TREK is a self-hosted trip planner built from admin-toggled addons, and half of them ship switched off

Most features are addons, and the AI and road trip ones start disabled

TREK describes itself as having grown from a travel planner into an ecosystem: planning together in real time on a live map, hikes, tours and road trips, bookings and shared costs, packing, a journal and a photo book, with a built-in AI for the busy work. It runs on the web, on phones and offline.

What a fresh install shows depends on addon defaults, because most features are addons an admin switches on or off. Lists, Costs, Documents, Collab, Tours, Vacay and Atlas ship on. Journey, Collections, MCP, the AI assistant, AI Parsing, Road trip, Dawarich and AirTrail ship off.

The consequence is that a new user opening the demo and a new user opening your install may see different apps. Road trip planning with EV charging and range, AI parsing of booking confirmations, flight sync from a self-hosted AirTrail instance and the MCP integration all need an admin to turn them on first. If someone tells you TREK lacks a feature, check the addon list before believing them.

Maps, routing, weather and rates come from outside services

Self-hosted does not mean self-contained. TREK draws on a set of external providers, several of which need no API key. Maps render with Leaflet, Mapbox GL or MapLibre GL, with OpenFreeMap available without a token. Place search uses the TREK Places index and OpenStreetMap with no key, or Google Places and Amap with one, and pulls descriptions, hours and photos from Wikipedia, Wikidata and Wikimedia Commons. Nearby exploration falls back to Overpass. Routing runs over OSRM or Valhalla, public transport over Transitous with Google where Transitous has no data, weather from Open-Meteo with a 16-day forecast, and currency rates from Frankfurter.

The benefit is that a basic install works without signing up for anything. The cost is that trip locations, searches and routes leave your server to reach those services. If the reason you self-host is to keep travel plans entirely private, this is the part to examine provider by provider. Day routes can also be opened in Google Maps or CoMaps, and a place in seven navigation apps, which again hands the data to whichever app you pick.

Tours are routed by activity type and hiking difficulty

Tours are the most detailed part of TREK. There are seven tour types: hike, city walk, run, bike (touring, road, gravel, MTB), paddle (kayak, canoe, SUP), horse ride, and ski and winter (alpine, cross-country, touring, snowshoe, winter hike). Legs are routed over Valhalla with shaping points, hand-drawn legs, route variants and round hikes of a chosen length.

Hikes can be routed within a maximum SAC grade from T1 to T6, with trail grades shown along the way and via ferratas on the map. A terrain view gives an elevation profile, ascent and descent, and a 3D map with grade colouring and a flyover, without a token. Multi-day tours cut one route into stages across the trip's days. Ski routing goes by piste difficulty and lift type, and the water router handles portages and locks with a wind forecast.

A recorded GPX can be linked to a planned day to compare distance, ascent and time, and trails can be imported from a wanderer instance. Day plans themselves auto-sort with nearest neighbour then 2-opt, keeping locked stops and hotels in place.

Costs are stored in integer cents with exchange rates frozen at entry

The money side is precise in a specific way. Costs are split in integer cents with equal or custom shares and several payers, followed by settle-up suggestions, a per-person summary, a settlement log and CSV export. Each expense carries its own currency, and the rate is frozen at the moment of entry.

Freezing the rate keeps past balances stable, but it has a consequence: if you enter an expense days before paying it, or the card settles at a different rate, TREK's figure will not match your statement. Treat the settle-up numbers as the group's agreed record, not as a reconciliation with your bank.

Reservations cover 18 booking types with status, confirmation code, travellers and attached files. Flights and trains resolve local times against 4,045 bundled airports without a key. Booking import accepts EML, PDF, PKPass, HTML, TXT and photos of confirmations, parsed through KItinerary or an AI model, with a review step before anything is saved; prices then become linked costs. Attachments are capped at 50 MB each and 500 MB for video, so long trip videos will not fit.

Seventeen trip actions map to four roles

Collaboration runs over WebSocket, so edits land live for everyone who has the trip open. Members are added by email or username, ownership can be handed over, and guests can be added without any login at all.

Permissions are configurable at a fine grain: an admin maps each of 17 trip actions to admin, trip owner, trip member or everybody. Each trip gets one reusable invite link with an optional expiry, and admin signup invites drop a new account straight into a trip. A public share produces a read-only trip page for people without an account.

The reusable link is convenient and also the thing to manage. Anyone holding it can join until it expires, so set an expiry on links you send to large groups. Guests without a login and a public read-only page also widen who sees the trip, so decide which of the 17 actions guests and everybody should hold before sharing widely.

The compose file drops every capability and mounts the root read only

The shipped docker-compose.yml runs the mauriceboe/trek:latest image with a hardened profile: a read-only root filesystem, no-new-privileges, all capabilities dropped and only CHOWN, SETUID, SETGID and KILL added back. KILL is there because dumb-init runs as root and forwards SIGTERM to node running as the node user; without it, docker stop ends in SIGKILL and graceful shutdown never runs. /tmp is a tmpfs mounted noexec and nosuid at 128m. The app listens on port 3000.

The encryption key deserves attention. ENCRYPTION_KEY is recommended and generated with:

openssl rand -hex 32

If it is unset, existing installs fall back to data/.jwt_secret and fresh installs auto-generate a key. Setting it yourself means you know where the key lives and can back it up.

TZ sets the timezone for logs, reminders and scheduled tasks, defaulting to UTC. LOG_LEVEL is info for concise user actions or debug for verbose detail. The in-app Help pages read from /app/wiki inside the image; if TREK_WIKI_DIR points at a path that does not exist, Help falls back to the public GitHub wiki, which needs outbound network and tracks the latest release rather than your version.

Releases move fast, and the compose file tracks latest

The project is not archived and ships frequently: v5.0.0 on 2026-10-25, v5.0.1 on 2026-10-28 and v5.1.0 on 2026-10-31, with the last push on 2026-11-02. The default compose file pulls mauriceboe/trek:latest, so a restart after a pull can move you across a major version without warning. Pin a tag for any install people depend on.

For building from source, package.json requires Node ^22.22.2, ^24.15.0 or >=26.0.0, and the repo is an npm workspace of client, server and shared, with a separate plugin-sdk directory. The Dockerfile builds shared, client and server in separate node:24-alpine stages, and rebuilds gosu with a current Go toolchain pinned to the commit of gosu's 1.19 tag so the image does not ship a stale Go standard library. The one native module, better-sqlite3, ships its binaries inside the npm tarball.

The repository also includes a charts/ directory and an unraid-template.xml, and an MCP.md alongside the MCP addon. The license is AGPL-3.0, and TRADEMARKS.md sits at the root, which matters if you plan to rebrand a modified deployment.

Editorial conclusion

TREK fits a household, club or small group that wants to plan trips together on a server it controls, with routed tours, bookings and shared costs in one place, and an admin willing to decide which addons to switch on. It does not fit anyone expecting a self-hosted app that never talks to outside services, since maps, routing, weather, currency rates and transit come from external providers. Before deploying, set ENCRYPTION_KEY yourself, pin an image version instead of latest, and check which map, places and routing providers you are comfortable sending trip locations to.

Frequently asked questions

Official sources

1. Official documentation
2. Official README
3. Project repository
4. Release notes