  4. Register the owner account, finish the welcome tour, then create and download a test backup from Settings.

Always-on PowerShell service

irm https://raw.githubusercontent.com/AES256Afro/Keel/main/install.ps1 | iex

For a custom location or port, download the script and run .\install.ps1 -Dir C:\Keel -Port 3000 -Owner you@example.com -Service. Open Task Scheduler and confirm the Keel task is running.

Linux desktop

AppImage

chmod +x Keel-1.2.1.AppImage
./Keel-1.2.1.AppImage

If the system reports that FUSE is missing, install the FUSE compatibility package for your distribution or use the Debian package instead.

Debian or Ubuntu

sudo apt install ./keel_1.2.1_amd64.deb

Launch Keel from the application menu. Both packages target x86-64 Linux.

macOS or Linux service

  1. Open Terminal on the machine that will run Keel.
  2. Run the guided installer. Add --service so it starts automatically.
  3. Read the final summary. It prints the install folder, data path, service name, and URL.
  4. Open http://localhost:3000, register the intended owner, and download a test backup.
curl -fsSL https://raw.githubusercontent.com/AES256Afro/Keel/main/install.sh | bash -s -- --service

Useful options: --dir ~/keel, --port 8080, --owner you@example.com, and --yes. Re-running the installer updates the application and leaves the local settings file in place.

Docker Compose

  1. Install Docker Engine or Docker Desktop and confirm docker compose version works.
  2. Clone Keel, copy .env.example to .env, and set the owner email and a backup passphrase.
  3. Run docker compose up -d --build.
  4. Run docker compose ps. Wait for the service to report healthy, then open port 3000.
  5. Create a backup and confirm you can find it outside the container.
Do not scale SQLite horizontally. Keep one Keel application replica with the SQLite volume. If a managed platform has no durable disk, build the PostgreSQL image and attach a managed PostgreSQL database.

Update with git pull --ff-only && docker compose up -d --build. Read the release notes first and keep a recent backup.

Private home server

This is the recommended multi-device route when only your own devices need access.

  1. Install Keel on the server with the shell installer or Docker.
  2. Install Tailscale on the server and your client devices. Sign them into the same tailnet.
  3. On the server, run tailscale serve --bg 3000.
  4. Set KEEL_WEBAUTHN_RP_ID to the server's *.ts.net hostname and KEEL_WEBAUTHN_ORIGIN to the complete HTTPS URL.
  5. Restart Keel and confirm the HTTPS address works from a second tailnet device.

This route does not create public DNS and does not require opening port 3000 on the router.

Public VPS

Use a small Debian or Ubuntu server with Docker, a domain, and a reverse proxy such as Caddy. Point DNS to the server before requesting a certificate.

  1. Set KEEL_OWNER_EMAIL and KEEL_ALLOWED_EMAILS to the intended account. Set KEEL_DISABLE_SIGNUP=1.
  2. Set KEEL_PUBLIC_URL, WebAuthn origin, and relying-party ID to the final HTTPS hostname.
  3. Put Keel behind HTTPS. Set KEEL_TRUST_PROXY=1 only when your reverse proxy overwrites or appends the forwarding headers.
  4. Start the production Compose stack and confirm /api/health reports OK over the public hostname.
  5. Configure an off-machine backup destination and test a restore before trusting the deployment.

Cloudflare can provide DNS, proxying, a Tunnel, and R2 backup storage. Keel itself is a Node server and does not run on Cloudflare Workers today.

Update without losing data

InstallUpdate command
Shell / CLIkeel update or rerun the installer
Windows desktopDownload and run the new setup file
Linux desktopReplace the AppImage or install the new `.deb`
Dockergit pull --ff-only && docker compose up -d --build
Sourcegit pull --ff-only && npm ci && npm run build, then restart

Keel applies its database migrations at startup. Keep a current backup and read release notes before upgrading across versions.

Troubleshooting

The page does not open

Confirm Keel is running, then try http://127.0.0.1:3000. For Docker, inspect docker compose ps and docker compose logs --tail=100. For a service install, use the exact status and log commands printed by the installer.

Another program uses port 3000

Choose another port during install, for example --port 8080, or set the deployment's PORT value. Then open that port in the browser.

Security keys do not register

WebAuthn needs HTTPS or localhost. Confirm the browser URL exactly matches KEEL_WEBAUTHN_ORIGIN and that the relying-party ID is only the hostname.

A public server allows unexpected registration

Stop the service, set KEEL_ALLOWED_EMAILS and KEEL_DISABLE_SIGNUP=1, restart, and review the audit log. Do this before sharing the URL.

You are unsure where data lives

Run keel paths for a CLI install. In Docker, inspect the named volume. Do not guess, and do not delete an install until a backup has been restored successfully elsewhere.

For a reproducible software bug, open an issue. For a vulnerability, use the private security report.