# OpenTodo configuration. Every variable is optional; the defaults run out of the box.
# Copy to .env next to docker-compose.yml. Coolify fills SERVICE_URL_OPENTODO itself.

# Public URL the app is served from. Used for the Secure cookie flag and the
# Origin check on state-changing requests. Leave empty to infer from requests.
OPENTODO_BASE_URL=

# Host port to publish when running plain docker compose (Coolify ignores ports:).
OPENTODO_PORT=8080
# Host address the port is published on. Default 0.0.0.0: every interface, so other
# devices on your network reach it (a NAS or home server at http://192.168.x.y:8080).
# Behind a reverse proxy on this machine, 127.0.0.1 is the safer choice: only the
# proxy and this machine reach the server.
# OPENTODO_BIND=127.0.0.1

# Allow anyone who can reach the server to create an account.
# The first account is always allowed (that is the owner); after that this
# flag decides. Keep false unless the instance is private.
OPENTODO_ALLOW_SIGNUP=false
# When set (16+ characters), creating the first account requires this token.
# OPENTODO_SETUP_TOKEN=

# Session lifetime in days.
OPENTODO_SESSION_DAYS=90

# Preset the owner's "allow private network targets" webhook policy on first start
# (for receivers such as Home Assistant or n8n on your LAN). Afterwards the
# toggle in Settings -> Webhooks wins. Leave empty to decide in the app.
OPENTODO_WEBHOOKS_ALLOW_PRIVATE=

# Preset the owner's "AI assistants (MCP endpoint)" toggle on first start
# (true/false). The read-only /mcp endpoint is off by default; afterwards the
# toggle in Settings -> AI assistants wins. See docs/mcp.md.
OPENTODO_MCP=

# Preset the owner's "Calendar apps (CalDAV)" toggle on first start (true/false).
# The /dav/ endpoint is off by default; afterwards the toggle in
# Settings -> Calendar apps wins. See docs/caldav.md.
OPENTODO_CALDAV=

# Web push for reminders (on by default, nothing to configure: the key pair is
# generated in the data directory on first use). "off" disables the push routes
# and the scheduler, so the server never contacts a push service; reminders are
# then shown in the app only.
OPENTODO_PUSH=

# Public demo instance (true/false, off when empty): seeds a shared demo
# account shown on the sign-in screen, wipes and reseeds it every night at
# 03:00 UTC and refuses sign-up, integrations and account changes. Use a
# dedicated, empty data directory. See docs/self-hosting/demo.md.
OPENTODO_DEMO=

# Host mode (multi-tenant-host): one process serves many tenants by host name,
# for operators of a hosted service. Off when OPENTODO_HOST_URL is empty; then
# OPENTODO_HOST_TOKEN (32+ characters) authenticates the operator interface on
# OPENTODO_HOST_OPERATOR_ADDR (default 127.0.0.1:8081). See docs/self-hosting/host-mode.md.
OPENTODO_HOST_URL=
OPENTODO_HOST_TOKEN=
OPENTODO_HOST_OPERATOR_ADDR=
# Minutes before an idle tenant closes (default 10), most tenants open at once
# (default 500), and default limits such as db_mb=500,ops_per_hour=5000,members=10.
OPENTODO_HOST_IDLE_MINUTES=
OPENTODO_HOST_MAX_OPEN=
OPENTODO_HOST_LIMITS=

# Log level: debug, info, warn, error
OPENTODO_LOG_LEVEL=info

# Largest import file in MB (1-200). Lower it on very small hosts.
OPENTODO_IMPORT_MAX_MB=20

# Days a deleted task or project stays in the Trash before the server purges it
# for good (default 30). 0 keeps the Trash until it is emptied by hand.
OPENTODO_TRASH_RETENTION_DAYS=

# Single sign-on with an OpenID Connect provider is configured by the owner in
# Settings -> Single sign-on. These optional variables override and lock those
# fields instead (see docs/self-hosting/sso.md). Leave unset to use the UI.
# The server contacts the issuer only when one is configured.
# OPENTODO_OIDC_ISSUER=https://sso.example.com/realms/home
# OPENTODO_OIDC_CLIENT_ID=opentodo
# OPENTODO_OIDC_CLIENT_SECRET=
# OPENTODO_OIDC_DISPLAY_NAME=Home SSO
# Emergency switch: false turns SSO-only mode off whatever Settings says.
# OPENTODO_OIDC_SSO_ONLY=

# Email to task (docs/email.md): optional. Set ADDRESS, IMAP_HOST, IMAP_USER and
# IMAP_PASSWORD (or IMAP_PASSWORD_FILE) together to have OpenTodo read one
# mailbox over IMAP (TLS) and turn mail to todo+<secret>@example.com into tasks.
# Setting only some of them stops startup. The server connects only to this host.
# OPENTODO_EMAIL_ADDRESS=todo@example.com
# OPENTODO_EMAIL_IMAP_HOST=imap.example.com:993
# OPENTODO_EMAIL_IMAP_USER=todo@example.com
# OPENTODO_EMAIL_IMAP_PASSWORD=
# OPENTODO_EMAIL_IMAP_PASSWORD_FILE=/run/secrets/opentodo_imap_password
# OPENTODO_EMAIL_IMAP_MAILBOX=INBOX
# OPENTODO_EMAIL_POLL_SECONDS=60
# OPENTODO_EMAIL_PROCESSED=move:OpenTodo/Processed   # or: delete

# Scheduled backups are configured by the owner in Settings → Backups. These
# optional presets seed those settings once, on first start; afterwards the
# Settings screen wins. See docs/backups.md. Leave unset to configure in the UI.
# OPENTODO_BACKUP_DESTINATION=local        # local | s3 | webdav
# OPENTODO_BACKUP_SCHEDULE=daily           # off | hourly | daily | weekly
# OPENTODO_BACKUP_TIME=03:00
# OPENTODO_BACKUP_KEEP=7
# OPENTODO_BACKUP_S3_ENDPOINT=https://s3.eu-central-1.amazonaws.com
# OPENTODO_BACKUP_S3_REGION=eu-central-1
# OPENTODO_BACKUP_S3_BUCKET=
# OPENTODO_BACKUP_S3_ACCESS_KEY=
# OPENTODO_BACKUP_S3_SECRET_KEY=
# OPENTODO_BACKUP_PASSPHRASE_FILE=/run/secrets/opentodo_backup_passphrase
# Also available: OPENTODO_BACKUP_WEEKDAY (0-6 or a day name), _MAX_AGE_DAYS,
# _COMPRESS, _LOCAL_DIR, _S3_PREFIX, _S3_PATH_STYLE, _WEBDAV_URL,
# _WEBDAV_USERNAME, _WEBDAV_PASSWORD, _WEBDAV_ALLOW_HTTP, _PASSPHRASE.