Environment file

Copy this file as .env and change what you need. It is safe for production as written: demo mode is off and no secrets are set.

How to read it

A line without # is on. Kanesh uses that value.
A line starting with # is off. Kanesh uses the built-in default.
To turn a setting on, remove the # and set your value.

For example, to use PostgreSQL, change DATABASE_DRIVER=sqlite to postgres and remove the # in front of DATABASE_URL.

Note: Docker reads this file through --env-file .env or env_file in Compose. The Go process does not read it; export the variables in your shell first.

Full file

# ---- Server ----
HOST=127.0.0.1
PORT=8080
DATA_DIR=.data
# Seconds running requests get to finish on shutdown (1s to 5m).
SHUTDOWN_TIMEOUT=10s

# ---- Database ----
# sqlite, postgres or mysql.
DATABASE_DRIVER=sqlite
# PostgreSQL URL or MySQL go-sql-driver DSN. Required for postgres and mysql.
# DATABASE_URL=postgres://kanesh:CHANGE_ME@127.0.0.1:5432/kanesh?sslmode=disable
# Custom SQLite path. Default: DATA_DIR/kanesh.db
# SQLITE_PATH=.data/kanesh.db

# ---- First owner ----
# Own claim secret (32 to 256 characters). Default: a one-time token in DATA_DIR/claim-token.
# BOOTSTRAP_TOKEN=
# Creates the owner on a new install only.
# ADMIN_EMAIL=you@example.com
# ADMIN_PASSWORD=
# Safer: read the password from a mounted secret.
# ADMIN_PASSWORD_FILE=/run/secrets/admin_password
# true shows the owner login on the sign-in screen. Throwaway demos only.
DEMO_MODE=false

# ---- Agents and tokens ----
# true turns on the read-only MCP endpoint.
MCP_ENABLED=false
# Extra raw-token header. Authorization: Bearer always works.
# AUTH_TOKEN_HEADER=X-Api-Key

# ---- Logging ----
# debug, info, warn or error.
LOG_LEVEL=info
# json for log tools, text for a terminal.
LOG_FORMAT=json
# Slow requests log as a warning. 0 turns it off.
# LOG_SLOW_REQUEST=1s

# ---- HTTPS and headers ----
# Set true behind HTTPS, including a TLS reverse proxy.
COOKIE_SECURE=false
# Strict-Transport-Security. Default: same as COOKIE_SECURE.
# HSTS_ENABLED=true
# Content-Security-Policy for Studio pages. The default is strict.
# CONTENT_SECURITY_POLICY=default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'
# Proxies allowed to pass the client IP (IPs or CIDRs, comma-separated).
# TRUSTED_PROXIES=10.0.0.0/8

# ---- Secrets saved from Studio ----
# At least 16 characters. Needed to save secrets such as the SMTP password. Back it up.
# SETTINGS_ENCRYPTION_KEY=
# Used only when SETTINGS_ENCRYPTION_KEY is unset.
# SECRET=

# ---- Rate limit ----
RATE_LIMIT_ENABLED=true
# Requests per client per window on /api/.
# RATE_LIMIT_POINTS=600
# RATE_LIMIT_DURATION=1m
# Stricter budget for login and the installation claim.
# RATE_LIMIT_AUTH_POINTS=20
# RATE_LIMIT_AUTH_DURATION=1m

# ---- CORS (browser apps on other origins) ----
# CORS_ENABLED=false
# CORS_ORIGINS=https://app.example.com,http://localhost:5173
# CORS_METHODS=GET,POST,PUT,PATCH,DELETE
# CORS_HEADERS=Authorization,Content-Type,If-Match,If-None-Match,X-Request-ID,X-Workspace-ID
# CORS_EXPOSE_HEADERS=ETag,X-Request-ID,X-Response-Time,Retry-After,Content-Disposition
# CORS_MAX_AGE=10m

# ---- Access policy ----
# PASSWORD_MIN_LENGTH=12
# PASSWORD_REQUIRE_CLASSES=false
# SESSION_LIFETIME=8h
# SESSION_IDLE_TIMEOUT=0s
# LOGIN_MAX_ATTEMPTS=5
# LOGIN_LOCKOUT=1m
# TOKEN_DEFAULT_LIFETIME=2160h
# TOKEN_MAX_LIFETIME=8760h
# OWNER_INVITES_ENABLED=true

# ---- File storage ----
# database (default) or s3.
# STORAGE_DRIVER=database
# S3 or MinIO. Required when STORAGE_DRIVER=s3.
# S3_ENDPOINT=https://s3.us-east-1.amazonaws.com
# S3_REGION=us-east-1
# S3_BUCKET=kanesh-uploads
# S3_ACCESS_KEY_ID=
# S3_SECRET_ACCESS_KEY=
# true for MinIO and most S3-compatible services.
# S3_FORCE_PATH_STYLE=false

# ---- Email ----
# smtp or resend. Default: smtp when SMTP_HOST is set.
# EMAIL_PROVIDER=smtp
# Resend API key. Required when EMAIL_PROVIDER=resend.
# RESEND_API_KEY=
# Sender for every provider.
# SMTP_FROM=noreply@example.com
# SMTP_FROM_NAME=Kanesh
# SMTP relay.
# SMTP_HOST=smtp.example.com
# SMTP_PORT=587
# SMTP_TLS=starttls
# SMTP_USERNAME=
# SMTP_PASSWORD=

Each group is explained on its own page: Configuration, Security, CORS, Access policy, Email and File uploads and storage.

Storage is explained on File uploads and storage.