Configuration reference

Every setting is an environment variable, read at startup. Set them in your .env. This page lists them by purpose with their defaults.

Core and storage

Variable	Default	Role
ANON_DB_KEY	required	Encryption key for data at rest (the anonymization mapping and linked accounts). Back it up in a vault. If it is lost or changed on an instance that already holds data, the mapping becomes unreadable.
ANON_LANGUAGE	fr	Default detection language (fr or en).
ANON_DATA_DIR	./data	Data directory (SQLite database, encrypted mapping, linked accounts). Mount it as a volume.
ANON_DB_PATH	./data/conversations.db	SQLite database path.
ANON_PORT	8500	Host port exposed by the container (set in the compose file).

Authentication

Variable	Default	Role
AUTH_BACKEND	local	local or ldap.
WEBAPP_USERS	empty	Bootstrap local accounts, format user:password,user2:password2. The first account created becomes admin.
WEBAPP_USER / WEBAPP_PASSWORD	admin / admin	Single-account fallback for a first boot. Change it.
LDAP_SERVER, LDAP_BASE_DN, LDAP_SEARCH_FILTER, LDAP_BIND_DN, LDAP_BIND_PASSWORD, LDAP_USE_SSL, LDAP_USER_DN_TEMPLATE, LDAP_REQUIRE_GROUP_DN	empty	LDAP or Active Directory settings, used when AUTH_BACKEND=ldap. See the install guide.

Licensing (commercial edition)

Variable	Default	Role
LICENSE_KEY	empty	The signed license token. Required for the commercial edition.
LICENSE_SERVER_URL	empty	License server for periodic validation and revocation. Leave empty only for a fully air-gapped instance.
LICENSE_PHONE_HOME_INTERVAL	86400	Seconds between license checks.
LICENSE_GRACE_PERIOD_DAYS	14	Network grace after the last successful check before an activated instance suspends.
LICENSE_NO_LICENSE_GRACE_DAYS	15	Grace before an instance with no license suspends.

API keys and rate limiting

Variable	Default	Role
API_KEY_DAILY_QUOTA	500	Calls per API key per day. 0 means unlimited.
RATE_LIMIT_ENABLED	true	Application rate limiting.
RATE_LIMIT_DEFAULT_PER_MIN	150	Default requests per minute per client.
RATE_LIMIT_AUTH_PER_MIN	10	Requests per minute on the login path.
RATE_LIMIT_LLM_PER_MIN	40	Requests per minute on model calls.
LOGIN_IP_MAX_ATTEMPTS	20	Failed logins per IP before lockout.
COOKIE_SECURE	true	Session cookie sent over HTTPS only, and the signal that enables HSTS. Set to false only for local HTTP testing.

Files and OCR

Variable	Default	Role
FILE_UPLOAD_MAX_BYTES	20971520	Maximum upload size (20 MB).
FILE_OCR_MAX_PAGES	30	Maximum pages processed by OCR per document.
FILE_OCR_MAX_WORKERS	min(8, CPUs)	OCR parallelism.

Caching

Variable	Default	Role
MODELS_CACHE_TTL	1800	Seconds the live model catalog is cached.
EXT_ANON_CACHE_TTL	3600	Seconds an anonymization session is cached for the extension and API.
EXT_ANON_CACHE_MAX	200	Maximum cached sessions.