Blog · Deploy guides

How to self-host Sure, the Maybe Finance fork, in 2026: its Compose file and one command

By the Pethost team · 13 October 2026 · 8 min read

You want Sure, the personal finance app that the community forked from Maybe Finance, on a server of your own, with its Postgres and Redis, at an address with HTTPS, and without setting up a proxy or certificates. Sure ships a Docker Compose file, and on Pethost a Compose file is a project. Put your own secrets beside it, as Sure asks, and run pethost deploy. The web app, its worker, Postgres and Redis started in 1 minute 22 seconds, at an address the deploy gave by itself.

What you need to self-host Sure in 2026

Three things: Sure's Compose file, the pethost command and a Pethost account.

The file is in Sure's repository, and its Docker guide has the command. Put it into a folder of its own, whose name becomes the project's name:

mkdir sure && cd sure
curl -fsSL -o compose.yml https://raw.githubusercontent.com/we-promise/sure/main/compose.example.yml

The command is one program, installed by one line. Every command it has is in the CLI's reference.

curl -fsSL https://pethost.dev/install.sh | sh      # macOS, Linux
irm https://pethost.dev/install.ps1 | iex           # Windows, in PowerShell

The account needs a plan. If you are not signed in, pethost deploy opens your browser and signs you in. If you have no plan yet, it shows you where to choose one, and waits.

Set Sure's secrets and tell it about HTTPS

The Compose file runs without any configuration, with a secret key and a database password that everyone can read in the repository. Sure's guide says to set your own when the app is reachable from outside your network, and here it is. Make a file named .env beside compose.yml:

SECRET_KEY_BASE="the result of: openssl rand -hex 64"
POSTGRES_PASSWORD="the result of: openssl rand -hex 16"

The Compose file reads both, for the web app, the worker and the database alike. The first deploy takes the .env to the machine with the project.

The second step is the one Sure's guide names “Using HTTPS”. The app answers in plain HTTP inside its container, and the address people open is HTTPS, so tell Rails that. In compose.yml, change one value:

  RAILS_ASSUME_SSL: "true"

Both are Sure's own steps, the same behind any proxy that does TLS. Nothing else in the file changes, the ports lines included. The three volumes, the health checks and depends_on run as Sure wrote them.

Deploy Sure with pethost deploy

Run pethost deploy in the folder. This is the whole screen:

$ pethost deploy
Name it [sure]:     it will live at https://sure.sam.pethost.app

✓ Packed 2 files, 6 KB   (took .env from this folder)
✓ Uploaded straight to your machine
✓ Started in 1 min 22 s
  · deployed compose.yml as compose.yaml
✓ web listens on 3000 → https://sure.sam.pethost.app
  It answers 302.

https://sure.sam.pethost.app

Wrote .pethost (commit it). Next:   pethost logs -f   ·   pethost open

The file publishes port 3000 of web. Once the service listened, the machine asked that port what it is, got an answer in HTTP, and gave it the project's address. So the port is served over HTTPS at that address and is not opened on the machine beside it. The answer is 302 because a new Sure sends its first visitor to the sign-up page.

Postgres and Redis publish no port, so they have no address and nothing of them is open: only the web app and the worker reach them, by the names db and redis. This is the project after the deploy:

$ pethost
sure · https://sure.sam.pethost.app
db	healthy	since 2026-10-13T15:30:49Z	listens on 5432	memory 63 MB
redis	healthy	since 2026-10-13T15:30:49Z	listens on 6379	memory 22 MB
web	running	since 2026-10-13T15:30:55Z	listens on 3000	memory 447 MB
worker	running	since 2026-10-13T15:30:55Z		memory 400 MB
4 services run · last deploy succeeded 2026-10-13T15:31:03Z

The file has a fifth service, backup, under a profile of the same name. A service with a profile starts only when COMPOSE_PROFILES in .env names it, on Pethost as with Docker Compose anywhere, so it did not start, and its script need not be in the folder.

Create your Sure account

Open the address. A new Sure has no account, and its first page says so: “To get started, you must sign up for a new account.” Enter your email and a password of 8 characters or more, with upper and lower case, a number and a special character. We did, and landed on Sure's onboarding.

Until you say otherwise, anyone who finds the address can sign up too. Sure's guide has the step: once your account exists, open Settings > Self-Hosting > Onboarding and choose Closed, or Invite-only if your household will join.

To use a name of your own, such as money.example.com, run pethost domain add money.example.com web:3000. It prints the one DNS record to make, a CNAME to your machine's name, and the certificate comes by itself once the name resolves.

Where the Sure data is, and how it is backed up

Sure keeps accounts, transactions and balances in Postgres, and the files you import, such as statements, under /rails/storage. The Compose file gives each a volume, and Redis a third. The machine keeps the volumes through restarts and deploys, and the nightly backup includes them:

$ pethost volume
sure (.pethost)
app-storage	0 B	web:/rails/storage, worker:/rails/storage	backed up 2026-10-13T15:35:29Z
postgres-data	55 MB	db:/var/lib/postgresql/data	backed up 2026-10-13T15:35:29Z
redis-data	0 B	redis:/data	backed up 2026-10-13T15:35:29Z

We restarted the project with pethost restart and signed in again with the same account. pethost backup lists the snapshots, and pethost backup restore puts one back. So the file's own backup service, which sends database dumps to a storage you rent, is not needed here: leave its profile off.

Update Sure to a new version

The file's tag is stable, Sure's latest release. To choose the moment of an update yourself, name a release in compose.yml, for the web app and the worker alike, and deploy again. We went from 0.7.5-hotfix.1 to 0.7.5-hotfix.2 this way:

    image: ghcr.io/we-promise/sure:0.7.5-hotfix.2

$ pethost deploy
sure (.pethost)
✓ Packed 3 files · uploaded · started in 41 s
  · kept the project's .env in place of the version's own: after the first deploy the project's is kept
  · deployed compose.yml as compose.yaml
  · kept the project's x-pethost
  It answers 302.
https://sure.sam.pethost.app
To send this folder's .env:  pethost env push

The address stayed, the data stayed, and the account signed in as before. The secrets stayed too: after the first deploy the project keeps its .env, and a later change to it goes up with pethost env push. If you keep the tag stable, pethost restart --pull gives the services new containers on the newest image of it. Read Sure's release notes first, and take a snapshot with pethost backup now before a large update: a rollback puts the earlier Compose file back, and a volume's data is not part of a version.

What you get for the price

Pethost is €9.99 a month for everything you host, on 2 vCPU, 3 GB of memory and 30 GB of disk. Sure's four services took about 930 MB of that memory, so the same machine has room for your other projects, such as an Umami or a Ryot beside it. There is no fee per project, and the database is part of the same price. Nothing is metered by account or by transaction.

• €9.99 a month for the whole machine
• 1 min 22 s to pull and start Sure's four services
• 930 MB of memory for all of them

What is already done on it: HTTPS with certificates that renew themselves, nightly backups kept for 14 days, SSH into any container, and a Compose project that runs from its own file. The machine is in the EU and always on, so your books open at once and never wait for a cold start. The plans are on the pricing part of the first page.

The screens are deploys of the Compose file in Sure's repository, with Sure 0.7.5-hotfix.2, Postgres 16.15 and pethost 0.2.4, on a test machine of ours. The account in them is the example one, sam.

1. Sure: self hosting with Docker
2. Sure: compose.example.yml
3. Sure: self-hosting
4. pethost, the command line of Pethost