Configuration Generator

Choose the options that fit your deployment and copy the generated YAML into your etc/ directory. These fragments layer on top of the shipped defaults, so you only need the options shown here. For the full option surface, see theConfiguration Reference andEnvironment Variablespages.

Deployment mode

Simple mode uses Redis/Valkey only, no SQL database. Full mode adds PostgreSQL-backed accounts, teams, and SSO.

Simple — single container, Redis/Valkey onlyFull — accounts, teams, SSO (adds PostgreSQL)

Email delivery

How outgoing mail (verification, notifications, password reset) is sent.

Generic SMTPAmazon SESSendGridLettermint

Single sign-on (SSO)

External identity providers via OmniAuth (OIDC, Entra ID, Google, GitHub). Requires Full deployment mode.

Requires Deployment mode: Full — accounts, teams, SSO (adds PostgreSQL)

Custom domains

Let users share secrets from their own domain instead of the default host.

Multi-region / jurisdictions

Advertise multiple regional deployments for data-residency requirements.

Error tracking (Sentry)

Report backend, frontend, and worker exceptions to Sentry.

Behind a reverse proxy / load balancer

Trust X-Forwarded-For from an upstream proxy (nginx, Caddy, ALB, k8s ingress) when resolving client IPs.

Require a passphrase on every secret

Default secret lifetime

5 minutes30 minutes1 hour4 hours12 hours1 day3 days7 days14 days30 days

config.yamlauth.yaml.env

Copy Download

emailer:
  mode: smtp
features:
  domains:
    enabled: false
  regions:
    enabled: false
diagnostics:
  enabled: false
site:
  network:
    trusted_proxy:
      enabled: false
  secret_options:
    passphrase:
      required: false
    default_ttl: 604800

These fragments contain the options you selected above and layer on top of the shipped defaults. Copy config.yaml / auth.yaml into your etc/ directory. Secrets (SECRET, database URLs, credentials) appear only as empty placeholders in the .env tab — set those yourself, and never paste them into a shared link.