Environment Variables

Name of the database that PostgreSQL creates on the first start. Freely selectable. It is only evaluated when the data directory is created.

Database user, created on the first start and superuser of the database.

Password of the database user. Choose a strong, random password and do not leave the example value change-me in place. The password is only set when the data directory is created. To change it in an existing database you need an ALTER USER in PostgreSQL.

Connection string through which FediSuite reaches the database. Format: postgresql://USER:PASSWORD@HOST:PORT/DATABASE. The host is db, which is the name of the database container in the Docker network. User, password and database name must match the POSTGRES_* values. Special characters in the password (for example @, / or :) have to be URL-encoded. The easiest choice is a password made of letters and digits.

The full public URL of your instance, with https:// and without a trailing slash. FediSuite builds links in emails and the OAuth return address (APP_URL/api/auth/fediverse/callback) from it. If it does not match the real domain, connecting accounts fails. Without a value http://localhost:3000 applies.

Secret key with which FediSuite signs login tokens. It also encrypts the stored two-factor secrets and the secret for the instance directory. Anyone who knows it can forge tokens, so it has to be long, random and secret. FediSuite does not require a minimum length, but the process does not start without a value. Do not change it after the first start: all logins become invalid and stored two-factor secrets can no longer be decrypted.

openssl rand -hex 64

Separate 32-byte key for encrypting access tokens and client secrets of connected Fediverse accounts. It must contain exactly 64 hexadecimal characters, be distinct from JWT_SECRET, and have the same value in the app and workers. Generate it once with openssl rand -hex 32, add it to .env, and keep a separate encrypted backup. Existing credentials are migrated on first start with 2.0. A missing, invalid, or wrong key prevents startup or decryption; never change it after migration.

Display name of the instance, for example in emails and in the default user agent. Default: FediSuite.

Public address of the instance for the default user agent and the entry in the instance directory. Default: the value of APP_URL. In most cases you can leave it out or set it to the same value as APP_URL.

Hostname of the SMTP server of your email provider. Without a value FediSuite uses localhost.

Port of the SMTP server. On 465 FediSuite uses TLS right away. On any other port, for example 587, the connection is encrypted with STARTTLS if the server offers it. Without a value 1025 applies.

User name for SMTP authentication, often the sender address.

Password for SMTP authentication. Some providers require a dedicated app password instead of the account password.

Sender address of the emails. It usually has to match the domain of your SMTP account, otherwise receiving servers reject the mails. Without a value FediSuite uses "APP_NAME" <no-reply@HOST> with the host from APP_URL.

Controls whether new users can sign up through the registration page. The default is true (open). For a private instance set it to false.

User-Agent header for all outgoing HTTP requests, for example to Fediverse servers. Default: Mozilla/5.0 (compatible; APP_NAME/1.0; +PUBLIC_SITE_URL). With a reachable URL in the header, operators of other instances can contact you if there are problems.

OUTBOUND_HTTP_USER_AGENT=Mozilla/5.0 (compatible; FediSuite/1.0; +https://your-domain.com)

Number of trusted reverse-proxy hops used to determine the client IP for rate limits, audit logs and sessions. Set 0 if port 3000 is directly reachable without a proxy; set 1 behind exactly one trusted proxy such as Traefik. The server also accepts false, true or a comma-separated list of trusted addresses/subnets. Avoid true when clients can connect directly: they could forge their IP in forwarding headers.

By default FediSuite refuses connections into private networks (loopback, private address ranges, link-local addresses such as the cloud metadata service). The check runs on every connection, including redirects. Set true only if a connected instance runs in your own network, for example a test instance next to the server. On servers that only connect to public instances leave the variable unset.

General time limit in milliseconds for outgoing HTTP requests (at least 1000). Individual jobs such as the reach calculation set shorter limits of their own.

Drafts: posts without a time that the scheduler never publishes, with a stage (idea, in progress, ready) and a drafts tab on the posts page.

Content calendar: month and week view of posts with filters and moving by drag and drop.

Labels and campaigns: internal markers for posts that are never published or turned into hashtags.

Recycling: use archive posts as a new draft, the badge “Interesting again”, the evergreen collection and the warning about similar posts.

Content analysis: the “Content” tab in the analytics, hints in the composer and time window markers in the calendar.

Shows the Community analytics tab and enables its API. It analyses recorded interactions to distinguish interacting, new and returning accounts. Set to false to hide this feature; configure the lifetime of recorded interactions separately with ENGAGEMENT_RETENTION_DAYS.

Publishes due scheduled posts (every minute) and, if published, syncs the instance list. In the Compose file only on in worker1. Several schedulers would not post twice (every post is claimed atomically) but are redundant.

Regularly refreshes accounts and post numbers. Can run in several containers.

Works through the queue for the reach calculation. The Compose file does not set it, so it runs in every container.

Sends the one-time reminder to users who have not connected a Fediverse account after 48 hours. In the Compose file only on in worker1.

Generates the tips for connected accounts every six hours. Can run in several containers.

Unique name of the container, for example worker-1. It shows up in the logs and in locks and queues.

How many accounts a worker refreshes per pass (every 60 seconds), 1 to 50. The Compose file sets 5. Lower values go easier on the servers of the Fediverse instances, higher ones work through many accounts faster.

Switches the plugin system on or off. With false the plugin registry stays empty.

Scans the folder /app/plugins for plugins on start. With false the scan is skipped.

Plugin API version of the instance. Plugins declare in their plugin.json which version they run on. Leave the value at 1.

How many days interaction records from other Fediverse accounts are retained for Community analytics. An hourly cleanup removes older records in batches; shorter retention also shortens the available analysis history. Invalid values fall back to 730 days and out-of-range values are clamped. Choose a period appropriate for your privacy policy.

Older changelog entries mention this variable, but current images ignore it. The plugin directory is fixed at /app/plugins. Mount your plugin repository there in every app and worker container; use PLUGINS_ENABLED and PLUGIN_SCAN_ON_START to control loading.