Self-hosting
Environment Configuration Every environment variable TabSlate Server reads, grouped by purpose, with real defaults.
This groups the variables documented in the server's .env.example
Variable Required Default Notes DATABASE_URLYes — PostgreSQL 17+ connection string. Must start with postgres:// or postgresql://. REDIS_URLNo — (in-memory fallback) Enables Redis-backed pub/sub, cache, and rate limiting. See Requirements .
Variable Required Default Notes JWT_SECRETYes — HMAC-HS256 signing secret. Generate with openssl rand -hex 32.
Variable Required Default Notes DOMAINYes, for the bundled Caddy service — Public hostname Caddy requests a Let's Encrypt certificate for.
Variable Required Default Notes PORTNo 8080HTTP port the server listens on. GIN_MODENo debugSet to release in production to suppress Gin's debug request logging. TRUSTED_PROXIESNo RFC1918 private ranges (172.16.0.0/12,10.0.0.0/8,192.168.0.0/16) Comma-separated trusted reverse-proxy IPs/CIDRs for client-IP resolution. Set to an empty string to trust only the raw connection address, if the server is directly internet-exposed with no proxy in front of it.
Variable Required Default Notes ALLOW_REGISTRATIONNo trueSet to false to close new signups after initial setup.
Variable Required Default Notes PROSOPO_SECRETNo — (verification disabled) Server-side secret for verifying captcha tokens. PROSOPO_SERVER_URLNo https://api.prosopo.io/siteverifyOverride only for a self-hosted Prosopo deployment. PROSOPO_BUNDLE_URLNo https://js.prosopo.io/js/procaptcha.bundle.jsJS widget bundle URL served to the browser. Override only for a self-hosted Prosopo deployment. REGISTER_CAPTCHA_THRESHOLDNo 3Successful registrations from one IP within the window before captcha is required on /auth/register. 0 always requires it. REGISTER_CAPTCHA_WINDOWNo 24hLook-back window for the above. Any Go duration string. OTP_CAPTCHA_THRESHOLDNo 5OTP email requests (resend / forgot-password) from one IP within the window before captcha is required. 0 always requires it. OTP_CAPTCHA_WINDOWNo 15mLook-back window for the above.
Variable Required Default Notes MAIL_PROVIDERNo — (email verification disabled, all users auto-verified) smtp, resend, or ses.SMTP_HOST / SMTP_PORT / SMTP_USER / SMTP_PASSWORD / SMTP_FROMOnly if MAIL_PROVIDER=smtp SMTP_PORT defaults to 587; the rest have no defaultRESEND_API_KEY / RESEND_FROMOnly if MAIL_PROVIDER=resend — SES_ACCESS_KEY_ID / SES_SECRET_KEY / SES_REGION / SES_FROMOnly if MAIL_PROVIDER=ses —
Variable Required Default Notes MEILISEARCH_HOSTNo — (search indexing disabled) Internal URL, e.g. http://meilisearch:7700. MEILISEARCH_API_KEYNo — Master or admin key for that instance.
Every pair below accepts any Go duration string for the window (30s, 1m, 5m, ...).
Variable Default Applies to RATE_LIMIT_AUTH / RATE_LIMIT_AUTH_WINDOW10 / 1mRegister, login, resend-verification, verify-email, forgot/reset-password — per IP. RATE_LIMIT_SYNC_PUSH / RATE_LIMIT_SYNC_PUSH_WINDOW60 / 1mPOST /sync/push — per IP.RATE_LIMIT_SYNC_PULL / RATE_LIMIT_SYNC_PULL_WINDOW120 / 1mGET /sync/pull — per IP.RATE_LIMIT_SEARCH / RATE_LIMIT_SEARCH_WINDOW60 / 1mGET /search — per IP.
Every rate-limit and captcha-threshold variable above works whether or not REDIS_URL is set — rate limiting and captcha-threshold counting both use the same Redis-or-in-memory infra layer described in Requirements . Without Redis, the counters just don't survive a server restart and aren't shared across multiple instances.
Last updated on