How to Set Up Joplin Server (Sync Your Notes Between Every Device, Encrypted)

Joplin is the open-source Evernote: notebooks, Markdown notes with images and attachments, a web clipper, tags, search, and apps for Windows, Mac, Linux, iOS and Android. It can sync through Dropbox or Nextcloud, but Joplin Server is the fastest and cleanest target — a small container that also enables sharing a notebook with someone and publishing a note as a link. With end-to-end encryption on, the server holds nothing readable.

mkdir -p ~/docker/joplin && cd ~/docker/joplin
nano compose.yaml

services:
joplin:
image: joplin/server:latest
container_name: joplin
ports:
- "22300:22300"
environment:
APP_BASE_URL: http://192.168.1.50:22300
APP_PORT: 22300
DB_CLIENT: pg
POSTGRES_HOST: db
POSTGRES_PORT: 5432
POSTGRES_DATABASE: joplin
POSTGRES_USER: joplin
POSTGRES_PASSWORD: ${DB_PASSWORD}
MAX_ITEM_SIZE: 200MB
MAX_TOTAL_ITEM_SIZE: 20GB
depends_on:
- db
restart: unless-stopped

db:
image: postgres:16-alpine
container_name: joplin_db
environment:
POSTGRES_DB: joplin
POSTGRES_USER: joplin
POSTGRES_PASSWORD: ${DB_PASSWORD}
volumes:
- ./db:/var/lib/postgresql/data
restart: unless-stopped

APP_BASE_URL must be the address the apps will use; change it to https://notes.example.com when it's behind the proxy. Note content lives in the database — ./db is the whole thing.

docker compose up -d
sudo ufw allow from 192.168.1.0/24 to any port 22300

http://192.168.1.50:22300, log in as admin@localhost / admin, and immediately Profile → change password (and email). Users → Add one per person: email, password. Those are the credentials the apps use.

Install Joplin on the desktop. Options → Synchronisation → Target: Joplin Server, URL http://192.168.1.50:22300, your user's email and password, Check synchronisation configuration. Same on the phone apps. Notes made anywhere arrive everywhere within a minute (or on demand with the sync button).

Desktop app → Options → Encryption → Enable encryption, set a master password. Every device then asks for that password once; from then on the server stores ciphertext only. Write the password down somewhere safe — the server can't help if you lose it.

Right-click a notebook → Share notebook → the other user's email. Both edit the same notes. Right-click a note → Publish gives a public link to a read-only web page of it — a recipe for a friend, a how-to for a relative. Shared notebooks can't be end-to-end encrypted (the server has to merge them), so keep shared things in their own notebook.

The Joplin Web Clipper browser extension saves a page, a simplified article or a screenshot as a note. Tags, a notebook tree, full-text search, Markdown with a live preview, maths, diagrams, attachments, a note history, and plugins (Kanban, backlinks, templates) are all in the apps — the server just syncs.

notes.example.com → 127.0.0.1:22300, client_max_body_size 200M, HTTPS, and update APP_BASE_URL. Then phones sync from anywhere without the VPN.

"Not allowed: POST /api/sessions" or sync errors. Wrong APP_BASE_URL (must match what the app uses, exactly, including https), or the user's password.

Attachments fail to sync. MAX_ITEM_SIZE and the proxy's upload limit.

Encryption keeps asking for a password on one device. Enter the master password under Encryption on that device — it's per device.

Admin password forgotten. docker compose exec joplin node dist/app.js --env prod --reset-admin-password (check the image's docs for the exact flag in your version).

Two containers, change the admin login, a user per person, the apps pointed at the server, encryption on. Notes, clippings and attachments sync across every device through a box you own, and the server itself can't read a word of them.