# Your servers. Half an hour. Every feature.

> Run OpenOKR on your own server with Docker Compose, or on Kubernetes with Helm. PostgreSQL is the only dependency. AGPL-3.0, every feature, no seat limit, no licence key, air-gap capable.

This is the Markdown version of https://okrgoal.com/open-source

*Open source · AGPL-3.0*

OpenOKR is open source and complete. Run it on one server with Docker Compose, or on your own Kubernetes with Helm. PostgreSQL is the only thing it needs. Nothing is held back for a paid edition, and nothing limits how many people use it.

[Install it](https://okrgoal.com/open-source#install) · [Star on GitHub](https://github.com/open-okr/open-okr)

### Every feature

The self-hosted edition and the cloud are the same release. Single sign-on, the audit log, both agents: all of it.

### No seat limit

A thousand people cost the same as ten: nothing.

### No licence key

Nothing to activate, renew or check in with us.

### No phone-home

No version check leaves your network. Telemetry is off unless you turn it on.

*Install in four steps*

## From nothing to signed in.

1. **Get the deployment files.**

   ```
   git clone https://github.com/open-okr/open-okr.git
   cd open-okr/deploy/docker
   ```
2. **Start it.**

   ```
   ./openokr up
   ```

   On a real server, give it a domain and it gets its own certificate:

   ```
   OPENOKR_DOMAIN=okr.example.com ./openokr up
   ```

   On the first run it generates every secret it needs, pulls the signed image, starts PostgreSQL, runs the migrations, starts the application and the proxy, and waits until it answers its own health check.
3. **Finish in the browser.**

   Open the address it prints. The setup wizard asks for one thing: the account that owns the instance. Registration closes the moment that account exists, and everybody after you joins by invitation. You are signed in, you have a workspace, and both agents are already members of it.
4. **Back up `secrets/`.**

   It holds the root encryption key. Lose it, and stored credentials such as mail passwords and AI keys become unreadable. That is the worst way to find out.

[Read the full install guide](https://github.com/open-okr/open-okr/tree/main/docs)

## What you need

| Requirement | Why |
|---|---|
| Docker and Docker Compose | The whole instance runs as containers |
| 2 CPU cores, 4 GB memory, 20 GB disk | Comfortable for a few hundred people. The database is what grows |
| Ports 80 and 443 | The bundled proxy answers on them. Both can be changed |
| A DNS name, for HTTPS | Certificates are issued automatically for a real name |

No mail server, no AI provider and no identity provider are required. Each is optional, and the product is whole without them.

## Three ways to run it

### One server

**For most organisations.** Docker Compose, a bundled proxy with automatic certificates, and a lifecycle helper for upgrades and backups.

```
./openokr up
```

### Kubernetes

**For universities, government and large enterprises.** A Helm chart with your PostgreSQL, your ingress and your backups. Migrations run as a hook before the application rolls.

```
helm install openokr oci://ghcr.io/open-okr/charts/openokr
```

### From a checkout

**For contributors and evaluators.** Node 22 and pnpm. Read the code while it runs.

```
pnpm dev
```

*Day two*

## Run it without a platform team.

The lifecycle helper that installed it also runs it.

| Command | What it does |
|---|---|
| `./openokr status` | What is running, and whether it is healthy |
| `./openokr upgrade` | Back up, pull the new release, restart, migrate, report |
| `./openokr backup` | An encrypted database dump and a copy of the files, with a checksum |
| `./openokr verify-backup` | Prove a backup would restore, without touching the live database |
| `./openokr restore` | Restore from a backup |
| `./openokr rotate-key` | Re-wrap every stored secret under a new root key |
| `./openokr logs` | Follow the application log |

*Upgrades you control*

## Nothing updates itself.

You choose when to upgrade. Releases follow semantic versioning: a major release names any action you must take, a minor one needs nothing from you, a patch is a fix. Any release upgrades straight to any later release in the same major, with no stops in between. The helper takes a backup first and stops if the backup fails, because rolling back means restoring that backup. Skipping it takes a deliberate setting, for a database backed up elsewhere.

*Offline, if you need it*

## Runs with no route to the internet.

- **AI:** a local model through Ollama or your own inference server, or no AI at all
- **Assets:** fonts and scripts served from the instance, never from a CDN
- **Telemetry:** none, unless you opt in
- **Chat:** optional. Email and the browser cover everything
- **Checked:** an air-gap checklist runs against the source on every change, so every outbound request has to go through one guarded path

[Read the air-gap guide](https://github.com/open-okr/open-okr/tree/main/docs)

*Verify what you run*

## Signed, with a bill of materials.

Every release publishes a multi-architecture image to `ghcr.io/open-okr/open-okr`, signed with cosign and shipped with a software bill of materials, and the Helm chart to `oci://ghcr.io/open-okr/charts/openokr`. Verify the signature before you run it. Pin the version you tested.

*The licence, in plain English*

## AGPL-3.0, and what it means for you.

| If you | Then |
|---|---|
| Run OpenOKR for your own organisation's staff | Unchanged, you have no obligations. Changed, offer the people who use your version its source, your own staff included |
| Change it and offer it to other people over a network | You must offer them your changed source, under the same licence |
| Want to sell a closed hosted version | You cannot. That is what the licence is for |

Contributions come under a lightweight contributor licence agreement, signed with one click. The full reasoning is in PLAN.md §4.

*Help when you want it*

## The community, or us.

### Community

GitHub issues, the documentation, and the runbooks for upgrades, incidents and the air gap. Free.

[Open GitHub](https://github.com/open-okr/open-okr)

### Support from OKR Institute

For organisations that want a named contact, response times in a contract, help with the rollout and help passing the security review. Same open source product.

[Talk to us](https://okrgoal.com/contact)

## Questions

### Is the self-hosted edition really complete?

Yes. It is the same release the cloud runs. There is no enterprise edition, no licence key and no feature flag that a payment turns on.

### What does it cost to run?

The server. A small machine with 2 CPU cores and 4 GB of memory is comfortable for a few hundred people. If you connect an AI provider, you pay that provider for what you use, and you can cap it.

### Can we start self-hosted and move to the cloud later, or the other way round?

Yes. Export the workspace to an encrypted archive, sealed with a passphrase you choose, and import it into the other, after a dry run. It works in both directions.

### Do we need Kubernetes?

No. One server with Docker Compose is the main path. The Helm chart is there for organisations that already run Kubernetes.

### How do we get security fixes?

Watch the repository's releases. A patch release carries fixes only and upgrades with one command.

### Can we use it commercially?

Yes. Running it for your own business is exactly what it is for.

## Up and running before lunch.

[Install it](https://okrgoal.com/open-source#install) · [Try the live demo first](https://demo.okrgoal.com/)

Or hand this to your coding agent:

```
Install OpenOKR on this machine with Docker Compose.
1. Check that Docker and Docker Compose are installed. If not, tell me how to install them for this system and stop.
2. Run: git clone https://github.com/open-okr/open-okr.git && cd open-okr/deploy/docker && ./openokr up
3. Wait until it prints the address, then tell me to open it and create the owner account in the setup wizard.
4. Remind me to back up deploy/docker/secrets/, because it holds the root encryption key.
```

---

OKRGoal, from OKR Institute. A map of this site for AI agents: https://okrgoal.com/llms.txt