"description":"Discard an unrecognized encrypted SQLite file and start fresh. Keep a recovery copy first. Leave unset to refuse startup and preserve the existing file."
"description":"Only used to open SQLite files encrypted by very old versions. You almost never need it."
},
{
"name":"DATABASE_LAYER_SKIP_PREUPGRADE_BACKUP",
"group":"database",
"default":"false",
"description":"Skip the backup Termix takes of the data folder before an upgrade changes the database."
},
{
"name":"DATABASE_LAYER_PREUPGRADE_BACKUP_KEEP",
"group":"database",
"default":"3",
"description":"How many of those upgrade backups to keep."
},
{
"name":"DRIZZLE_MIGRATIONS_DIR",
"group":"database",
"internal":true,
"description":"Where database migrations are read from. Set by the image."
},
{
"name":"JWT_SECRET",
"group":"secrets",
"secret":true,
"description":"Signs sign-in sessions. At least 64 characters. Made for you and saved in DATA_DIR/.env if not set. Also read from JWT_SECRET_FILE."
},
{
"name":"DATABASE_KEY",
"group":"secrets",
"secret":true,
"description":"Key for the encrypted SQLite file, 64 hex characters. Made for you if not set. Also read from DATABASE_KEY_FILE."
},
{
"name":"ENCRYPTION_KEY",
"group":"secrets",
"secret":true,
"description":"Wraps the data keys that encrypt passwords and SSH keys, 64 hex characters. Made for you if not set. Also read from ENCRYPTION_KEY_FILE."
},
{
"name":"INTERNAL_AUTH_TOKEN",
"group":"secrets",
"secret":true,
"description":"Token the server uses to call itself. Made for you if not set. Also read from INTERNAL_AUTH_TOKEN_FILE."
},
{
"name":"TERMIX_REQUIRE_EXTERNAL_SECRETS",
"group":"secrets",
"default":"false",
"description":"Refuse to start unless the four secrets above come from env vars or _FILE files, so none are written to disk."
},
{
"name":"OIDC_SYSTEM_SECRET",
"group":"secrets",
"secret":true,
"description":"Only read to move data from installs older than 2.5. Never change it on an install that has it."
},
{
"name":"WEBAUTHN_SYSTEM_SECRET",
"group":"secrets",
"secret":true,
"description":"Only read to move data from installs older than 2.5. Never change it on an install that has it."
},
{
"name":"ALLOW_PASSWORD_LOGIN",
"group":"auth",
"description":"true or false. Overrides the admin setting for signing in with a username and password."
},
{
"name":"ALLOW_REGISTRATION",
"group":"auth",
"description":"true or false. Overrides the admin setting for creating new accounts."
},
{
"name":"ALLOW_PASSWORD_RESET",
"group":"auth",
"description":"true or false. Overrides the admin setting for resetting a password from the sign in page."
},
{
"name":"EXTERNAL_ALLOW_REGISTRATION",
"group":"auth",
"description":"true or false. Overrides the admin setting for creating accounts the first time someone signs in with SSO or LDAP."
},
{
"name":"EXTERNAL_FORCE_HTTPS",
"group":"auth",
"default":"false",
"description":"Build sign in callback URLs with https even when the request came in over http. Use it behind a proxy that does not send X-Forwarded-Proto."
},
{
"name":"OIDC_ALLOW_REGISTRATION",
"group":"auth",
"deprecated":"EXTERNAL_ALLOW_REGISTRATION",
"description":"Old name for EXTERNAL_ALLOW_REGISTRATION. Still read in 26.10."
},
{
"name":"OIDC_FORCE_HTTPS",
"group":"auth",
"deprecated":"EXTERNAL_FORCE_HTTPS",
"description":"Old name for EXTERNAL_FORCE_HTTPS. Still read in 26.10."
},
{
"name":"OIDC_CLIENT_ID",
"group":"auth",
"internal":true,
"description":"Read by core only to move a 2.8 OIDC setup into the sso plugin. See the sso plugin for the real variables."
},
{
"name":"OIDC_ENV_OVERRIDE",
"group":"auth",
"internal":true,
"description":"Read by core only to move a 2.8 OIDC setup into the sso plugin. See the sso plugin for the real variables."
},
{
"name":"TRUSTED_PROXY_AUTH_ENABLED",
"group":"auth",
"default":"false",
"description":"Let a proxy like Authelia or Authentik sign people in by sending their username in a header."
},
{
"name":"TRUSTED_PROXY_AUTH_TRUSTED_PROXIES",
"group":"auth",
"description":"Comma separated IPs or CIDRs of the proxies allowed to send the headers. Required when trusted proxy login is on."
},
{
"name":"TRUSTED_PROXY_AUTH_USERNAME_HEADER",
"group":"auth",
"default":"x-forwarded-username",
"description":"Header that holds the username."
},
{
"name":"TRUSTED_PROXY_AUTH_ROLE_HEADER",
"group":"auth",
"default":"x-forwarded-role",
"description":"Header that holds the user's groups or roles."
},
{
"name":"TRUSTED_PROXY_AUTH_ROLE_MAP",
"group":"auth",
"description":"JSON map from proxy roles to Termix roles, like {\"admins\":[\"admin\"],\"staff\":[\"user\"]}. Required when trusted proxy login is on."
},
{
"name":"TRUSTED_PROXIES",
"group":"proxy",
"docker":true,
"description":"Comma separated IPs or CIDRs nginx takes the client IP from (X-Forwarded-For). Set it to your reverse proxy."
},
{
"name":"CORS_ALLOWED_ORIGINS",
"group":"proxy",
"description":"Comma separated extra origins allowed to call the API from a browser."
},
{
"name":"TERMIX_ALLOWED_ORIGINS",
"group":"proxy",
"description":"Comma separated extra origins allowed to open WebSockets."
"description":"Comma-separated host names or IP addresses that plugin registry downloads may reach on a private address, like a registry in your LAN. List bare hosts: entries with a scheme, port or path are ignored. Matched by name only, on any port, so only list names your own DNS answers for. With HTTPS_PROXY set, add them to NO_PROXY too."
"description":"Start only layout and theme plugins. Every other plugin stays off until a restart without it, so you can turn off a plugin that breaks the server or the app."
