Configuration reference

Dieser Inhalt ist noch nicht in deiner Sprache verfügbar.

Kept is configured with environment variables. An environment variable always beats the same setting in the admin screens, which then shows it as locked. kept admin config prints this same table from the server you are running, so it always matches your version.

The Compose file passes the common ones through from .env; the rest go in a compose.override.yaml next to it.

Variable	Default	Notes
`KEPT_DATABASE_URL`		`kept_app` login (required)
`KEPT_AUTH_DATABASE_URL`		`kept_auth` login (required)
`KEPT_SYSTEM_DATABASE_URL`		`kept_system` login (required: workers, and the setup code at web boot)
`KEPT_OWNER_DATABASE_URL`		for `kept migrate` / `kept admin`, and on a worker with a backup target (the dump runs as kept_owner)
`KEPT_SECRET_KEY`		generated on first boot if unset (D193); set both or neither; see §7.3
`KEPT_AUTH_SECRET`		generated on first boot if unset (D193); set both or neither; see §7.3
`KEPT_SECRET_KEY_VERSION`		the version of `KEPT_SECRET_KEY`: `1` when unset; `kept admin rotate-key` says what to set (§7.3)
`KEPT_SECRET_KEYS_RETIRED`		earlier `KEPT_SECRET_KEY` versions, still needed to open values and backups sealed before a rotation: comma-separated `version:key` pairs; never logged
`KEPT_PUBLIC_URL`		required; source of truth for links and QR codes
`KEPT_ROLE`	`all`	`all` · `web` · `worker`
`KEPT_STORAGE`	`local`	`local` · `s3` (+ `KEPT_S3_*`)
`KEPT_SMTP_URL`		optional; `smtp://` or `smtps://`, with credentials if needed; unset, mail is only logged as due
`KEPT_SMTP_FROM`		the From of every mail; default `Kept <no-reply@<KEPT_PUBLIC_URL host>>`
`KEPT_LOG_LEVEL`	`info`	pino log level
`KEPT_LOG_FORMAT`	`json`	`pretty` for `docker logs`
`KEPT_SOURCE_URL`		the image’s OCI `source` + `revision` labels; forks override it (D147)
`KEPT_SETUP_CODE`		generated; app stores may preset it (D107); 6 Crockford base32 characters
`KEPT_SIGNUP_OPEN`		`true` · `false`; when set, locks sign-up open or closed and the admin setting shows as locked
`KEPT_CONFIG_DIR`	`/config`	config volume; holds only the generated secret keys
`KEPT_DATA_DIR`	`/data`	data volume; local file storage
`KEPT_MAX_FILE_MB`	`25`	largest file one upload may be, in MB (§3.4)
`KEPT_IMAGE_CONCURRENCY`		images resized at once, process-wide; default 1 with under 3 GB of RAM, else 2
`KEPT_S3_ENDPOINT`		S3 endpoint URL; empty for AWS itself (e.g. `http://rustfs:9000`)
`KEPT_S3_PUBLIC_ENDPOINT`		S3 endpoint the browser reaches, for presigned URLs; empty: `KEPT_S3_ENDPOINT` (e.g. `https://files.example.com`)
`KEPT_S3_REGION`	`us-east-1`	S3 region
`KEPT_S3_BUCKET`		S3 bucket (required with `KEPT_STORAGE=s3`)
`KEPT_S3_ACCESS_KEY_ID`		S3 access key id (required with `KEPT_STORAGE=s3`)
`KEPT_S3_SECRET_ACCESS_KEY`		S3 secret access key (required with `KEPT_STORAGE=s3`); never logged
`KEPT_S3_FORCE_PATH_STYLE`		`true` for path-style URLs (RustFS, MinIO, most self-hosted S3)
`KEPT_TRUSTED_PROXIES`		comma-separated IPs/CIDRs of reverse proxies whose `X-Forwarded-For` is believed; empty: the socket address is the client
`KEPT_METRICS_TOKEN`		optional bearer token required to read `/metrics`
`OTEL_EXPORTER_OTLP_ENDPOINT`		optional; your OpenTelemetry collector (OTLP over HTTP): traces requests and queries there, with the image’s `--import` preload; the other `OTEL_*` variables apply; unset, nothing is loaded or sent (D84)
`KEPT_ERROR_DSN`		optional; a Sentry-compatible DSN: a request that fails with a 5xx is reported with its request id, route and stack, never a body, header, message or user; unset, nothing is sent (D84)
`KEPT_AI_MOCK`		`1`: every AI call answers from the mock provider (tests, dev); refused in production
`KEPT_BARCODE_LOOKUP`		`true` · `false`; when set, locks barcode lookup (Open*Facts) on or off and the admin setting shows as locked
`KEPT_BARCODE_CONTACT`		an email for the barcode lookup’s User-Agent, as Open*Facts asks (D104)
`KEPT_EVAL_DIR`		the extraction evaluation only (`pnpm eval:extraction`): the folder of labelled photos
`KEPT_BACKUP_DIR`		nightly backup to this directory: an absolute path outside `KEPT_DATA_DIR`, ideally another disk; the worker also needs `KEPT_OWNER_DATABASE_URL`
`KEPT_BACKUP_S3_BUCKET`		nightly backup to this S3 bucket instead of a directory (+ `KEPT_BACKUP_S3_*`); the worker also needs `KEPT_OWNER_DATABASE_URL`
`KEPT_BACKUP_S3_PREFIX`	`kept-backups/`	where in the backup bucket the backups go
`KEPT_BACKUP_S3_ENDPOINT`		the backup bucket’s S3 endpoint; empty for AWS itself
`KEPT_BACKUP_S3_REGION`	`us-east-1`	the backup bucket’s region
`KEPT_BACKUP_S3_ACCESS_KEY_ID`		access key id for the backup bucket (required with `KEPT_BACKUP_S3_BUCKET`)
`KEPT_BACKUP_S3_SECRET_ACCESS_KEY`		secret access key for the backup bucket (required with `KEPT_BACKUP_S3_BUCKET`); never logged
`KEPT_BACKUP_S3_FORCE_PATH_STYLE`		`true` for path-style URLs (RustFS, MinIO, most self-hosted S3)
`KEPT_BACKUP_KEEP`	`7`	how many backups are kept; older ones, and the files only they held, are removed
`KEPT_BACKUP_TIME`	`02:30`	when the nightly backup starts, `HH:MM` in UTC
`KEPT_BACKUP_PASSWORD`		the backup repository’s password, at least 12 characters; set, it locks the password in Admin → Backups; never logged (no password, no backup)
`KEPT_BACKUP_SFTP`		nightly backup over SFTP instead of a directory or a bucket: the repository location in restic’s `sftp:` syntax (+ `KEPT_BACKUP_SFTP_KEY_FILE`, `KEPT_BACKUP_SFTP_KNOWN_HOSTS`)
`KEPT_BACKUP_SFTP_KEY_FILE`		the SFTP private key file, an absolute path (required with `KEPT_BACKUP_SFTP`)
`KEPT_BACKUP_SFTP_KNOWN_HOSTS`		a known_hosts file holding the SFTP server’s pinned host key, an absolute path (required with `KEPT_BACKUP_SFTP`)
`KEPT_BACKUP_KEEP_DAILY`		retention: the newest backup of each of the last N days; default 7 (D66); set, it locks the field
`KEPT_BACKUP_KEEP_WEEKLY`		retention: the newest backup of each of the last N weeks; default 4 (D66); set, it locks the field
`KEPT_BACKUP_KEEP_MONTHLY`		retention: the newest backup of each of the last N months; default 6 (D66); set, it locks the field
`KEPT_RESTIC_BIN`		the restic binary; default the image’s pinned one, else `restic` on `PATH`
`KEPT_RESTIC_CACHE_DIR`		restic’s cache, never backed up; default `<KEPT_DATA_DIR>/.cache/restic`
`KEPT_UPDATE_CHECK`		`true` · `false`; when set, locks “Check for new versions” (GitHub releases, off by default, D65) on or off
`KEPT_PORT`	`8080`	the port the server listens on
`KEPT_ALLOW_DOWNGRADE`		`1`: start on a database more than one release ahead of this image, audited; for a restore runbook only (plan Q9)
`KEPT_UPGRADE_SNAPSHOT`	`auto`	`auto` · `off`: whether `kept migrate` takes a database snapshot before migrating a populated database (plan Q8)
`KEPT_VAPID_PUBLIC_KEY`		web push: overrides the generated key pair; set both or neither
`KEPT_VAPID_PRIVATE_KEY`		web push: the private half of `KEPT_VAPID_PUBLIC_KEY`; never logged
`KEPT_VAPID_SUBJECT`		web push: who push services contact, an `https:` URL or `mailto:` address; default `KEPT_PUBLIC_URL` when https, else `mailto:` the `KEPT_SMTP_FROM` address, else push is unavailable
`KEPT_EMBEDDINGS`	`provider`	`provider` · `local` · `off`: where search’s embeddings come from; `local` is refused unless the local model’s runtime is installed (D207)
`KEPT_EMBEDDINGS_DIR`		the local embedding model’s files, only read when `KEPT_EMBEDDINGS=local`; default `<KEPT_DATA_DIR>/models`
`KEPT_OIDC_ISSUER`		OIDC sign-in: the issuer URL exactly as its discovery document states it; set, OIDC is on (needs `KEPT_OIDC_CLIENT_ID`)
`KEPT_OIDC_CLIENT_ID`		OIDC sign-in: the client id
`KEPT_OIDC_CLIENT_SECRET`		OIDC sign-in: the client secret (a confidential client); never logged
`KEPT_OIDC_NAME`	`OIDC`	OIDC sign-in: the provider’s name on “Sign in with <name>”
`KEPT_OIDC_AUTOPROVISION_DOMAINS`		OIDC sign-in: comma-separated email domains (exact, no subdomains) whose people get an account on first sign-in; empty: invite only
`KEPT_OIDC_AUTOPROVISION_GROUPS`		OIDC sign-in: comma-separated groups (exact) whose members get an account on first sign-in; empty: invite only
`KEPT_OIDC_GROUPS_CLAIM`	`groups`	OIDC sign-in: the ID token claim holding the groups
`KEPT_OIDC_SCOPES`	`openid email profile`	OIDC sign-in: the scopes asked for, space-separated
`KEPT_GOOGLE_CLIENT_ID`		Google sign-in: the OAuth client id from Google Cloud; set with the secret, Google sign-in is on (invite only, never autoprovision)
`KEPT_GOOGLE_CLIENT_SECRET`		Google sign-in: the OAuth client secret; never logged
`KEPT_APPRISE_URL`		Apprise channels: the Apprise API server, e.g. `http://apprise:8000`; unset, people can’t add Apprise channels