Session Desk

Run your own copy

Session Desk is a personal paper-trading desk. It is single-user: each person runs their own copy on their own server, with their own keys. There is no shared account and no hosted service you sign up for here.

Back to sign in

Get the code

The repo address is PUBLIC_REPO_URL. This server is using the address below. Copy the clone command onto the machine that will run the desk.

git clone https://github.com/UnityBridge/session-desk
cd session-desk

What it costs

  • About $5–6 a month for a small VPS. An OVHcloud VPS-1, or anything similar, with Ubuntu 24.04 is enough.
  • Supabase’s free project covers the database and sign-in.
  • Alpaca’s free paper account and free IEX data cover the market feed and paper fills.
  • A model key is optional. OpenAI or Anthropic charges only for the calls you make.
  • A domain is optional until you want a public HTTPS name. Expect about $10 a year if you buy one.

Accounts to create

  • Supabase

    Free project for the database and your sign-in. One project per person.

  • Alpaca

    Free paper account and free IEX stock data. This is the paper broker.

  • Robinhood

    Your own login, used later if you connect the broker. Start in paper mode.

  • Coinbase

    Optional. A CDP key with trade and view only, if you want that crypto venue.

  • OpenAI

    Optional. Pays for strategy drafts and the Setup Assistant when you turn that on.

  • Anthropic

    Optional. The other model provider. You only need one of these two.

  • A domain

    Optional until you want HTTPS on a real name. Any registrar works. Cloudflare DNS is enough.

Set it up

  1. 1. Create the server and add an SSH key

    Rent a small Ubuntu 24.04 VPS, such as an OVHcloud VPS-1. On your computer, create a key if you do not have one, then paste the public key into the provider’s panel before the first login.

    ssh-keygen -t ed25519 -C "session-desk"
ssh ubuntu@YOUR_SERVER_IP

  2. 2. Install Docker

    On the server, install Docker Engine and the compose plugin, then add your user to the docker group and sign in again.

    curl -fsSL https://get.docker.com | sudo sh
sudo usermod -aG docker "$USER"

  3. 3. Clone the repo

    The address comes from PUBLIC_REPO_URL. The default is this project’s public GitHub repo.

    git clone https://github.com/UnityBridge/session-desk
cd session-desk

  4. 4. Run setup.sh

    From the repo folder, the script writes .env. You can press enter on keys you do not have yet and fill them in after Supabase exists. It leaves live trading off.

    chmod +x scripts/setup.sh
./scripts/setup.sh

  5. 5. Create a Supabase project and run the migrations

    In the Supabase SQL editor, run each file in supabase/migrations in this order. The app does not run them for you. Then open Authentication, then URL Configuration. Set Site URL to your https domain, and add https://<your-domain>/** to Redirect URLs. Otherwise the confirmation email links to localhost. Leave Allow new users to sign up ON. The app's OWNER_EMAIL check is what restricts sign-ups. Set OWNER_EMAIL in .env to the one address that may create the desk account.

    1. supabase/migrations/20260927020000_init_session_desk.sql
    2. supabase/migrations/20260927043000_auto_trading_and_crypto.sql
    3. supabase/migrations/20260927060000_crypto_venue_mode.sql
    4. supabase/migrations/20260927070000_tutor_log.sql
    5. supabase/migrations/20260927100000_agent_api.sql

  6. 6. Fill in .env

    Put your Supabase URL, publishable key, and service role key in .env. Add the Alpaca paper key. Set OWNER_EMAIL to your address and leave ALLOW_SIGNUPS=false. Set APP_BASE_URL to the https address you will use. Keep LIVE_TRADING_ENABLED=false.

  7. 7. Start the desk

    Compose builds the web app and the worker. The dashboard listens on port 43123.

    docker compose up -d

  8. 8. Point DNS at the server and turn on HTTPS

    Create an A record for your hostname that points at the server’s IP. Put Caddy, or another reverse proxy, in front of port 43123 so the public site is HTTPS. Open ports 22, 80, and 443. Leave 43123 off the public internet. Set APP_BASE_URL to that https URL and restart compose.

    desk.example.com {
    reverse_proxy 127.0.0.1:43123
}

  9. 9. Sign in and create the owner account

    Open the site, choose Create account with the OWNER_EMAIL address, then sign in. Leave Supabase's Allow new users to sign up ON, and leave ALLOW_SIGNUPS=false. OWNER_EMAIL is what stops anyone else from creating an account. Paper mode is the desk you just opened.

Safety defaults

  • Start in paper mode. Practice fills go through Alpaca paper, not a live brokerage account.
  • LIVE_TRADING_ENABLED=false is the default. Leave it there. This phase still refuses live broker orders.
  • The Setup Assistant is off by default. The checklist on /setup works without a model.
  • The agent API is off by default. Turn it on only after HTTPS is in place, and only for a token you created.
  • Never share keys. The .env file, the Supabase service role key, and broker secrets stay on your server.

Not financial advice

Use this at your own risk. Session Desk is software you run yourself. It is not financial, legal, or tax advice, and it is not a broker. Nothing on this page is a recommendation to buy or sell anything.

Troubleshooting

The Create account button is missing, or sign-up says it is closed.

That is the default. Set OWNER_EMAIL in .env to your address and restart. Only that address can create an account. ALLOW_SIGNUPS=true opens registration to anyone, which you do not want on a public server.

Sign-in says a table does not exist.

The SQL migrations have not been applied, or they were applied out of order. Run the five files in supabase/migrations from oldest name to newest, then reload.

Every page sends me back to sign-in.

The desk, settings, setup, and agent log require a session. Only this guide, the sign-in page, and the health check are public. Create the owner account, then sign in.

Docker says permission denied.

Your user is not in the docker group yet, or you have not signed out and back in since usermod. You can also prefix commands with sudo.

The site loads over HTTP but the agent API refuses connections.

Use the HTTPS hostname, or an SSH tunnel to localhost. Public plain HTTP is refused unless AGENT_API_ALLOW_INSECURE=true. Leave the agent API off until you want it.

Can a friend log into this server?

No. Session Desk is one person, one copy, one set of keys. A friend clones the repo onto their own server.