A · What you need

B · Installation in four steps

All commands run on the server, after ssh root@your-server-ip. Paste line by line, press Enter, read the output.

Install Docker, if it is not there yet

docker compose version

If a version number appears, continue with step 1. If it says command not found, install Docker with the official script (Ubuntu, Debian):

curl -fsSL https://get.docker.com | sh
docker compose version

Create a folder, fetch the two files

The template is published as env.example (no leading dot, because Apache does not reliably serve dotfiles) and lands directly as .env with this command. The same guide in the browser: posthopeproduction.com/kendoshi/server.html

mkdir -p ~/kendoshi && cd ~/kendoshi
curl -fsSL https://posthopeproduction.com/kendoshi/docker-compose.release.yml -o docker-compose.yml
curl -fsSL https://posthopeproduction.com/kendoshi/env.example -o .env

Fill in .env: two values are required

openssl rand -hex 32
nano .env

The first line prints a long random value. In nano: set DOMAIN to your subdomain, AUTH_SECRET to the random value. Leave KENDOSHI_LICENSE and BOARDIST_SETUP_TOKEN empty. Save with Ctrl+O, Enter, quit with Ctrl+X. The file then looks like this:

DOMAIN=kendoshi.your-domain.com
AUTH_SECRET=3f9a...long random value...c21e
KENDOSHI_LICENSE=
BOARDIST_SETUP_TOKEN=

Start

docker compose up -d
docker compose ps

The first start pulls the image (about 500 MB) and takes one to two minutes. Afterwards docker compose ps shows app as healthy and caddy as running. During this time Caddy fetches the certificate for your domain.

Create the admin account

docker compose logs app | grep Setup-Token

Open https://your-subdomain in the browser. The page asks for the setup token from the log, so that a random first visitor cannot become admin. Enter the token, choose name, email and password. That is your admin account, and the setup route is closed afterwards.

C · Setting up the team

All in the browser, signed in as admin. The order matters: structure first, then licence, then people. If you invite first, you have to grant access to everyone one by one afterwards.

Name the workspace

Settings, Workspace: enter your team's name. It appears at the top of the sidebar and in the calendar subscriptions.

Create folders, projects, groups

• Projects are the boards. One project per undertaking or area, for example Release, Office, Client X.

• Folders bundle projects in the sidebar. Create them only once there are more than five projects.

• Groups are the sections inside a board, for example This week, Later, Waiting. Every project automatically gets a group Done at the bottom.

• Start with three projects and two groups each. Structure grows with the team, not ahead of it.

Install the licence

Settings, section License: paste the line from your purchase email (the whole line, from PHP1. to the last character), click "Add license". The page then shows "Licensed to" name (email). No restart. Alternatively put the line into .env as KENDOSHI_LICENSE and run docker compose up -d; the field in the interface is then read-only.

Invite the team

1. Settings, Team, create an invite link. The link is valid for 14 days and exactly once. One link per person.

2. Send the link. The person registers with it, choosing name, email and password.

3. Then, without fail: open Access for the new member and share the folders and projects. Without sharing, the person only sees their inbox and private projects and thinks the server is empty.

Roles

Automations and AI agents get their own member account with their own API token, never an admin account.

Connect the apps

• Browser: https://your-subdomain, always the complete picture. On the phone use Add to Home Screen, then it behaves like an app.

• Kendoshi for Mac, iPhone, iPad: on first launch choose Connect to team, enter the server address https://your-subdomain and your personal API token. Every person fetches their own token: Settings, API token, create token.

• Calendar: Settings, Calendar sync, copy the personal feed address, add it in Apple Calendar as a subscription or in Google via URL. Tasks with a time remind you 30 minutes before. The address is personal, never pass it on.

• AI: Settings, API token, copy the link. The link goes into Claude under Settings, Connectors, Add custom connector. The AI then reads and writes with exactly that person's rights and can never delete. Since 2.14 the server answers the AI in English, field names included (for example created instead of erstellt, effort instead of aufwand). If you wrote your own scripts against the connector, adjust the field names. Details in the Setup Kit Claude Code and MCP.

Fill the team wiki

Book icon at the bottom of the sidebar. Everyone can read, only admins write. Good for what everybody needs to know: rules, procedures, who to ask. A first page How we use Kendoshi with the three sentences from part D saves many questions later.

D · Working with Kendoshi

The essentials in three sentences, the way they get passed on in a team: Press Q for quick entry. My Day is the start page for the day. The sun brings a task into today.

Quick entry: everything in one line

Deliver mix tomorrow 2pm p1 @alisha #Release /This week

The shortcuts work in English and German (morgen, jeden montag, 14uhr).

The areas

Completed tasks move to the group Done and stay as a log. Deleted items sit in the trash for 30 days and can be restored. Everything else, from recurring tasks to mail drop, is in the Kendoshi user handbook.

E · Operations: backup, update, restore

All data lives in a single file: /data/boardist.db inside the Docker volume boardist-data. Next to it license.txt and the folder backups/. Whoever backs up this one file has everything.

Manual backup

cd ~/kendoshi
docker compose exec app cp /data/boardist.db /data/backups/boardist-manual.db
docker cp "$(docker compose ps -q app)":/data/backups/boardist-manual.db ./kendoshi-backup-$(date +%Y-%m-%d).db

The file kendoshi-backup-date.db belongs somewhere else: another machine, a cloud folder, whatever you back up anyway. In addition the server writes a dated backup to /data/backups/ on every start and keeps the last seven. That is the seat belt, not a replacement for a copy outside the server.

Automatic backup every night

On the server open crontab -e and append this line. It saves every night at three to ~/kendoshi-backup-date.db:

0 3 * * * cd ~/kendoshi && docker compose exec -T app cp /data/boardist.db /data/backups/boardist-cron.db && docker cp "$(docker compose ps -q app)":/data/backups/boardist-cron.db ~/kendoshi-backup-$(date +\%Y\%m\%d).db

Update

cd ~/kendoshi
docker compose pull
docker compose up -d

docker-compose.yml pins the version (image: ...:2.14.0). For a new version change the number there and run the two commands. If you always want the newest, use latest. Before every schema change the container writes a copy /data/boardist.pre-push.db and applies the change itself. After the update reload the browser once.

Restore

From a backup file on the server (adjust the file name):

cd ~/kendoshi
docker compose stop app
docker cp ./kendoshi-backup-2026-09-18.db "$(docker compose ps -q -a app)":/data/boardist.db
docker compose start app

From an automatic backup inside the container, without pulling the file out first (file name from docker compose exec app ls /data/backups):

docker compose stop app
docker compose run --rm --no-deps --entrypoint sh app -c 'cp /data/backups/boardist-2026-09-18_162741.db /data/boardist.db'
docker compose start app

Moving to another server

1. On the old server: take a manual backup (above) and save the .env file.

2. On the new server: do part B up to step 3, using the same .env (same AUTH_SECRET, otherwise everyone is signed out).

3. Restore as above, then point the domain's A record at the new IP.

Passwords and access

• Forgotten password: there is no email reset. An admin sets a new one under Settings, Team, three-dot menu next to the member, Reset password, and hands it over in person. The person then changes it under Account and security.

• Lost device: the person chooses Sign out everywhere under Account and security and revokes their API token.

• Member leaves: an admin removes them via the menu next to the member. Their tasks stay, only the access is gone.

• Admin locked out: a second admin helps. So appoint two admins from the start.

F · Let an AI help: three prompts

If the terminal makes you nervous, let yourself be guided. The prompts work with Claude, ChatGPT or any other AI. Prompt 2 needs Claude Code or an AI that is allowed to run commands on the server.

Prompt 1 · The AI guides you step by step

For any AI in a chat. It runs nothing itself; it tells you what to type and reads your output.

You are helping me install Kendoshi Team on my own server. I am not a
technician. Guide me step by step, one step at a time, and wait for my
answer before naming the next one. Each step: one sentence on what happens,
then the finished command to copy, then what I should see as output.

The facts. Stick to them exactly, do not invent anything:
- Kendoshi Team is a Docker image. It needs a Linux server with Docker
  Compose v2, a subdomain with an A record pointing at the server, and
  ports 80 and 443 open.
- Installation: create the folder ~/kendoshi. Fetch two files:
  curl -fsSL https://posthopeproduction.com/kendoshi/docker-compose.release.yml -o docker-compose.yml
  curl -fsSL https://posthopeproduction.com/kendoshi/env.example -o .env
- Two values in .env are required: DOMAIN (my subdomain) and AUTH_SECRET
  (output of: openssl rand -hex 32). KENDOSHI_LICENSE and
  BOARDIST_SETUP_TOKEN stay empty.
- Start: docker compose up -d. Check: docker compose ps (app healthy).
- The first visit in the browser asks for a setup token. It is in the log:
  docker compose logs app | grep Setup-Token
- Then create the admin account. The licence is added later in the
  interface under Settings, Licence (the line from the purchase email,
  starts with PHP1.). Without a licence one user works.
- Backup is one file: /data/boardist.db in the volume boardist-data.

Ask me first: Do I already have a server with SSH access? Do I have a
subdomain? Is Docker installed (docker compose version)? Then start with
the first open point.

If an output does not match what you expect, stop and explain to me in
plain words what went wrong before we continue. Never give me commands
that delete data without saying first what they delete.

Prompt 2 · Claude Code sets up the server

For Claude Code on your Mac, with SSH access to the server. Have the server IP, the subdomain and a working ssh login ready. The AI works, you give your OK at three points.

TASK: Install Kendoshi Team on my server.

Server:    ssh root@<SERVER-IP>   (login already works)
Subdomain: <kendoshi.my-domain.com>  (A record points at the server)

Rules:
- Work over ssh on the server, step by step, and show me the output after
  each step.
- Three points need my OK before you continue: (1) before you install
  Docker, (2) before you run docker compose up -d, (3) before you delete or
  overwrite anything.
- Generate AUTH_SECRET with openssl rand -hex 32 directly on the server and
  write it into .env. Do not show it to me in the chat.
- Install nothing except Docker. Do not change firewall rules without
  asking. Do not touch other containers.

Steps:
1. Check: operating system, docker compose version, whether ports 80 and
   443 are free (ss -tlnp), whether the subdomain points at the server IP
   (dig +short). Report, then wait.
2. If Docker is missing: curl -fsSL https://get.docker.com | sh (after OK).
3. mkdir -p ~/kendoshi, fetch the two files there:
   https://posthopeproduction.com/kendoshi/docker-compose.release.yml as docker-compose.yml
   https://posthopeproduction.com/kendoshi/env.example as .env
   (curl -fsSL <address> -o <filename>), set DOMAIN and AUTH_SECRET,
   leave KENDOSHI_LICENSE and BOARDIST_SETUP_TOKEN empty.
4. Show me the .env without the value of AUTH_SECRET, wait for my OK, then
   docker compose up -d.
5. Wait until docker compose ps shows app as healthy. Then
   curl -sI https://<subdomain> and name the setup token from
   docker compose logs app | grep Setup-Token.
6. Propose a cron line for the nightly backup (do not install it), write
   the backup and update commands into a file ~/kendoshi/README.txt.
7. Final report: what is running, where the data lives, what I do next in
   the browser (setup token, admin account, licence, invite the team).

Prompt 3 · Something is not working

My Kendoshi Team server has a problem. Help me find the cause before we
change anything. I run the commands and send you the output.

What I see: <describe here, for example: browser shows a certificate
error / page does not load / invitation is rejected / after the update the
container does not start>

Let me run these commands one after the other and interpret each output:
  cd ~/kendoshi && docker compose ps
  docker compose logs --tail=50 app
  docker compose logs --tail=50 caddy
  cat .env | sed 's/AUTH_SECRET=.*/AUTH_SECRET=(set)/'
  dig +short <my subdomain>
  curl -sI https://<my subdomain>

Known causes, check these first:
- AUTH_SECRET missing in .env: the container does not start, the log says so.
- DNS does not point at the server or port 80/443 is closed: Caddy gets no
  certificate, the caddy log shows acme errors.
- "Without a license exactly one user works": not a fault, the licence
  is missing.
- "attempt to write a readonly database": the volume is not owned by UID 1000.
- Everyone signed out: AUTH_SECRET was changed, normal.

Only propose a fix once the outputs support it. Before every command that
changes something, tell me what it does and whether a backup is needed.

G · When something is stuck

H · Security in five sentences

1. The .env is the server's key file. Never pass it on, never into a chat, include it in your backup.

2. Three things are personal and belong to nobody else: password, connector link with API token, calendar feed address. If one leaks: revoke the token, regenerate the feed links.

3. The server is reachable from the internet, so install updates when a new version is out. Two commands, part E.

4. The AI also reads other people's text through the connector (comments, wiki). If an instruction sits there, it may take it for an order. Do not confirm proposals nobody asked for.

5. Backup outside the server, every night, one file. Once a month check that the file is there and has a sensible size.

Changelog