# Host-side bind mount paths — set to wherever you store Docker data DATA_DB_PATH=/your/host/path/db DATA_UPLOADS_PATH=/your/host/path/uploads # Required if using user management — use a long random string, keep it secret # Generate one: openssl rand -base64 48 JWT_SECRET=change-me-to-a-long-random-secret # Or mount it as a Docker/Swarm secret: # JWT_SECRET_FILE=/run/secrets/notetrace_jwt_secret # Optional — At-rest encryption key for OIDC client secrets and webhook # secrets. Defaults to a key derived from JWT_SECRET, which means # rotating JWT_SECRET also invalidates every encrypted secret. Set # TOKEN_ENC_KEY explicitly if you want to rotate session tokens independently # of stored secrets. # Generate one: openssl rand -base64 48 # TOKEN_ENC_KEY=change-me-to-a-long-random-key # TOKEN_ENC_KEY_FILE=/run/secrets/notetrace_token_enc_key # Optional — Lockout recovery token # Required to use the "Disable user management" recovery option on the login page # Without this, the recovery endpoint is disabled for safety # RECOVERY_TOKEN=my-secret-recovery-phrase # RECOVERY_TOKEN_FILE=/run/secrets/notetrace_recovery_token # Optional — Mount the app at a path other than root (for reverse-proxy setups) # Example: BASE_URL=/notetrace will serve the app at https://example.com/notetrace/ # Default unset = served at root path. # BASE_URL=/notetrace # Optional: Sign in over plain HTTP (no TLS in front) # The sign-in cookie is HTTPS-only by default (marked Secure), so a browser # keeps it only on an https:// page (Chrome and Firefox also on # http://localhost). Opened at a plain http:// address (a LAN IP, an Unraid # WebUI link), signing in sends you straight back to the sign-in page: the # password was right, but the browser threw the cookie away. The sign-in and setup screens say so. Set this to 1 # to send the cookie over plain HTTP too. It then travels in cleartext, so # only do this on a trusted home network, and leave it unset (0) behind HTTPS # (a reverse proxy with TLS, Cloudflare Tunnel, Tailscale Serve). The Android # app signs in with a token, not this cookie. # More: https://traceapps.github.io/docs/getting-started/lan-http/ # INSECURE_COOKIES=1 # Optional — Log level (error | warn | info | debug) # Default: info — logs requests, warnings, and errors # Set to 'debug' for verbose sync and import output # LOG_LEVEL=info # Optional — SMTP email (for password reset & user invites) # If set, these override whatever is configured in the Settings UI AND lock those fields for all users # Without SMTP configured, invites fall back to a copyable link instead of email. # SMTP_HOST=smtp.example.com # SMTP_PORT=587 # SMTP_SECURE=false # true for port 465 (SSL), false for STARTTLS # SMTP_USER=you@example.com # SMTP_PASS=your-password # SMTP_FROM=NoteTrace # SMTP_PASS_FILE=/run/secrets/notetrace_smtp_pass # Optional — AI Assistant (shared key for all users) # If set, AI calls are proxied through the server (key never reaches the browser) # and the provider/model/key fields are locked in Settings for all users. # Supports every provider the app supports — cloud (claude / openai / gemini) # and OpenAI-compatible local endpoints (Ollama, LM Studio, LocalAI, vLLM, # DeepSeek, Groq, etc.). Set AI_PROVIDER=oai-compat + AI_BASE_URL + AI_MODEL # to point at a private-network LLM the browser can't reach directly (e.g. # a Docker Compose sidecar on an internal network). # AI_PROVIDER=claude # claude | openai | gemini | oai-compat # AI_API_KEY=sk-ant-... # required for cloud providers; optional for oai-compat # AI_API_KEY_FILE=/run/secrets/notetrace_ai_api_key # AI_MODEL=claude-haiku-4-5-20251001 # optional for cloud (defaults to provider's fast model); REQUIRED for oai-compat # AI_BASE_URL=http://ollama:11434 # REQUIRED when AI_PROVIDER=oai-compat; must be reachable from the server container # Optional: speech-to-text model for voice notes when Trace is set here. # Defaults: gpt-4o-mini-transcribe on OpenAI, whisper-1 on an OpenAI-compatible # server (Gemini uses AI_MODEL). Whisper-style models give timestamped transcripts. # AI_TRANSCRIBE_MODEL=whisper-1 # AI_ENABLED=true # optional, auto-enables the AI Assistant for all users # Optional — Scheduled auto-backup # When any of these are set, the Backup Schedule fields in Settings → # Backup are env-locked for admins (set policy in compose, not the UI). # BACKUP_SCHEDULE = off | daily | weekly | monthly # BACKUP_TIME = HH:MM in the container's timezone (default 02:00) # BACKUP_RETENTION = integer count of backups to keep (older auto-purged) # BACKUP_SCHEDULE=weekly # BACKUP_TIME=02:00 # BACKUP_RETENTION=8 # Optional — Cap the upload size for `Upload & Restore` of a full-backup ZIP # Default 1024 MB. Bump if you have an unusually large backup to restore. # BACKUP_UPLOAD_MAX_MB=1024 # Optional — Cap session length in hours. Default 8760 (1 year). Lower this # for shared / kiosk machines where you want shorter login sessions. # MAX_SESSION_HOURS=8760 # Optional — Override the listening port inside the container. Default 3004. # The docker-compose.yml maps host 3004 to container 3004; if you change this, # update the compose `ports:` mapping too. # PORT=3004 # Optional — OIDC Single Sign-On (declared in env instead of the Settings UI) # # Single-provider shorthand — `OIDC_*` is an alias for `OIDC_PROVIDER_1_*`: # OIDC_ISSUER=https://auth.example.com # OIDC_CLIENT_ID=notetrace # OIDC_CLIENT_SECRET=... # OIDC_DISPLAY_NAME=Authentik # OIDC_REDIRECT_URIS=https://notetrace.example.com/api/auth/oidc/callback/1 # comma-separated for multi # OIDC_SCOPE=openid profile email # OIDC_TOKEN_AUTH_METHOD=client_secret_post # or client_secret_basic | none # OIDC_ADMIN_GROUP_CLAIM=groups # OIDC_ADMIN_GROUP_VALUE=NoteTraceAdmins # OIDC_AUTO_LINK=1 # link verified-email to existing users (default 1) # OIDC_AUTO_REGISTER=0 # blanket signup on first SSO login (default 0) # OIDC_IS_ACTIVE=1 # # Multi-provider — use the numbered prefix: # OIDC_PROVIDER_2_ISSUER=https://other-idp.example.com # OIDC_PROVIDER_2_CLIENT_ID=... # OIDC_PROVIDER_2_CLIENT_SECRET=... # OIDC_PROVIDER_2_DISPLAY_NAME=Keycloak # # Env-defined providers show with a lock badge in Settings → Authentication → # OIDC providers and are read-only. Edit via .env / docker-compose / k8s # secrets. UI mutations on env-defined providers are refused server-side. # Optional: outgoing webhooks. Configure a target URL in Settings, # Webhooks and NoteTrace fires a signed HTTP POST when a note is # created, a checklist is fully checked off, or a reminder fires. Off by # default. See docs/webhooks.md. # WEBHOOKS_ENABLED=1 # Optional: allow a webhook target on a private or loopback address (a # same-Docker-network Home Assistant instance, for example). Off by # default; public-internet-facing installs should leave this off. # ALLOW_PRIVATE_WEBHOOK_URLS=1 # Send to CookTrace works with a CookTrace on your own network (a LAN IP, # localhost, a same-Docker-network container name) without any setting. # Optional: link previews on note cards are fetched by this server. Links to # private or loopback addresses (your LAN, localhost, Docker networks) get no # preview unless this is set. Off by default. # ALLOW_PRIVATE_LINK_PREVIEWS=1 # Optional: audio tools for converting voice recordings browsers can't play # (Google Keep's 3GP/AMR) and splitting long recordings for transcription. # The Docker image includes a small audio-only ffmpeg; set these only when # running the server outside Docker with ffmpeg somewhere else. # FFMPEG_PATH=/usr/bin/ffmpeg # FFPROBE_PATH=/usr/bin/ffprobe # ── Update checks ───────────────────────────────────────────────────────── # Off until you turn them on: setup asks, and Settings, Updates can change it. # When on, the server asks github.com for the latest release every few hours # and shows a banner when one is out. Nothing about you or your data is sent. # Set this to off to keep them off for good, whatever the setting says. # UPDATE_CHECK=off