Install Kept

Pick how you run Kept, then follow its steps. Each path has a full guide in this section; the link is at the end of its steps.

In a terminal

• Docker ComposeOne machine
• KubernetesWith Helm
• From sourceYour own image

One click

• Home AssistantAs an app

Docker Compose

What you need

Docker with the Compose plugin, and a terminal. Tested on 1 GB of RAM and one CPU core; Kept and its database use about 200–400 MB of it (what was tested).

1. Download compose.yaml into a folder of its own: Kept and its database in one file, with no copy of the repository and no passwords to make.

   mkdir kept && cd kept
   curl -fsSLO https://raw.githubusercontent.com/keptinventory/kept/v1.14.7/compose.yaml

2. Write .env. init asks for the address you’ll open Kept at, such as http://kept.home.arpa:8080. Use a name rather than an IP address: printed labels carry it.

   docker compose run --rm init

   You should see

   Wrote .env.
   
   KEPT SETUP CODE: XXX-XXX
   
   Next: docker compose up -d, then open http://kept.home.arpa:8080 and enter the setup code.

3. Start it. The database starts, two one-shot services make its logins and apply the migrations, then Kept starts on port 8080.

   docker compose up -d

   You should see

   At the address, Kept’s Enter the setup code page.

4. Set up. Enter the code init showed and create the first account: it becomes the instance admin.

5. Keep the keys. Print the recovery kit and keep it somewhere other than this server, such as a password manager. A backup brings back secret values only with these keys.

   docker compose exec kept kept admin recovery-kit

   You should see

   Text that starts with KEPT RECOVERY KIT.

Windows

In PowerShell, type curl.exe where the steps say curl, and run mkdir kept and cd kept one at a time. Or run every step in WSL.

Every step in full, with Caddy for HTTPS and Ollama for local AI: Install with Docker Compose.

Kubernetes

Not yet tested on a real cluster

The chart renders and validates on every check, and each release publishes it with the image, but it hasn’t been installed on a real cluster yet. Treat a first install as a test.

What you need

A Kubernetes cluster such as k3s, kubectl and helm, and a terminal. The chart asks for 384 MiB of memory for Kept (at most 1 GiB) and 256 MiB for its bundled Postgres (at most 512 MiB).

1. Create the secrets. The chart never writes a secret: the database logins and the bundled Postgres’s superuser get their passwords from secrets you make first.

   kubectl create namespace kept
   pw() { openssl rand -hex 32; }
   # The four database logins (always).
   kubectl -n kept create secret generic kept-db \
     --from-literal=KEPT_DB_OWNER_PASSWORD="$(pw)" --from-literal=KEPT_DB_APP_PASSWORD="$(pw)" \
     --from-literal=KEPT_DB_AUTH_PASSWORD="$(pw)" --from-literal=KEPT_DB_SYSTEM_PASSWORD="$(pw)"
   # The bundled Postgres's superuser (or, for external Postgres with roles.create, the server admin's password).
   kubectl -n kept create secret generic kept-postgres --from-literal=POSTGRES_PASSWORD="$(pw)"

2. Install the chart, with publicUrl set to the address people will open. Don’t add --wait to this first install: the migrations run after it.

   helm install kept oci://ghcr.io/keptinventory/charts/kept --version 1.14.7 -n kept \
     --set publicUrl=https://kept.example.org \
     --set roles.existingSecret=kept-db --set postgres.superuserSecret=kept-postgres

   You should see

   The first line of the notes Helm prints:

   Kept 1.14.7 is installed as "kept" in namespace "kept".

3. Find the setup code. Kept prints it once, on its first start.

   kubectl -n kept logs deploy/kept | grep 'KEPT SETUP CODE'

   You should see

   KEPT SETUP CODE: XXX-XXX

   Open the address, enter the code and create the first account: it becomes the instance admin.

4. Keep the keys. Save the recovery kit and keep it off the cluster.

   kubectl -n kept exec deploy/kept -- kept admin recovery-kit > kept-recovery-kit.txt

   You should see

   kept-recovery-kit.txt, starting with KEPT RECOVERY KIT.

5. Check it. helm test asks the running Kept for /readyz and /version.

   helm test kept -n kept

On Windows, run these in WSL. The values, the optional secrets and what the chart runs: Install on Kubernetes with Helm.

From source

What you need

Git, Docker with the Compose plugin, and a terminal. Kept runs as with Docker Compose, on your own image.

1. Get the code.

   git clone https://github.com/keptinventory/kept.git && cd kept

2. Build the image, tagged kept:local.

   docker build -t kept:local .

3. Write .env. Point compose.yaml at your image, then run init. It finds the .env, asks whether to update it (answer Y), then asks for the address you’ll open Kept at.

   echo KEPT_IMAGE=kept:local >> .env
   docker compose run --rm init

   You should see

   Updated .env.
   
   KEPT SETUP CODE: XXX-XXX

4. Start it, and open the address.

   docker compose up -d

   You should see

   Kept’s Enter the setup code page. Enter the code init showed and create the first account: it becomes the instance admin.

5. Keep the keys. Print the recovery kit and keep it somewhere other than this server.

   docker compose exec kept kept admin recovery-kit

   You should see

   Text that starts with KEPT RECOVERY KIT.

On Windows, run these in WSL. The same compose.yaml as a release, explained in full: Install with Docker Compose.

Home Assistant

What you need

Home Assistant OS with Supervisor 2026.10.4 or later: apps need the Supervisor, so not Home Assistant Container or Core. An aarch64 or amd64 machine, such as a Raspberry Pi 4 or 5 on 64-bit or a mini PC. 4 GB of memory; 2 GB works with few other apps. No terminal.

1. Add Kept’s repository. The button opens your Home Assistant with it filled in. Or go to Settings → Apps → Install app → ⋮ → Repositories and add https://github.com/keptinventory/kept.

   Add Kept to Home Assistant

2. Install, then Start. Find Kept in the app store, then Install, then Start.

   You should see

   On the app’s Log tab, Kept’s own address and the setup code:

   Kept is at http://homeassistant.local:8080 (change it in Configuration: "Kept's address")

   KEPT SETUP CODE: XXX-XXX

3. Open Web UI. Kept opens inside Home Assistant, and in the sidebar too.

   You should see

   For a Home Assistant administrator, Create the first account, with no code. Anyone else sees Enter the setup code and types the code from the Log tab.

Kept’s address, https and the backups: Install as a Home Assistant app.

Something not working?

• The container keeps restarting. Read its log: docker compose logs kept. Kept checks its settings before it starts and stops with one line naming the first problem, such as kept: invalid environment: KEPT_PUBLIC_URL (run docker compose run --rm init). If docker compose up -d stops at bootstrap, docker compose logs bootstrap says why. On less than 1 GB of memory, a backup can run out of it and Docker restarts Kept (what it needs). More
• The port is in use. Kept takes port 8080 on the host. Run docker compose run --rm init again with an http:// address on a free port: it writes the address and the port (KEPT_HTTP_PORT) to .env. Then docker compose up -d. In the Home Assistant app, change the port under Configuration → Network and set Kept’s address to match. More
• Permission denied. Kept runs as user 10001 with a read-only filesystem, so a folder you mount into it, such as a backup directory, must be owned by uid 10001. init writes .env into the folder you run it from: run it in a folder you own. More
• Other devices can’t open it. localhost opens on this machine only. Use a name the other devices can find, set in your router’s DNS or each device’s hosts file, and run init again with it. If Kept says “This Kept is set up for address. Open it there.”, open it at exactly that address, or list the other one in KEPT_EXTRA_ADDRESSES (more than one address). More
• A 502 from the reverse proxy. Kept speaks plain HTTP on port 8080: point the proxy at http://, not https://, on that port (behind a reverse proxy). Kept starts only once migrate has finished; if it failed, docker compose logs migrate says why. More

Everything else: Troubleshooting.

Go further

• HTTPS: the camera, installing the app, push and location need it. Put Kept on HTTPS, or Kept on a home network for what works without it.
• The assistant: ask in plain words, with your own AI provider; Kept works without one. AI providers, and Connect an AI client (MCP).
• Backups: nightly and encrypted, to a directory, S3 or SFTP. Backups.
• Mail: password resets, invitations and reminders by mail, with KEPT_SMTP_URL and KEPT_SMTP_FROM. Mail, push and the calendar feed.
• Home Assistant: the integration brings what’s due into dashboards and automations. Home Assistant.

Updates

• Docker Compose: set KEPT_IMAGE in .env to the new release, then:

  docker compose pull
  docker compose up -d

  A release that changes compose.yaml says so in its notes: download its file over yours.

• From source:

  git pull
  docker build -t kept:local .
  docker compose up -d

• Kubernetes: each release publishes a chart of the same version, and its migrations run in a Job before the new version serves.

• Home Assistant: Home Assistant offers the update. Turn on Keep backup of the last version in its update dialog.

With a backup target set, Kept takes a snapshot before it migrates. Upgrades and rollback.