No Cloud · No Account · No Breach Risk
Pew Pew Collection is a self-hosted firearm inventory app that runs entirely on your own hardware. No cloud storage, no third-party servers, no subscriptions. Your collection data stays where it belongs — with you.
Capabilities
SECURE AUTH
Bcrypt hashed passwords, session-based auth, and a forced password change on first login. App refuses to start in production with default credentials.
FULL CATALOGING
Track make, model, serial, caliber, firearm type, warranty, purchase details, storage location, and custom notes.
SEARCH & SORT
Powerful search across all fields. Click any column header to sort. Filter chips show an active state. The item count badge updates live as filters are applied. Inventory collapses into a card layout on mobile.
CSV EXPORT & IMPORT
Export your entire inventory with one click or bulk-import from a CSV file. Disposition fields (sold/lost/stolen) are included. Always your data.
FULLY OFFLINE
No internet connection ever required. No external services, no subscriptions, no telemetry. Just a local web server.
DOCKER READY
Pull the image from GHCR, spin it up with Compose, and you're running in under 60 seconds.
DARK MODE UI
A refined dark theme with a light mode toggle. Theme preference persists across sessions. The toggle announces its destination state via aria-label for screen readers.
CSRF PROTECTION
All forms are protected via the double-submit cookie pattern. Rate-limited login and password-change endpoints block brute-force attacks.
ACCESSIBLE BY DEFAULT
Skip-to-main landmark link, semantic <main> with focus management, and descriptive aria-label attributes on all interactive controls. Built for keyboard and screen-reader users.
REPORTS & ANALYTICS
Dedicated analytics dashboard with collection summary, breakdown charts by type, caliber, make, and condition, acquisition trends, average price by year, and disposition statistics.
INSURANCE REPORT
Generate a print-friendly insurance report with every firearm record and total purchase value, ready for PDF export.
SQLITE STORAGE
All data in a single portable file. Backups are a one-line cp command. Simple, reliable, yours.
SERIAL UNIQUENESS
Database-enforced unique serial numbers prevent accidental duplicates. Validated during form entry and CSV import with clear inline error messages.
In the field
→ INVENTORY LIST — Searchable, sortable, exportable.
→ ADD FIREARM — Comprehensive detail capture.
→ DETAIL VIEW — Full record with edit & delete.
→ PROFILE — Account, display preferences, and password management.
→ DASHBOARD — Activity feed, value chart, and type breakdown.
→ STATS — Local analytics by type, caliber, make, condition, and trend.
→ INSURANCE REPORT — Print-ready inventory summary with total value.
Deploy
# Pull & run in one command docker run -d \ --name ppcollection \ -p 3000:3000 \ -v $(pwd)/data:/data \ -e SESSION_SECRET=$(openssl rand -hex 32) \ -e ADMIN_USERNAME=admin \ -e ADMIN_PASSWORD=$(openssl rand -base64 24) \ --restart unless-stopped \ ghcr.io/gogorichielab/ppcollection:latest
services: ppcollection: image: ghcr.io/gogorichielab/ppcollection:latest ports: - "3000:3000" volumes: - ./data:/data environment: SESSION_SECRET: your_strong_secret_here ADMIN_USERNAME: admin ADMIN_PASSWORD: your_strong_password_here restart: unless-stopped
Run the Docker command or compose file. The image is hosted on GitHub Container Registry — no Docker Hub account required.
Generate a strong SESSION_SECRET with openssl rand -hex 32 and a strong ADMIN_PASSWORD with openssl rand -base64 24. Both are required in production — the app refuses to start with defaults.
Navigate to http://localhost:3000 and sign in with ADMIN_USERNAME / ADMIN_PASSWORD. First login requires setting a new password.
Add your first firearm. All data lives in a single app.db SQLite file — easy to back up, easy to restore.
Configuration
| Variable | Default | Notes |
|---|---|---|
SESSION_SECRET |
ppcollection_dev_secret |
Required in production — app refuses to start with the default. Generate with openssl rand -hex 32 |
ADMIN_USERNAME |
admin |
Username for the single admin account |
ADMIN_PASSWORD |
changeme |
Required for first-run in production — app refuses to start with the default on a fresh install. Forced password change on first login. Generate with openssl rand -base64 24 |
PORT |
3000 |
HTTP port the server listens on |
DATABASE_PATH |
/data/app.db |
Path to the SQLite database file inside the container |
DATA_DIR |
/data |
Allowed base directory for database files. DATABASE_PATH must resolve inside this directory. |
TRUST_PROXY |
false |
Set to true when running behind an HTTPS reverse proxy (nginx, Caddy, Traefik). Required for secure cookies to work correctly. |
SECURE_COOKIES |
true in production |
Enables the Secure flag on session and CSRF cookies. Defaults to true when NODE_ENV=production. Set SECURE_COOKIES=false if running on plain HTTP. |
UPDATE_CHECK |
false |
Opt-in: check GitHub Releases for new versions (cached 14 days). Set to true to enable in-app notifications. |
AUDIT_VERBOSE |
false |
When true, audit logs include username and serial metadata. Keep disabled for minimal sensitive logging. |
Open Source
Pew Pew Collection is free, open source, and welcomes contributions. Found a bug? Have a feature idea? Pull requests are warmly received.