ManaVault

ManaVault is a self-hosted Magic: The Gathering collection and deck workspace. It gives you one local source of truth for the cards you own, where they live, which decks are using them, and what still needs to be bought or pulled from storage.

It is built for players who care about exact printings, physical inventory, and repeatable deck-building workflows without handing collection data to a hosted service. One container, one SQLite database: no Postgres, Redis, object storage, or hosted backend required.

Features

Each area links to the feature reference for details.

• Card catalog - local Scryfall sync with fast search, exact printings, prices, legalities, rulings, oracle tags, EDHREC synergies, and full-screen previews.
• Collection - track quantity, condition, language, finish, purchase price, and storage location per printing. TXT/CSV import and export, structured filters, bulk edits, a value dashboard with gains and losses, rule-based auto-sort into locations, list availability checks, and sold-list removal.
• Card scanner - identify cards from the camera entirely in the browser, log them hands-free, and import the scanned list into the collection.
• Decks - commander/mainboard/considering zones, decklist import/export, preferred printings, custom tags, flexible grouping, primers, keyboard shortcuts, and a Swap cards workbench with a legality preview.
• Allocation - reserve physical copies for deck cards so a card is never promised to two decks, then turn gaps into pull lists, proxies, and buylists for Mana Pool, Card Kingdom, StarCityGames, or TCGplayer.
• Deck analysis - format legality, mana curve and production, tokens, Commander Spellbook combos, salt scores, and an in-browser playtest table.
• Recommendations - EDHREC recommendations, cuts, themes, and commander pages, plus Recommander suggestions.
• AI deck insights (optional, OpenRouter) - saved deck analysis with granular Commander bracket ratings, analysis of pasted lists, and saved Ask AI conversations that can check your collection for free copies.
• Random deck picker - a weighted "pick a deck" suggestion with play history.
• Trade - a trade binder, want list, and matches against a partner's list or a Moxfield, Archidekt, or ManaVault link, plus decklist diffs.
• Sharing - revocable read-only links for decks, buylists, want lists, and trade binders.
• Pricing - choose Scryfall, TCGplayer, Card Kingdom, or Mana Pool as the price source.
• Settings and appearance - Liquid Glass or classic styling, a dozen color palettes, live server logs, and read-only personal API keys.
• Mobile - an installable PWA plus optional Android and iOS shells with Share/Open with collection imports.
• Backups - SQLite-safe local backups, Google Drive or S3-compatible (including Cloudflare R2) cloud backups on a CRON schedule, and automatic pre-migration snapshots.

Quick Start

For a localhost-only trial with auth disabled:

mkdir -p data

docker run --rm \
  -p 4000:4000 \
  -v "$PWD/data:/data" \
  -e SECRET_KEY_BASE="$(openssl rand -base64 48)" \
  -e MANAVAULT_AUTH_DISABLED=true \
  -e PHX_HOST=localhost \
  ghcr.io/cfbender/manavault:1.4.3

Visit http://localhost:4000. The first boot downloads the Scryfall catalog in the background; card search and import matching work once that sync finishes (Settings -> Server logs reports when it completes).

Self-Hosting

For anything reachable beyond localhost, enable built-in auth. Generate a Phoenix secret and an owner password hash from a source checkout:

mise exec -- mix phx.gen.secret
mise exec -- mix manavault.auth.hash 'your-password'

Then run the published image with Docker Compose:

services:
  manavault:
    image: ghcr.io/cfbender/manavault:1.4.3
    container_name: manavault
    restart: unless-stopped
    ports:
      - "4000:4000"
    volumes:
      - ./data:/data
    environment:
      SECRET_KEY_BASE: ${SECRET_KEY_BASE}
      MANAVAULT_ADMIN_PASSWORD_HASH: ${MANAVAULT_ADMIN_PASSWORD_HASH}
      PHX_HOST: vault.example.com
      # Behind an HTTPS reverse proxy you control:
      MANAVAULT_SECURE_COOKIES: "true"
      MANAVAULT_TRUST_PROXY_HEADERS: "true"

Keep SECRET_KEY_BASE stable and saved somewhere safe: it signs sessions and encrypts stored secrets (AI and cloud backup credentials), so changing it means re-entering those secrets.

The self-hosting guide covers the full environment variable list, reverse proxies, data layout, and building your own image. If the same instance is reached under more than one hostname, list the extra origins in MANAVAULT_ALLOWED_ORIGINS so live updates keep working on each of them; see Serving more than one hostname.

Operating

• Health check - GET /health returns {"status":"ok"}; the image ships a Docker healthcheck.

• Upgrade - pull a newer tag and recreate the container. Pending migrations run on boot after an automatic pre-migration backup. See Upgrading.

• Back up - schedule cloud backups in Settings -> Cloud backups, copy the stopped data/ directory, or create a zip in the running container:

  docker exec manavault /app/bin/manavault rpc 'Manavault.Backup.create!()'

  See Manual backups.

• Restore - stop the container and run mix manavault.restore from a checkout, or stage a cloud restore in Settings and restart. See Restore.

• Card data - the Scryfall catalog and symbols refresh daily and vendor prices every 30 minutes; force a reload from Settings -> Scryfall data. See stalled syncs.

• Logs - Settings -> Server logs streams live output, and docker logs manavault shows the same.

• Locked out - clear permanent login bans in the running container; see login bans:

  docker exec manavault /app/bin/manavault rpc 'Manavault.Auth.AttemptLimiter.reset_all()'

• Scanner models - downloaded from GitHub releases at startup and every six hours; see scanner.md.

Documentation

• Feature reference - concepts and product-area behavior.
• Self-hosting - Docker, data layout, auth, reverse proxies, environment variables, backups, restores, and upgrades.
• Card scanner - scanner models, updates, training data, and the browser pipeline.
• Improving card recognition - train, test, and contribute data for the scanner's models (in Oracle).
• Personal API - create read-only API keys and list decks for integrations such as The Gathering.
• Android builds - official APK behavior, Share/Open with imports, custom domains, App Links, and release signing.
• Development - local setup, tests, codegen, and native shell commands.
• Releasing - changelog, version bump, tag, container, and APK release flow.
• Changelog

Development

Tool versions are pinned in mise.toml:

mise run setup   # toolchain, dependencies, database, assets
mise run dev     # Phoenix with Vite watcher on http://localhost:4000
mise run test

See development.md for the full workflow.

Tech Stack

Phoenix, Absinthe GraphQL, Ecto/SQLite, Oban, Vite, React, TanStack Router/Query, Tailwind/DaisyUI styling, onnxruntime-web for the scanner, and optional Capacitor native shells.

License

Mozilla Public License 2.0.