Anytype

Deploys a self-hosted Anytype sync backend using the any-sync-dockercompose stack (3× any-sync-node, coordinator, filenode, consensusnode, MongoDB, Redis, MinIO) via Docker Compose. The compose stack itself is cloned as-is from the upstream repo; this role only manages the .env file and lifecycle.

Not for high-load production use. Upstream's own docs describe this compose stack as suitable for personal self-hosted networks, review, or testing — for high-load production deployments they point to their Puppet or Ansible modules instead. This role automates the compose stack as-is; it doesn't change that guidance.

Requirements

• Docker
• Docker Compose v2 plugin
• git
• curl and jq (only if you use anytype_update)
• community.docker Ansible collection

Variables

Variable	Default	Description
anytype_repo	https://github.com/anyproto/any-sync-dockercompose.git	Git URL of the any-sync-dockercompose repo. Cloned into anytype_docker_dir on first run only.
anytype_repo_version	v7.0.1	Tag/branch/commit of anytype_repo used for the initial clone, so installs are reproducible. See Updating.
anytype_update	false	When true, pulls anytype_repo's latest default-branch commit and re-pins the any-sync image versions in .env via upstream's update-versions.sh. See Updating.
anytype_docker_dir	/docker/anytype	Host path for the cloned repo and rendered .env file.
anytype_storage_dir	/data/anytype	Host path for persistent data volumes (MongoDB, Redis, MinIO, node storage).
anytype_any_sync_node_version	v0.11.1	any-sync-node image tag.
anytype_any_sync_filenode_version	v0.11.1	any-sync-filenode image tag.
anytype_any_sync_coordinator_version	v0.9.1	any-sync-coordinator image tag.
anytype_any_sync_consensusnode_version	v0.7.2	any-sync-consensusnode image tag.
anytype_any_sync_tools_version	latest	any-sync-tools (netcheck) image tag.
anytype_cli_version	latest	anytype-cli image tag. Only takes effect when anytype_cli_enabled is true.
anytype_mongo_version	7.0.28	MongoDB image tag. Pinning a major version below 6 (e.g. 4.4.x, the documented workaround for hosts without AVX CPU support) auto-applies a compatible healthcheck — see Compose Overrides.
anytype_redis_version	7.2.0-v6	Redis image tag.
anytype_minio_version	RELEASE.2024-07-04T14-25-45Z	MinIO image tag.
anytype_external_listen_hosts	127.0.0.1	Address(es) advertised to Anytype clients for reaching this deployment, baked into the generated client.yml/network.yml. Accepts hostnames as well as IPs. Space-separated for multiple. Does not affect the API/metrics ports below, which always bind 127.0.0.1.
anytype_any_sync_node_base_port	1000	Base sync port for any-sync-node-1/2/3. Each node gets base + node index.
anytype_any_sync_node_base_quic_port	1010	Base QUIC port for any-sync-node-1/2/3. Each node gets base + node index.
anytype_any_sync_nodes	see Nodes	List of 3 entries (api_port, metric_port), one per any-sync-node-1/2/3 in order.
anytype_any_sync_coordinator_default_limits_space_members_read	1000	Max space members with read access, enforced by the coordinator.
anytype_any_sync_coordinator_default_limits_space_members_write	1000	Max space members with write access, enforced by the coordinator.
anytype_any_sync_coordinator_default_limits_shared_spaces_limit	1000	Max shared spaces per account, enforced by the coordinator.
anytype_any_sync_filenode_default_limit	1099511627776	Default per-account storage quota in bytes (1 TiB).
anytype_cli_enabled	false	Turns on the anytype-cli bot/automation service in the rendered docker-compose override. See CLI.
anytype_cli_grpc_port	31010	anytype-cli gRPC port. Only takes effect when anytype_cli_enabled is true.
anytype_cli_grpc_web_port	31011	anytype-cli gRPC-Web port.
anytype_cli_api_port	31012	anytype-cli HTTP API port.
anytype_cli_account_name	anytype-bot	Account name used by the anytype-cli bot.
anytype_mongo_1_port	27001	MongoDB port.
anytype_mongo_replica_set	rs0	MongoDB replica set name.
anytype_redis_port	6379	Redis port.
anytype_redis_maxmemory	256mb	Redis max memory before eviction (noeviction policy).
anytype_aws_access_key_id	~	MinIO root user / S3 access key for any-sync-filenode. Required.
anytype_aws_secret_access_key	~	MinIO root password / S3 secret key. Required.
anytype_minio_bucket	minio-bucket	MinIO bucket used for file storage.
anytype_minio_port	9000	MinIO S3 API port.
anytype_minio_web_port	9001	MinIO console port.
anytype_any_sync_daemons_memory_limit	500M	Memory limit applied to each any-sync daemon container.
anytype_deploy_wait_timeout	600	Max seconds to wait for containers to become running/healthy during deploy, before failing instead of hanging indefinitely.
anytype_uninstall	false	Stops and removes containers and the docker directory.
anytype_purge	false	Also removes the storage directory. Requires anytype_uninstall: true. Irreversible.

Nodes

anytype_any_sync_nodes is a list of exactly 3 entries, one per any-sync-node-1/2/3 in order. Each entry:

Key	Required	Description
api_port	yes	Host port for the node's internal API server (container port 8080).
metric_port	yes	Host port for the node's Prometheus metrics endpoint (container port 8000).

Node hostnames and sync/QUIC transport ports aren't configurable: hostnames are fixed by the upstream docker-compose.yml service names, and the transport ports are derived from anytype_any_sync_node_base_port/anytype_any_sync_node_base_quic_port. The same applies to the coordinator, filenode, and consensusnode services — only their API/metrics-adjacent settings are exposed as variables.

Updating

anytype_repo_version pins the initial clone to a specific tag so a fresh install is reproducible — it is not re-applied on later runs (the git clone task only clones once; see Notes). Before bumping it, read upstream's Upgrade Guide.

Setting anytype_update: true makes the role, on that run, git pull anytype_repo's latest default-branch commit (ignoring anytype_repo_version) and then run ./update-versions.sh .env from the cloned repo. That script only bumps ANY_SYNC_NODE_VERSION, ANY_SYNC_FILENODE_VERSION, ANY_SYNC_COORDINATOR_VERSION, and ANY_SYNC_CONSENSUSNODE_VERSION to whatever upstream's compatibility API resolves as current — it does not touch Mongo/Redis/MinIO/tools/cli versions, and requires curl/jq on the target host plus network access to puppetdoc.anytype.io.

This happens after .env is rendered from anytype_*_version, so it overrides them for that run only. The next run without anytype_update: true re-renders .env from your anytype_*_version defaults, discarding the bumped versions. To make an update stick, copy the resulting versions from .env back into your inventory, or leave anytype_update: true set permanently if you want every run to track upstream's latest.

Compose Overrides

templates/override.yml.j2 always renders to docker-compose.override.yml in anytype_docker_dir, which Docker Compose auto-merges alongside the vendored docker-compose.yml — the vendored file itself is never touched. It carries two fixes unconditionally, on every deploy:

• MongoDB pre-6.0 healthcheck — auto-applied when anytype_mongo_version's major version is below 6. Upstream's healthcheck hardcodes mongosh, which isn't bundled until MongoDB 6.0. This matters if you're pinning anytype_mongo_version to a 4.4.x/5.0.x release — the documented workaround for hosts without AVX CPU support, since MongoDB 5.0+ requires it (see upstream's Troubleshooting & FAQ). Without this fix, mongo-1 would be permanently unhealthy and block every service that depends on it.
• create-bucket dependency — makes any-sync-filenode explicitly wait on the one-shot MinIO bucket provisioner's successful completion, since nothing in the vendored compose file does, and docker compose up --wait can't otherwise tell its clean exit apart from a crash.

anytype_cli_enabled: true (see CLI below) adds a third piece on top of the same file.

CLI

anytype_cli_enabled: true turns on anytype-cli — a headless bot/automation account for your network, exposed over gRPC/gRPC-Web/HTTP. anytype-cli_bootstrap creates the bot account once on first boot; anytype-cli then serves it continuously. Use cases: automating workspace/content operations, running a bot that can be invited into and manage spaces, or integrating the network into other tooling — see upstream's Anytype-cli wiki page.

Enabling it adds the anytype-cli/anytype-cli_bootstrap service block to the always-rendered docker-compose.override.yml (see Compose Overrides).

The bot's account key is generated on first boot and persisted in anytype_storage_dir/anytype-cli/config.json — back it up, it's the bot's only credential.

anytype_cli_enabled: true

Setting anytype_cli_enabled: false again re-renders the override file without that service block, and the next deploy stops and removes the now-orphaned anytype-cli/anytype-cli_bootstrap containers.

Usage

Minimal setup:

anytype_aws_access_key_id: "{{ vault_anytype_minio_access_key }}"
anytype_aws_secret_access_key: "{{ vault_anytype_minio_secret_key }}"

Exposed on a LAN address with custom node ports:

anytype_external_listen_hosts: "10.0.0.5"
anytype_aws_access_key_id: "{{ vault_anytype_minio_access_key }}"
anytype_aws_secret_access_key: "{{ vault_anytype_minio_secret_key }}"
anytype_any_sync_nodes:
  - api_port: 18081
    metric_port: 18001
  - api_port: 18082
    metric_port: 18002
  - api_port: 18083
    metric_port: 18003

Track upstream's latest versions on every run:

anytype_update: true

Uninstall

To stop and remove all containers and the docker directory:

anytype_uninstall: true

To also wipe all data including MongoDB, Redis, and MinIO contents (irreversible):

anytype_uninstall: true
anytype_purge: true

Notes

• Back up anytype_storage_dir/docker-generateconfig. On first run it generates and persists the network's cryptographic identity (network ID and signing keys). If it's lost, the deployment cannot rejoin or recover the same any-sync network — treat it like a private key, not just app data.
• The ansible.builtin.git clone task only runs the actual clone once (update: false); once anytype_docker_dir holds a repo, changing anytype_repo_version on a later run has no effect until you either remove the directory or set anytype_update: true (which ignores the pin and tracks latest instead — see Updating).
• anytype_storage_dir and its subdirectories are owned by 0:0 (root), mode 0755.
• anytype_docker_dir is owned by 0:0 (root), mode 0700; the rendered .env inside it is mode 0600 since it contains secrets (MinIO credentials) in plain text.
• Service hostnames (any-sync-node-1/2/3, any-sync-coordinator, any-sync-filenode, any-sync-consensusnode, mongo-1, redis) are not configurable — they're fixed by the upstream docker-compose.yml service names, and changing them would break Docker's internal DNS resolution between containers.
• Docker Engine, the Compose v2 plugin, and git must already be installed on the target host — this role does not install them.
• anytype_repo defaults to the public GitHub repo over HTTPS, so no SSH deploy keys are required on the target host.
• The anytype-cli service is commented out by default in the upstream docker-compose.yml; the anytype_cli_* variables only take effect when anytype_cli_enabled: true — see CLI.
• anytype_aws_access_key_id and anytype_aws_secret_access_key should be stored in Ansible Vault.