PHP 8.3 or 8.4 with gd, intl, pdo_mysql, bcmath, pcntl and zip, and Composer.
MySQL 8.4. Only MySQL: SQLite and MariaDB aren't supported.
ffmpeg, which encodes takes, shared harmonies and share videos on the server.
HTTPS. Browsers give a page the microphone, audio worklets, the service worker, passkeys and push notifications only on a secure page. localhost counts, for trying it out.
S3-compatible object storage with CORS and presigned uploads (DigitalOcean Spaces, AWS S3, Cloudflare R2 or MinIO), for media, private files and backups. Uploads to the local disk are for development only.
Two background processes: the scheduler, which also works through the default queue, and a worker for the long queue.
Mail, through any mailer Laravel supports.
Our beta runs on 1 vCPU and 1 GB for the web, 1 GB for the long worker and 0.5 GB for the scheduler.
Install it
1Clone the repo and run composer install --no-dev in server.
2Copy .env.example to .env, and set the database, the storage buckets, mail, APP_URL and SELF_HOSTED=true.
3Run php artisan key:generate, and set your own SQIDS_ALPHABET: never the default, and never changed once links are out.
4Run php artisan migrate --force, then php artisan app:templates:sync to put the songs in the catalogue.
5Point the web root at server/public, which serves the app from web/ beside it, and start the scheduler and the long worker.
6Run php artisan app:doctor: every readiness check, with its fix.
What SELF_HOSTED=true changes
Everything is unlocked: every account has every Plus feature, with no plans and no licence key. The limits are yours to set in server/config/usage.php.
Your own legal pages: your terms, privacy policy and the rest, as Markdown files in server/resources/legal/local/en/, or another folder with SELF_HOSTED_LEGAL_PATH. Until you write one, its page says it isn't written yet. Stackapella's own are never shown.
Your own addresses: SITE_CONTACT_EMAIL, SITE_FOUNDER, SITE_FOUNDER_URL, SITE_X_URL and SITE_BLUESKY_URL (none hides a link), SECURITY_CONTACT for security.txt, and the mail settings for what you send from.
The credit the licence asks for, Stackapella by Hillel Coren with stackapella.com, stays in every page's footer.
The admin, with each network feature (the gallery, leagues, a virtual choir and more) a switch you turn on.
What isn't included
The official songs and the course aren't bundled, but they're CC BY-SA 4.0: fetch them from their own repo and use or adapt them on any install, credited "Stackapella (https://stackapella.com)". The creator makes songs too.
The real singers' guide voices. Your guides are the synthesized voice.
Real instruments, until you upload CC0 sample sets of your own (php artisan app:instruments:upload).
The native apps, which talk to stackapella.com. On your server, people use the web app, which installs from the browser.
Paid Plus, the app stores and coaching, which are Stackapella's business.
This site. You may run the Stackapella web app under the Attribution Assurance License, but our marketing site (its pages, words, images and the Stackapella brand) isn't part of what's licensed for you to serve. On your install it's switched off (IS_NEXUS off): your address opens the app, and Help, the legal pages and shared harmonies stay.
If your install may not use the songs, the course and the guides, delete those folders: it runs without them, with no songs until you add your own, no guides and no what's new.
What a fresh install connects to
Nothing reported to us, no third-party analytics and no licence check.
Your server contacts your storage and mail provider, and each optional service only once its keys are set. Practice reminders go through the browsers' own push services, only for people who turn them on.
The weekly check of Cloudflare's published addresses runs only behind Cloudflare: BEHIND_CLOUDFLARE, off by default on a self-hosted install.
Your users' browsers load Vue (and lamejs, when exporting an MP3) from jsDelivr, each pinned to an exact version with an integrity hash, and the Figtree and Noto Music fonts from Google Fonts.
Yours to run
HTTPS and its renewals.
Backups, and a restore you've tested.
Updates.
Mail that arrives.
Moderation, if you open sharing.
Your own terms and privacy policy. Voices are personal data, and your singers may be 13 or older.
Bring your own, if you like
Google and Apple sign-in, Turnstile, Sentry, web push (php artisan app:reminders:keys), Event Schedule and Invoice Ninja, and posting to X and Bluesky. Each stays out of the way until its keys are in .env.
For choirs and schools
One install can serve a whole choir, school or federation: the director makes a group, shares songs and assigns parts, and the singers practise theirs.
Should you self-host?
Most singers shouldn't: stackapella.com is free to start. Self-host when the recordings must stay on your own servers, or when you're building on Stackapella.