Umami Analytics Deployment

Docker Compose deployment for a self-hosted Umami instance at observe.bobparsons.dev.

Runtime Shape

• ghcr.io/umami-software/umami:postgresql-v2.19.0 serves the app on port 3000.
• Traefik terminates TLS and routes observe.bobparsons.dev over the external traefik network (no host port is published).
• Umami connects to the existing shared Postgres instance (postgres-server) over the external postgres-network — this repo does not run its own database.
• Telemetry is disabled (DISABLE_TELEMETRY=1).
• The deploy workflow exports secrets from Infisical to .env via the infisical/infisical Docker image (docker run --rm infisical/infisical:latest infisical export ...), so no Infisical CLI needs to be installed on the deploy host; Docker Compose substitutes DATABASE_URL and APP_SECRET into the container environment.

Required Forgejo Variables

• INFISICAL_PROJECT_ID
• INFISICAL_API_URL optional, defaults to https://infisical.bobparsons.dev

Required Forgejo Secrets

• INFISICAL_CLIENT_ID
• INFISICAL_CLIENT_SECRET

Required Infisical Keys (prod environment)

• DATABASE_URL — postgresql://umami:<password>@postgres-server:5432/umami
• APP_SECRET — generate with openssl rand -hex 32

Database Provisioning (one-time, manual)

Before the first deploy, connect to the shared Postgres instance and create the database and role:

docker exec -it postgres18 psql -U postgres

CREATE DATABASE umami;
CREATE USER umami WITH ENCRYPTED PASSWORD 'replace-with-a-strong-password';
GRANT ALL PRIVILEGES ON DATABASE umami TO umami;
ALTER DATABASE umami OWNER TO umami;

Making umami the database owner is the simplest fix for PostgreSQL 15+, where the public schema is owned by pg_database_owner and CREATE on public is no longer granted to PUBLIC by default: owning the database implies ownership of the public schema created inside it, which resolves the permission gap and lets Umami's migrations run without further grants.

Use the same password when setting the DATABASE_URL Infisical secret above. Umami runs its own schema migrations automatically on container startup — no separate migration step is needed.

Host Prerequisites

• DNS for observe.bobparsons.dev points to the Traefik host.
• Docker and Docker Compose plugin are installed on the Forgejo deploy runner host.
• The Forgejo deploy runner has Docker socket access.
• The external traefik and postgres-network Docker networks exist or can be created by the runner.

Deploy

Push to main or run the Deploy Umami workflow manually.

First Login

After the first deploy, open https://observe.bobparsons.dev and log in with the Umami default credentials (admin / umami). Change the admin password immediately from Settings → Profile.