--- title: Server configuration reference label: Configuration description: Environment defaults for storage, sign-in, limits, notifications, and native transfer listeners. layout: docs order: 147 --- ## Environment defaults These values apply to the documented server release. Saved System settings take precedence where supported. Confirm release-specific changes before upgrading, and store secrets in your deployment's protected environment management. | Variable | Default | Meaning | | ---------------------------------------- | ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `VOTPORT_ADMIN_PASSWORD` | — | Admin password (hashed with argon2id at startup). Required unless the hash is set. At least 12 characters; a shorter one refuses to start, because this is the credential that still works when the identity provider does not. | | `VOTPORT_ADMIN_PASSWORD_HASH` | — | Argon2 PHC string; takes precedence over the plain password. | | `VOTPORT_PUBLIC_URL` | — | Public https URL; used for generated links and to mark cookies `Secure`. | | `VOTPORT_BIND` | `0.0.0.0:8080` | Listen address inside the container. | | `VOTPORT_PUSH_BIND` | off | UDP address for native VOT pushes. Setting it enables the listener; leave unset to keep native push disabled. | | `VOTPORT_PUSH_ADVERTISE` | derived | `host:port` that native senders dial. Defaults to the host in `VOTPORT_PUBLIC_URL` and the push bind port. Set it when the public UDP address differs. | | `VOTPORT_SERVE_BIND` | unset | UDP address for serving Deliver grants to VOT clients over QUIC; off when unset. Same certificate and issuer key as push. | | `VOTPORT_SERVE_ADVERTISE` | derived | `host:port` that VOT fetch clients dial, on the same rules as `VOTPORT_PUSH_ADVERTISE`. | | `VOTPORT_PUSH_CERT` / `VOTPORT_PUSH_KEY` | generated | PEM certificate and private key for native push. Set both together to use those paths in place, or leave both unset for a persistent self-signed pair under `VOTPORT_DATA_DIR`. | | `VOTPORT_DATA_DIR` | `/data` | State: `votport.db` (links, upload records; legacy `state.json` is imported once) and the cookie secret. | | `VOTPORT_RECEIVE_DIR` | `/received` | Root folder received files are published into. | | `VOTPORT_OUTBOUND_DIR` | `/outbound` | Root folder for server-rendered projects and files uploaded by admins for outbound links. Nested project subdirectories are allowed. | | `VOTPORT_MAX_UPLOAD_BYTES` | 50 GiB | Hard cap per upload session (per-link caps can be lower). Accepts plain bytes or a `K/KiB/KB`, `M/MiB/MB`, `G/GiB/GB`, `T/TiB/TB` suffix, e.g. `500G`. | | `VOTPORT_ALLOW_HIDDEN` | off | Set `1` to accept dot-file names from uploaders. | | `VOTPORT_SESSION_IDLE_SECS` | `1800` | Idle time before an unfinished upload session is discarded. | | `VOTPORT_WEB_ROOT` | `./web` | Static assets directory (`/app/web` in Docker). | | `VOTPORT_NOTIFY_WEBHOOK_URL` | — | POSTed a JSON summary (`event`, `label`, `upload_id`, `total_bytes`, `files`) when an upload completes. | | `VOTPORT_NOTIFY_NTFY_URL` | — | Full ntfy topic URL (e.g. `https://ntfy.sh/mytopic`) sent a message per completed upload. | | `VOTPORT_NOTIFY_NTFY_TOKEN` | — | Bearer token for the ntfy topic, if it needs one. | | `VOTPORT_NOTIFY_PUSHOVER_TOKEN` | — | Pushover application token (set together with the user key). | | `VOTPORT_NOTIFY_PUSHOVER_USER` | — | Pushover application token (set together with the user key). | | `VOTPORT_NOTIFY_SMTP_HOST` | — | SMTP host. The channel is inert unless host, from, and at least one `to` all resolve. | | `VOTPORT_NOTIFY_SMTP_PORT` | `587` | SMTP port. Port 465 uses implicit TLS. | | `VOTPORT_NOTIFY_SMTP_STARTTLS` | on | SMTP STARTTLS. Off only when `0`. Port 465 uses implicit TLS regardless. | | `VOTPORT_NOTIFY_SMTP_USERNAME` | — | Optional SMTP AUTH username. | | `VOTPORT_NOTIFY_SMTP_PASSWORD` | — | Optional SMTP AUTH password. | | `VOTPORT_SCIM_TOKEN` | — | Bearer for the SCIM 2.0 provisioning endpoint at `/scim/v2`; unset disables it. Overridable via `PUT /api/admin/settings`. | | `VOTPORT_REPLICA_TOKEN` | — | Bearer a standby presents to `GET /api/replica`; unset disables it. Overridable via `PUT /api/admin/settings`. | | `VOTPORT_STANDBY_SOURCE` | — | `votport standby` only: the live instance's https URL to pull replicas from. | | `VOTPORT_STANDBY_INTERVAL_SECS` | `60` | `votport standby` only: seconds between pulls; the RPO. | | `VOTPORT_SCIM_REQUIRE_PROVISIONING` | `0` | `1` refuses SSO sign-in for subjects with no principal row. Overridable via `PUT /api/admin/settings`. | | `VOTPORT_OIDC_SUBJECT_CLAIM` | `sub` | Id-token claim used as the principal subject: `sub`, `email`, or `preferred_username`. Must match the SCIM `userName` mapping. | | `VOTPORT_NOTIFY_SMTP_FROM` | — | SMTP From address (required with host and `to`). | | `VOTPORT_NOTIFY_SMTP_TO` | — | Comma-separated SMTP recipients (at least one required with host and from). | | `VOTPORT_AUDIT_RETENTION_DAYS` | `400` | Days to keep queryable audit rows; `0` disables pruning. Overridable via `PUT /api/admin/settings`. | | `VOTPORT_UPLOAD_RETENTION_DAYS` | off | Days to keep received files and their records; a daily sweep deletes expired content and audits it. `0` (default) keeps everything. Overridable via `PUT /api/admin/settings`. | | `VOTPORT_DEFAULT_MAX_TOTAL_BYTES` | unlimited | Fills a new tenant's byte quota when the request omits it, and caps received bytes on the unnamed default tenant. Named tenants keep the quota on their row. | | `VOTPORT_DEFAULT_MAX_LINKS` | unlimited | Same overlay for max links (new tenants when omitted, and the unnamed default tenant). | | `VOTPORT_DEFAULT_MAX_SESSIONS` | unlimited | Same overlay for max concurrent sessions. | | `VOTPORT_PUBLIC_PASSWORD_LOGIN` | on | Set `0` to prefer collapsing the local password form when SSO is offered (login API stays available). | | `VOTPORT_METRICS_TOKEN` | — | When set, `GET /metrics` requires this bearer token. Counts only; scrape over an internal interface. | | `VOTPORT_TRUSTED_PROXIES` | loopback + private ranges | Comma-separated CIDR blocks (or bare addresses) whose `X-Forwarded-For` is believed. Anything else is keyed on its socket address. The default trusts any loopback or RFC1918/ULA peer, which is broad: on a shared container network or a LAN bind, anything that can reach the port can pick its own throttle bucket. Name your reverse proxy to close that; see [trusted proxy configuration](/docs/self-hosting/installation/#https-proxy). | | `VOTPORT_OIDC_ISSUER` | — | OIDC issuer URL for admin single sign-on. Requires the client id/secret and `VOTPORT_PUBLIC_URL`; see [sign-in configuration](/docs/administration/sign-in/). | | `VOTPORT_OIDC_CLIENT_ID` | — | OAuth client id at the identity provider. | | `VOTPORT_OIDC_CLIENT_SECRET` | — | OAuth client secret at the identity provider. | | `VOTPORT_OIDC_ADMIN_GROUP` | — | Group whose members sign in as admins. Unset means every principal your provider authenticates gets admin. | ## Operational settings The System page also manages scheduled backups, replica access, and sign-in settings. Use [backup and restore](/docs/self-hosting/backups/), [access configuration](/docs/administration/sign-in/), and [notifications and retention](/docs/administration/settings/) for their workflows. Notification delivery is best-effort: a notification failure is logged and does not change the transfer outcome.