evertap

Linux

Run evertap on a home server, a VPS, or your own Linux computer, or inside WSL on Windows.

Check Docker

evertap needs Linux on x64 or arm64, with Docker Engine 24 or later.

Use Docker 28.0 or later

Or 28.3.3 or later with firewalld. Older versions let other machines on your network reach what Docker publishes on 127.0.0.1, which includes every database and bucket, without going through evertap. The Doctor warns about it.

Your user must be able to use Docker without sudo. Add it to the docker group, then log out and back in:

sudo usermod -aG docker $USER

Being in that group is as good as being root on that machine, so add only users you would trust with root. Docker from Snap and rootless Docker need one more step first (How Docker was installed).

Leave disk space for the images evertap downloads: about 400 MB for each PostgreSQL version and 800 to 900 MB for each MySQL version you use. Each MySQL database also takes about 210 MB before any data, as each runs a server of its own, and each MySQL version keeps one more such copy that new databases start from.

Run the install script

Run it as yourself, not with sudo:

curl -fsSL https://evertap.dev/install.sh | sh

When it asks where it runs, answer 1:

Where is this?
  1) The machine that runs evertap (it needs Docker)
  2) A laptop or CI that connects to evertap on another machine

curl -fsSL https://evertap.dev/install.sh | sh

What it does on Linux with systemd

  1. Asks where it runs: answer 1The machine that runs evertap
  2. Checks that you can use Dockerdocker group
  3. Installs the binary/usr/local/bin/evertap
  4. Starts evertap at bootevertap@<you>
  5. Runs setup, the first timeevertap setup

It checks that your user can use Docker, and stops with what to do if not. Then it downloads the build for your system from the latest GitHub release, checks it against the release's SHA256SUMS, and installs it as /usr/local/bin/evertap, asking for sudo if it needs it. evertap keeps its data in your ~/.local/share/evertap, where evertap setup and the other commands you run find it.

Without a terminal, as when a script sets up the machine, set EVERTAP_ROLE=host on the sh side of the pipe. The install script lists its other settings.

Keep evertap running

Every connection to a database or bucket goes through the evertap serve process. While it is stopped, the databases keep running in Docker but nothing reaches them.

The script installs the unit evertap@.service from the release in /etc/systemd/system/ and enables evertap@<you>, which runs evertap serve at boot as the user who ran the script. It starts evertap, or restarts it, and waits up to 30 seconds for it to answer.

  • Read evertap's log with journalctl -u evertap@$USER -f. On start, it says where it listens and what to do next.
  • The script replaces the unit each time it runs. Make changes of your own in a drop-in, which it leaves alone: sudo systemctl edit evertap@.
  • To give evertap environment variables, see Settings for the service.

Set up and sign in

With systemd, the install script runs evertap setup for you on a first install. Without a terminal, it says to run evertap setup with flags instead.

On the machine running evertap, as the user that runs it, while it runs:

evertap setup

evertap setup

Where will you open evertap from?

  • This computer onlyApps on this computer connect directlyhttp://ev.internal:8080
  • Devices on your networkLaptops run evertap connecthttp://<this machine>:8080
  • Anywhere, through CloudflareLaptops run evertap connecthttps://evertap.example.com
  • Behind your own proxy or tunnelLaptops run evertap connecthttps://evertap.example.com

Until you run it, evertap listens on 127.0.0.1 alone, and no other machine can reach it (What listens where). Setup asks where you will open evertap from (Choose how evertap is reached), asks only what that choice needs, and applies it without a restart. Then it signs in your first browser:

  • For This computer only, it opens a signed-in browser on this machine.
  • For the others, it prints a one-time sign-in link and a QR code. Open the link in a browser, or scan the code with your phone. It signs in one browser and expires in 10 minutes.

Without a terminal, give the answers as flags, and setup asks nothing:

evertap setup --mode local                                                         # This computer only
evertap setup --mode network --listen 0.0.0.0                                      # Devices on your network
CLOUDFLARE_API_TOKEN=<token> evertap setup --mode cloudflare --zone example.com    # Anywhere, through Cloudflare
evertap setup --mode network --url https://evertap.example.com                     # Behind your own proxy or tunnel

Run evertap setup again to change your answers; it offers to keep the address you gave before. Once you are signed in, Settings in the UI can make the same changes, as long as they keep your browser connected.

Signing in later

  • A new browser shows a code. On a device that is signed in, open /device (Clients → Add a device) and enter it.
  • evertap signin-link, on the machine running evertap, prints another one-time link and QR code. Use it when no browser is signed in anymore.
  • evertap open, on the machine running evertap, opens a signed-in browser there.

Check it

evertap doctor

The Doctor, also a page in the UI, shows the Docker version and any warnings about it, the state of each service, whether each database and bucket entry answers, and which of your own Docker containers want the same ports.

Next, connect from your laptop. Upgrading and uninstalling are in Limitations.

WSL

There is no Windows build, but evertap runs inside WSL as on any Linux. Follow the steps above inside WSL, with these differences:

Windows

Only what runs inside WSL reaches ev.internal.

WSL, with Docker

Your appsev.internalevertapevertap serve
Windows appsNo ev.internal
  • Where WSL runs without systemd, the script installs the binary alone: run evertap serve yourself (Keep evertap running).
  • Windows apps outside WSL do not reach ev.internal, because WSL passes only 127.0.0.1 on to Windows. Run your apps inside WSL too.
  • WSL writes a new /etc/hosts each time it starts, which drops the ev.internal line that setup adds for This computer only. Keep it with generateHosts = false.

How Docker was installed

evertap finds Docker's socket in this order: EVERTAP_DOCKER_SOCKET, a unix:// DOCKER_HOST, then the usual places of Docker Engine, Docker Desktop, OrbStack, Colima, and rootless Docker. Some installs need more:

  • Docker from Snap cannot read files in hidden folders of your home, which includes evertap's data directory ~/.local/share/evertap, so databases fail to start. Install Docker from docker.com's packages instead, or set EVERTAP_DATA_DIR to a folder that is not hidden, such as ~/evertap, wherever you run evertap (see Configuration).
  • Rootless Docker stops when you log out, and the databases with it. Run sudo loginctl enable-linger $USER and systemctl --user enable docker so it keeps running. The systemd service has no XDG_RUNTIME_DIR, so set EVERTAP_DOCKER_SOCKET=/run/user/<your uid>/docker.sock in its environment file before you run the install script.

The Doctor warns about both.

Settings for the service

Most installs need no environment variables, since evertap setup saves its answers. To set one for the service, put it in /etc/evertap/evertap.env, which the unit reads if it exists. Start from the example contrib/systemd/evertap.env, remove the # before what you need, and restart the service:

sudo mkdir -p /etc/evertap
curl -fsSL https://raw.githubusercontent.com/caru-ini/evertap/main/contrib/systemd/evertap.env |
  sudo tee /etc/evertap/evertap.env > /dev/null
sudoedit /etc/evertap/evertap.env
sudo systemctl restart evertap@$USER

Set only what you need: a variable fixes its setting, and setup can no longer change it (Configuration). If you set EVERTAP_DATA_DIR there, set it in your shell too, or evertap setup, the install script, and the other commands on that machine cannot find the running evertap.

Upgrade

Run the install script again to upgrade evertap, or to repair it: it asks again, and installs even the version you have. With systemd, it keeps the binary it replaces as evertap.prev beside the new one. If the new evertap does not answer, it puts that one back and starts it again (Upgrade).

Install by hand

From the releases page, download evertap-linux-<arch>.tar.gz for your system and SHA256SUMS, then:

grep evertap-linux-x64.tar.gz SHA256SUMS | sha256sum -c
tar -xzf evertap-linux-x64.tar.gz
sudo install -m 755 evertap-linux-x64/evertap /usr/local/bin/evertap

The archive also holds the license, the third-party notices, and the systemd unit evertap@.service. To run evertap at boot without the install script, install the unit from the same archive, and enable it for your own user, whose ~/.local/share/evertap holds evertap's data:

sudo cp evertap-linux-x64/evertap@.service /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable --now evertap@$USER

The unit runs /usr/local/bin/evertap; if you installed it elsewhere, change ExecStart. After each upgrade by hand, restart it with sudo systemctl restart evertap@$USER.

With the GitHub CLI, you can check that GitHub's release workflow built the archive:

gh attestation verify evertap-linux-x64.tar.gz --repo caru-ini/evertap
Edit on GitHub

The evertap name and logo are not licensed with the code (section 6 of the license). You may use them to refer to evertap, but not to name or brand your own product or service, or in a way that suggests evertap made or endorses it, without permission.

evertap is an independent project. It is not affiliated with, endorsed, sponsored, supported, or certified by the owners of the software it runs, and it uses their names only to say which software that is.

  • Postgres, PostgreSQL and the Slonik Logo are trademarks or registered trademarks of the PostgreSQL Community Association of Canada, and used with their permission.
  • MySQL is a registered trademark of Oracle and/or its affiliates.
  • Redis is a registered trademark of Redis Ltd. Any rights therein are reserved to Redis Ltd.
  • Other names, including Garage and Cloudflare, may be trademarks of their respective owners.

On this page