Server configuration reference

Environment defaults

These values apply to the documented server release. Saved System settings take precedence where supported. Confirm release-specific changes before upgrading, and store secrets in your deployment's protected environment management.

Variable	Default	Meaning
VOTPORT_ADMIN_PASSWORD	—	Admin password (hashed with argon2id at startup). Required unless the hash is set. At least 12 characters; a shorter one refuses to start, because this is the credential that still works when the identity provider does not.
VOTPORT_ADMIN_PASSWORD_HASH	—	Argon2 PHC string; takes precedence over the plain password.
VOTPORT_PUBLIC_URL	—	Public https URL; used for generated links and to mark cookies Secure.
VOTPORT_BIND	0.0.0.0:8080	Listen address inside the container.
VOTPORT_PUSH_BIND	off	UDP address for native VOT pushes. Setting it enables the listener; leave unset to keep native push disabled.
VOTPORT_PUSH_ADVERTISE	derived	host:port that native senders dial. Defaults to the host in VOTPORT_PUBLIC_URL and the push bind port. Set it when the public UDP address differs.
VOTPORT_SERVE_BIND	unset	UDP address for serving Deliver grants to VOT clients over QUIC; off when unset. Same certificate and issuer key as push.
VOTPORT_SERVE_ADVERTISE	derived	host:port that VOT fetch clients dial, on the same rules as VOTPORT_PUSH_ADVERTISE.
VOTPORT_PUSH_CERT / VOTPORT_PUSH_KEY	generated	PEM certificate and private key for native push. Set both together to use those paths in place, or leave both unset for a persistent self-signed pair under VOTPORT_DATA_DIR.
VOTPORT_DATA_DIR	/data	State: votport.db (links, upload records; legacy state.json is imported once) and the cookie secret.
VOTPORT_RECEIVE_DIR	/received	Root folder received files are published into.
VOTPORT_OUTBOUND_DIR	/outbound	Root folder for server-rendered projects and files uploaded by admins for outbound links. Nested project subdirectories are allowed.
VOTPORT_MAX_UPLOAD_BYTES	50 GiB	Hard cap per upload session (per-link caps can be lower). Accepts plain bytes or a K/KiB/KB, M/MiB/MB, G/GiB/GB, T/TiB/TB suffix, e.g. 500G.
VOTPORT_ALLOW_HIDDEN	off	Set 1 to accept dot-file names from uploaders.
VOTPORT_SESSION_IDLE_SECS	1800	Idle time before an unfinished upload session is discarded.
VOTPORT_WEB_ROOT	./web	Static assets directory (/app/web in Docker).
VOTPORT_NOTIFY_WEBHOOK_URL	—	POSTed a JSON summary (event, label, upload_id, total_bytes, files) when an upload completes.
VOTPORT_NOTIFY_NTFY_URL	—	Full ntfy topic URL (e.g. https://ntfy.sh/mytopic) sent a message per completed upload.
VOTPORT_NOTIFY_NTFY_TOKEN	—	Bearer token for the ntfy topic, if it needs one.
VOTPORT_NOTIFY_PUSHOVER_TOKEN	—	Pushover application token (set together with the user key).
VOTPORT_NOTIFY_PUSHOVER_USER	—	Pushover application token (set together with the user key).
VOTPORT_NOTIFY_SMTP_HOST	—	SMTP host. The channel is inert unless host, from, and at least one to all resolve.
VOTPORT_NOTIFY_SMTP_PORT	587	SMTP port. Port 465 uses implicit TLS.
VOTPORT_NOTIFY_SMTP_STARTTLS	on	SMTP STARTTLS. Off only when 0. Port 465 uses implicit TLS regardless.
VOTPORT_NOTIFY_SMTP_USERNAME	—	Optional SMTP AUTH username.
VOTPORT_NOTIFY_SMTP_PASSWORD	—	Optional SMTP AUTH password.
VOTPORT_SCIM_TOKEN	—	Bearer for the SCIM 2.0 provisioning endpoint at /scim/v2; unset disables it. Overridable via PUT /api/admin/settings.
VOTPORT_REPLICA_TOKEN	—	Bearer a standby presents to GET /api/replica; unset disables it. Overridable via PUT /api/admin/settings.
VOTPORT_STANDBY_SOURCE	—	votport standby only: the live instance's https URL to pull replicas from.
VOTPORT_STANDBY_INTERVAL_SECS	60	votport standby only: seconds between pulls; the RPO.
VOTPORT_SCIM_REQUIRE_PROVISIONING	0	1 refuses SSO sign-in for subjects with no principal row. Overridable via PUT /api/admin/settings.
VOTPORT_OIDC_SUBJECT_CLAIM	sub	Id-token claim used as the principal subject: sub, email, or preferred_username. Must match the SCIM userName mapping.
VOTPORT_NOTIFY_SMTP_FROM	—	SMTP From address (required with host and to).
VOTPORT_NOTIFY_SMTP_TO	—	Comma-separated SMTP recipients (at least one required with host and from).
VOTPORT_AUDIT_RETENTION_DAYS	400	Days to keep queryable audit rows; 0 disables pruning. Overridable via PUT /api/admin/settings.
VOTPORT_UPLOAD_RETENTION_DAYS	off	Days to keep received files and their records; a daily sweep deletes expired content and audits it. 0 (default) keeps everything. Overridable via PUT /api/admin/settings.
VOTPORT_DEFAULT_MAX_TOTAL_BYTES	unlimited	Fills a new tenant's byte quota when the request omits it, and caps received bytes on the unnamed default tenant. Named tenants keep the quota on their row.
VOTPORT_DEFAULT_MAX_LINKS	unlimited	Same overlay for max links (new tenants when omitted, and the unnamed default tenant).
VOTPORT_DEFAULT_MAX_SESSIONS	unlimited	Same overlay for max concurrent sessions.
VOTPORT_PUBLIC_PASSWORD_LOGIN	on	Set 0 to prefer collapsing the local password form when SSO is offered (login API stays available).
VOTPORT_METRICS_TOKEN	—	When set, GET /metrics requires this bearer token. Counts only; scrape over an internal interface.
VOTPORT_TRUSTED_PROXIES	loopback + private ranges	Comma-separated CIDR blocks (or bare addresses) whose X-Forwarded-For is believed. Anything else is keyed on its socket address. The default trusts any loopback or RFC1918/ULA peer, which is broad: on a shared container network or a LAN bind, anything that can reach the port can pick its own throttle bucket. Name your reverse proxy to close that; see trusted proxy configuration.
VOTPORT_OIDC_ISSUER	—	OIDC issuer URL for admin single sign-on. Requires the client id/secret and VOTPORT_PUBLIC_URL; see sign-in configuration.
VOTPORT_OIDC_CLIENT_ID	—	OAuth client id at the identity provider.
VOTPORT_OIDC_CLIENT_SECRET	—	OAuth client secret at the identity provider.
VOTPORT_OIDC_ADMIN_GROUP	—	Group whose members sign in as admins. Unset means every principal your provider authenticates gets admin.

Operational settings

The System page also manages scheduled backups, replica access, and sign-in settings. Use backup and restore, access configuration, and notifications and retention for their workflows.

Notification delivery is best-effort: a notification failure is logged and does not change the transfer outcome.