penpot-aio

Overview

Penpot is an open-source design and prototyping platform for product teams, designers, and developers.

All-In-One Unraid Edition
penpot-aio packages Penpot frontend, backend, exporter, MCP server, PostgreSQL, Redis-compatible cache, Nginx, and Mailpit into one practical Unraid-first container.

Quick Install (Beginners)

Install this template and leave [code]Web UI Port[/code] and [code]AppData[/code] at their defaults unless you have a port or path conflict.
Set [code]Public URL[/code] to the URL users will actually visit, such as [code]http://tower.local:9001[/code] or your reverse-proxy HTTPS URL.
Start the container and give first boot a few minutes. The wrapper initializes bundled PostgreSQL, Redis-compatible cache, filesystem assets, Mailpit, MCP, and generated secrets.
Open the Web UI and create your first account. The default lab path disables email verification and uses local Mailpit; change the flags and SMTP settings before public production use.

Power Users (Advanced View)

Advanced View exposes upstream Penpot configuration, Penpot flags, external PostgreSQL, external Redis/Valkey, SMTP, S3-compatible object storage, OAuth/OIDC/LDAP, telemetry, MCP, SSRF controls, rate/limit/performance tuning, and AIO runtime controls.
Leave database, cache, SMTP, and storage fields blank/defaulted for the bundled one-container path. Set the matching external fields only when intentionally moving that service out of the AIO container.
Blank secret fields generate and persist values in [code]/appdata/config/generated.env[/code]. Explicit template values override generated values.
[code]/appdata/config/extra.env[/code] is loaded as a final sanitized key/value escape hatch, not a substitute for the exposed template options. Only [code]PENPOT_[/code], [code]AWS_[/code], and core runtime keys are accepted; shell syntax is not executed.

Important Notes

Penpot is a real multi-service stack. Plan for at least 2 CPU cores and 4 GiB RAM, with more for active teams or large files.
Public exposure should sit behind a trusted HTTPS reverse proxy. Remove [code]disable-secure-session-cookies[/code] and [code]disable-email-verification[/code] for production.
The bundled Mailpit inbox is for local/lab capture, not real mail deliverability.

Requirements

Penpot is a heavier multi-service application. Plan for at least 2 CPU cores and 4 GiB RAM. Use HTTPS and production-safe flags before exposing it publicly.

Runtime arguments

Web UI: http://[IP]:[PORT:8080]
Network: bridge
Shell: sh
Privileged: false

Template configuration

Web UI PortPorttcp

Penpot frontend, API gateway, exporter routes, and MCP proxy.

Target: 8080
Default: 9001
Value: 9001

Mailpit UI PortPorttcp

Bundled Mailpit inbox UI for local/lab mail capture. Advanced because normal Penpot use starts through the Web UI.

Target: 8025
Default: 8026
Value: 8026

MCP HTTP PortPorttcp

Optional direct host port for the Penpot MCP HTTP endpoint. Leave blank unless you need direct MCP access outside the frontend /mcp route.

Target: 4401

MCP WebSocket PortPorttcp

Optional direct host port for the Penpot MCP WebSocket endpoint. Leave blank unless you need direct MCP access outside the frontend /mcp route.

Target: 4402

AppDataPathrw

Persistent Penpot data, PostgreSQL data, cache data, generated secrets, assets, Mailpit data, logs, and optional extra.env.

Target: /appdata
Default: /mnt/user/appdata/penpot-aio
Value: /mnt/user/appdata/penpot-aio

Public URLVariable

Canonical URL users will visit, including http or https. For LAN installs use your Unraid host and mapped port; for public installs use the reverse-proxy HTTPS URL.

Target: PENPOT_PUBLIC_URI
Default: http://localhost:9001
Value: http://localhost:9001

[AIO Runtime] Enable Internal PostgresVariable

Use the bundled PostgreSQL database. Set false only when PENPOT_DATABASE_URI points at an external PostgreSQL server.

Target: PENPOT_AIO_ENABLE_INTERNAL_POSTGRES
Default: true|false
Value: true

[AIO Runtime] Enable Internal RedisVariable

Use the bundled Redis-compatible cache. Set false only when PENPOT_REDIS_URI points at an external Redis or Valkey service.

Target: PENPOT_AIO_ENABLE_INTERNAL_REDIS
Default: true|false
Value: true

[AIO Runtime] Enable MailpitVariable

Use bundled Mailpit when SMTP_HOST is blank so local email-dependent flows work on first boot.

Target: PENPOT_AIO_ENABLE_MAILPIT
Default: true|false
Value: true

[AIO Runtime] Enable MCPVariable

Run Penpot MCP inside the AIO container and expose it through the frontend /mcp routes.

Target: PENPOT_AIO_ENABLE_MCP
Default: true|false
Value: true

[AIO Runtime] Default FlagsVariable

Default flags used when PENPOT_FLAGS is blank. Remove disable-* entries before public HTTPS production use.

Target: PENPOT_AIO_DEFAULT_FLAGS
Default: disable-email-verification enable-smtp disable-secure-session-cookies enable-mcp
Value: disable-email-verification enable-smtp disable-secure-session-cookies enable-mcp

[AIO Runtime] Extra Env FileVariable

Optional dotenv-style escape hatch loaded after generated defaults. Only PENPOT_, AWS_, and core runtime keys are accepted; shell syntax is not executed.

Target: PENPOT_AIO_EXTRA_ENV_FILE
Default: /appdata/config/extra.env
Value: /appdata/config/extra.env

[AIO Runtime] Wait Timeout SecondsVariable

Startup wait timeout for internal PostgreSQL, Redis, and Mailpit readiness checks.

Target: PENPOT_AIO_WAIT_TIMEOUT_SECONDS
Default: 360
Value: 360

[AIO Runtime] Database NameVariable

Database name used by the bundled PostgreSQL cluster.

Target: PENPOT_AIO_DATABASE_NAME
Default: penpot
Value: penpot

[AIO Runtime] Redis PasswordVariable

Optional manual password for bundled Redis. Leave blank to generate and persist one on first boot.

Target: PENPOT_AIO_REDIS_PASSWORD

[AIO Runtime] Redis MaxmemoryVariable

Bundled Redis maxmemory setting.

Target: PENPOT_AIO_REDIS_MAXMEMORY
Default: 256mb
Value: 256mb

[AIO Runtime] Redis Maxmemory PolicyVariable

Bundled Redis memory eviction policy.

Target: PENPOT_AIO_REDIS_MAXMEMORY_POLICY
Default: volatile-lfu|allkeys-lfu|allkeys-lru|volatile-lru|noeviction
Value: volatile-lfu

[AIO Runtime] Mailpit Ui UsernameVariable

Optional Mailpit UI username. Leave blank to persist the default penpot username.

Target: PENPOT_AIO_MAILPIT_UI_USERNAME

[AIO Runtime] Mailpit Ui PasswordVariable

Optional Mailpit UI password. Leave blank to generate and persist one on first boot.

Target: PENPOT_AIO_MAILPIT_UI_PASSWORD

[AIO Runtime] Mailpit Max MessagesVariable

Maximum messages retained by the bundled Mailpit inbox.

Target: PENPOT_AIO_MAILPIT_MAX_MESSAGES
Default: 500
Value: 500

[AIO Runtime] Mailpit Max AgeVariable

Maximum age for messages retained by bundled Mailpit.

Target: PENPOT_AIO_MAILPIT_MAX_AGE
Default: 14d
Value: 14d

[AIO Runtime] Log LevelVariable

Wrapper log level. This does not replace upstream Penpot logging controls.

Target: PENPOT_AIO_LOG_LEVEL
Default: info|debug|warn|error
Value: info

[Storage] AWS Access Key IdVariable

Advanced upstream Penpot environment variable AWS_ACCESS_KEY_ID.

Target: AWS_ACCESS_KEY_ID

[Storage] AWS Secret Access KeyVariable

Advanced upstream Penpot environment variable AWS_SECRET_ACCESS_KEY.

Target: AWS_SECRET_ACCESS_KEY

[Advanced Upstream] AdminsVariable

Advanced upstream Penpot environment variable PENPOT_ADMINS.

Target: PENPOT_ADMINS

[Advanced Upstream] Allow Demo UsersVariable

Advanced upstream Penpot environment variable PENPOT_ALLOW_DEMO_USERS.

Target: PENPOT_ALLOW_DEMO_USERS
Default: false|true
Value: false

[Storage] Assets PathVariable

Advanced upstream Penpot environment variable PENPOT_ASSETS_PATH.

Target: PENPOT_ASSETS_PATH
Default: /internal/assets/
Value: /internal/assets/

[Storage] Assets Storage BackendVariable

Advanced upstream Penpot environment variable PENPOT_ASSETS_STORAGE_BACKEND.

Target: PENPOT_ASSETS_STORAGE_BACKEND
Default: fs|s3
Value: fs

[Advanced Upstream] Audit Log Archive URIVariable

Advanced upstream Penpot environment variable PENPOT_AUDIT_LOG_ARCHIVE_URI.

Target: PENPOT_AUDIT_LOG_ARCHIVE_URI

[Advanced Upstream] Audit Log Http Handler ConcurrencyVariable

Advanced upstream Penpot environment variable PENPOT_AUDIT_LOG_HTTP_HANDLER_CONCURRENCY.

Target: PENPOT_AUDIT_LOG_HTTP_HANDLER_CONCURRENCY

[Auth] Auth Token Cookie Max AgeVariable

Advanced upstream Penpot environment variable PENPOT_AUTH_TOKEN_COOKIE_MAX_AGE.

Target: PENPOT_AUTH_TOKEN_COOKIE_MAX_AGE

[Auth] Auth Token Cookie NameVariable

Advanced upstream Penpot environment variable PENPOT_AUTH_TOKEN_COOKIE_NAME.

Target: PENPOT_AUTH_TOKEN_COOKIE_NAME
Default: auth-token
Value: auth-token

[Limits/Performance] Auto File Snapshot EveryVariable

Advanced upstream Penpot environment variable PENPOT_AUTO_FILE_SNAPSHOT_EVERY.

Target: PENPOT_AUTO_FILE_SNAPSHOT_EVERY
Default: 5
Value: 5

[Limits/Performance] Auto File Snapshot TimeoutVariable

Advanced upstream Penpot environment variable PENPOT_AUTO_FILE_SNAPSHOT_TIMEOUT.

Target: PENPOT_AUTO_FILE_SNAPSHOT_TIMEOUT
Default: 3h
Value: 3h

[Access] Backend URIVariable

Advanced upstream Penpot environment variable PENPOT_BACKEND_URI.

Target: PENPOT_BACKEND_URI
Default: http://127.0.0.1:6060
Value: http://127.0.0.1:6060

[Database] Database Max Pool SizeVariable

Advanced upstream Penpot environment variable PENPOT_DATABASE_MAX_POOL_SIZE.

Target: PENPOT_DATABASE_MAX_POOL_SIZE

[Database] Database Min Pool SizeVariable

Advanced upstream Penpot environment variable PENPOT_DATABASE_MIN_POOL_SIZE.

Target: PENPOT_DATABASE_MIN_POOL_SIZE

[Database] Database PasswordVariable

PostgreSQL password. Leave blank to generate and persist one for the bundled database.

Target: PENPOT_DATABASE_PASSWORD

[Database] Database ReadonlyVariable

Advanced upstream Penpot environment variable PENPOT_DATABASE_READONLY.

Target: PENPOT_DATABASE_READONLY
Default: false|true
Value: false

[Database] Database URIVariable

Leave blank for bundled PostgreSQL. Set a PostgreSQL URI only when using an external database.

Target: PENPOT_DATABASE_URI

[Database] Database UsernameVariable

PostgreSQL username. The bundled database uses penpot.

Target: PENPOT_DATABASE_USERNAME
Default: penpot
Value: penpot

[Advanced Upstream] Default Blob VersionVariable

Advanced upstream Penpot environment variable PENPOT_DEFAULT_BLOB_VERSION.

Target: PENPOT_DEFAULT_BLOB_VERSION
Default: 4
Value: 4

[Limits/Performance] Default Executor ParallelismVariable

Advanced upstream Penpot environment variable PENPOT_DEFAULT_EXECUTOR_PARALLELISM.

Target: PENPOT_DEFAULT_EXECUTOR_PARALLELISM

[Advanced Upstream] Default Internal ResolverVariable

Advanced upstream Penpot environment variable PENPOT_DEFAULT_INTERNAL_RESOLVER.

Target: PENPOT_DEFAULT_INTERNAL_RESOLVER

[Limits/Performance] Default Rpc RlimitVariable

Advanced upstream Penpot environment variable PENPOT_DEFAULT_RPC_RLIMIT.

Target: PENPOT_DEFAULT_RPC_RLIMIT

[Limits/Performance] Deletion DelayVariable

Advanced upstream Penpot environment variable PENPOT_DELETION_DELAY.

Target: PENPOT_DELETION_DELAY

[SMTP] Email Domain BlacklistVariable

Advanced upstream Penpot environment variable PENPOT_EMAIL_DOMAIN_BLACKLIST.

Target: PENPOT_EMAIL_DOMAIN_BLACKLIST

[SMTP] Email Domain WhitelistVariable

Advanced upstream Penpot environment variable PENPOT_EMAIL_DOMAIN_WHITELIST.

Target: PENPOT_EMAIL_DOMAIN_WHITELIST

[SMTP] Email Verify ThresholdVariable

Advanced upstream Penpot environment variable PENPOT_EMAIL_VERIFY_THRESHOLD.

Target: PENPOT_EMAIL_VERIFY_THRESHOLD
Default: 15m
Value: 15m

[Telemetry] Error Report WebhookVariable

Advanced upstream Penpot environment variable PENPOT_ERROR_REPORT_WEBHOOK.

Target: PENPOT_ERROR_REPORT_WEBHOOK

[Limits/Performance] Executor ThreadsVariable

Advanced upstream Penpot environment variable PENPOT_EXECUTOR_THREADS.

Target: PENPOT_EXECUTOR_THREADS

[Advanced Upstream] Exporter Shared KeyVariable

Advanced upstream Penpot environment variable PENPOT_EXPORTER_SHARED_KEY.

Target: PENPOT_EXPORTER_SHARED_KEY

[Access] Exporter URIVariable

Advanced upstream Penpot environment variable PENPOT_EXPORTER_URI.

Target: PENPOT_EXPORTER_URI
Default: http://127.0.0.1:6061
Value: http://127.0.0.1:6061

[Limits/Performance] File Clean DelayVariable

Advanced upstream Penpot environment variable PENPOT_FILE_CLEAN_DELAY.

Target: PENPOT_FILE_CLEAN_DELAY

[Storage] File Data BackendVariable

Advanced upstream Penpot environment variable PENPOT_FILE_DATA_BACKEND.

Target: PENPOT_FILE_DATA_BACKEND
Default: storage|legacy-db|db
Value: storage

[Core] FlagsVariable

Raw upstream Penpot flags. Leave blank to use AIO defaults plus per-flag dropdown controls.

Target: PENPOT_FLAGS

[Storage] Font Max File SizeVariable

Advanced upstream Penpot environment variable PENPOT_FONT_MAX_FILE_SIZE.

Target: PENPOT_FONT_MAX_FILE_SIZE

[Auth] Github Client IdVariable

Advanced upstream Penpot environment variable PENPOT_GITHUB_CLIENT_ID.

Target: PENPOT_GITHUB_CLIENT_ID

[Auth] Github Client SecretVariable

Advanced upstream Penpot environment variable PENPOT_GITHUB_CLIENT_SECRET.

Target: PENPOT_GITHUB_CLIENT_SECRET

[Auth] Gitlab Base URIVariable

Advanced upstream Penpot environment variable PENPOT_GITLAB_BASE_URI.

Target: PENPOT_GITLAB_BASE_URI

[Auth] Gitlab Client IdVariable

Advanced upstream Penpot environment variable PENPOT_GITLAB_CLIENT_ID.

Target: PENPOT_GITLAB_CLIENT_ID

[Auth] Gitlab Client SecretVariable

Advanced upstream Penpot environment variable PENPOT_GITLAB_CLIENT_SECRET.

Target: PENPOT_GITLAB_CLIENT_SECRET

[Auth] Google Client IdVariable

Advanced upstream Penpot environment variable PENPOT_GOOGLE_CLIENT_ID.

Target: PENPOT_GOOGLE_CLIENT_ID

[Auth] Google Client SecretVariable

Advanced upstream Penpot environment variable PENPOT_GOOGLE_CLIENT_SECRET.

Target: PENPOT_GOOGLE_CLIENT_SECRET

[Access] HostVariable

Advanced upstream Penpot environment variable PENPOT_HOST.

Target: PENPOT_HOST
Default: localhost
Value: localhost

[Access] Http Server HostVariable

Advanced upstream Penpot environment variable PENPOT_HTTP_SERVER_HOST.

Target: PENPOT_HTTP_SERVER_HOST
Default: 127.0.0.1
Value: 127.0.0.1

[Limits/Performance] Http Server Io ThreadsVariable

Advanced upstream Penpot environment variable PENPOT_HTTP_SERVER_IO_THREADS.

Target: PENPOT_HTTP_SERVER_IO_THREADS

[Limits/Performance] Http Server Max Body SizeVariable

Advanced upstream Penpot environment variable PENPOT_HTTP_SERVER_MAX_BODY_SIZE.

Target: PENPOT_HTTP_SERVER_MAX_BODY_SIZE
Default: 367001600
Value: 367001600

[Limits/Performance] Http Server Max Multipart Body SizeVariable

Advanced upstream Penpot environment variable PENPOT_HTTP_SERVER_MAX_MULTIPART_BODY_SIZE.

Target: PENPOT_HTTP_SERVER_MAX_MULTIPART_BODY_SIZE
Default: 367001600
Value: 367001600

[Limits/Performance] Http Server Max Worker ThreadsVariable

Advanced upstream Penpot environment variable PENPOT_HTTP_SERVER_MAX_WORKER_THREADS.

Target: PENPOT_HTTP_SERVER_MAX_WORKER_THREADS

[Access] Http Server PortVariable

Advanced upstream Penpot environment variable PENPOT_HTTP_SERVER_PORT.

Target: PENPOT_HTTP_SERVER_PORT
Default: 6060
Value: 6060

[Advanced Upstream] Initial Project SkeyVariable

Advanced upstream Penpot environment variable PENPOT_INITIAL_PROJECT_SKEY.

Target: PENPOT_INITIAL_PROJECT_SKEY
Default: initial-project
Value: initial-project

[Access] Internal ResolverVariable

Advanced upstream Penpot environment variable PENPOT_INTERNAL_RESOLVER.

Target: PENPOT_INTERNAL_RESOLVER

[Auth] LDAP Attrs EmailVariable

Advanced upstream Penpot environment variable PENPOT_LDAP_ATTRS_EMAIL.

Target: PENPOT_LDAP_ATTRS_EMAIL
Default: mail
Value: mail

[Auth] LDAP Attrs FullnameVariable

Advanced upstream Penpot environment variable PENPOT_LDAP_ATTRS_FULLNAME.

Target: PENPOT_LDAP_ATTRS_FULLNAME
Default: cn
Value: cn

[Auth] LDAP Attrs PhotoVariable

Advanced upstream Penpot environment variable PENPOT_LDAP_ATTRS_PHOTO.

Target: PENPOT_LDAP_ATTRS_PHOTO

[Auth] LDAP Attrs UsernameVariable

Advanced upstream Penpot environment variable PENPOT_LDAP_ATTRS_USERNAME.

Target: PENPOT_LDAP_ATTRS_USERNAME
Default: uid
Value: uid

[Auth] LDAP Base DnVariable

Advanced upstream Penpot environment variable PENPOT_LDAP_BASE_DN.

Target: PENPOT_LDAP_BASE_DN

[Auth] LDAP Bind DnVariable

Advanced upstream Penpot environment variable PENPOT_LDAP_BIND_DN.

Target: PENPOT_LDAP_BIND_DN

[Auth] LDAP Bind PasswordVariable

Advanced upstream Penpot environment variable PENPOT_LDAP_BIND_PASSWORD.

Target: PENPOT_LDAP_BIND_PASSWORD

[Auth] LDAP HostVariable

Advanced upstream Penpot environment variable PENPOT_LDAP_HOST.

Target: PENPOT_LDAP_HOST

[Auth] LDAP PortVariable

Advanced upstream Penpot environment variable PENPOT_LDAP_PORT.

Target: PENPOT_LDAP_PORT

[Auth] LDAP SslVariable

Advanced upstream Penpot environment variable PENPOT_LDAP_SSL.

Target: PENPOT_LDAP_SSL
Default: false|true
Value: false

[Auth] LDAP StarttlsVariable

Advanced upstream Penpot environment variable PENPOT_LDAP_STARTTLS.

Target: PENPOT_LDAP_STARTTLS
Default: false|true
Value: false

[Auth] LDAP User QueryVariable

Advanced upstream Penpot environment variable PENPOT_LDAP_USER_QUERY.

Target: PENPOT_LDAP_USER_QUERY
Default: (|(uid=:username)(mail=:username))
Value: (|(uid=:username)(mail=:username))

[Advanced Upstream] Loggers Loki EnvironmentVariable

Advanced upstream Penpot environment variable PENPOT_LOGGERS_LOKI_ENVIRONMENT.

Target: PENPOT_LOGGERS_LOKI_ENVIRONMENT

[Advanced Upstream] Loggers Loki InstanceVariable

Advanced upstream Penpot environment variable PENPOT_LOGGERS_LOKI_INSTANCE.

Target: PENPOT_LOGGERS_LOKI_INSTANCE

[Advanced Upstream] Loggers Loki JobVariable

Advanced upstream Penpot environment variable PENPOT_LOGGERS_LOKI_JOB.

Target: PENPOT_LOGGERS_LOKI_JOB

[Advanced Upstream] Loggers Loki URIVariable

Advanced upstream Penpot environment variable PENPOT_LOGGERS_LOKI_URI.

Target: PENPOT_LOGGERS_LOKI_URI

[Advanced Upstream] Management Api KeyVariable

Advanced upstream Penpot environment variable PENPOT_MANAGEMENT_API_KEY.

Target: PENPOT_MANAGEMENT_API_KEY

[MCP] MCP Log DirVariable

Advanced upstream Penpot environment variable PENPOT_MCP_LOG_DIR.

Target: PENPOT_MCP_LOG_DIR
Default: /appdata/logs/mcp
Value: /appdata/logs/mcp

[MCP] MCP Log LevelVariable

MCP log verbosity.

Target: PENPOT_MCP_LOG_LEVEL
Default: info|debug|warn|error|trace
Value: info

[MCP] MCP Remote ModeVariable

MCP remote mode. Keep true for the bundled HTTP/WebSocket MCP server path.

Target: PENPOT_MCP_REMOTE_MODE
Default: true|false
Value: true

[MCP] MCP Repl PortVariable

Advanced upstream Penpot environment variable PENPOT_MCP_REPL_PORT.

Target: PENPOT_MCP_REPL_PORT

[MCP] MCP Server HostVariable

Advanced upstream Penpot environment variable PENPOT_MCP_SERVER_HOST.

Target: PENPOT_MCP_SERVER_HOST
Default: 127.0.0.1
Value: 127.0.0.1

[MCP] MCP Server PortVariable

Advanced upstream Penpot environment variable PENPOT_MCP_SERVER_PORT.

Target: PENPOT_MCP_SERVER_PORT
Default: 4401
Value: 4401

[MCP] MCP URIVariable

Advanced upstream Penpot environment variable PENPOT_MCP_URI.

Target: PENPOT_MCP_URI
Default: http://127.0.0.1:4401
Value: http://127.0.0.1:4401

[MCP] MCP URI WsVariable

Advanced upstream Penpot environment variable PENPOT_MCP_URI_WS.

Target: PENPOT_MCP_URI_WS
Default: http://127.0.0.1:4402
Value: http://127.0.0.1:4402

[MCP] MCP Websocket PortVariable

Advanced upstream Penpot environment variable PENPOT_MCP_WEBSOCKET_PORT.

Target: PENPOT_MCP_WEBSOCKET_PORT
Default: 4402
Value: 4402

[Storage] Media DirectoryVariable

Advanced upstream Penpot environment variable PENPOT_MEDIA_DIRECTORY.

Target: PENPOT_MEDIA_DIRECTORY

[Storage] Media Max File SizeVariable

Advanced upstream Penpot environment variable PENPOT_MEDIA_MAX_FILE_SIZE.

Target: PENPOT_MEDIA_MAX_FILE_SIZE

[Storage] Media URIVariable

Advanced upstream Penpot environment variable PENPOT_MEDIA_URI.

Target: PENPOT_MEDIA_URI

[Limits/Performance] Netty Io ThreadsVariable

Advanced upstream Penpot environment variable PENPOT_NETTY_IO_THREADS.

Target: PENPOT_NETTY_IO_THREADS

[Advanced Upstream] Nexus Shared KeyVariable

Advanced upstream Penpot environment variable PENPOT_NEXUS_SHARED_KEY.

Target: PENPOT_NEXUS_SHARED_KEY

[Advanced Upstream] Nitrate Backend URIVariable

Advanced upstream Penpot environment variable PENPOT_NITRATE_BACKEND_URI.

Target: PENPOT_NITRATE_BACKEND_URI

[Advanced Upstream] Nitrate Shared KeyVariable

Advanced upstream Penpot environment variable PENPOT_NITRATE_SHARED_KEY.

Target: PENPOT_NITRATE_SHARED_KEY

[Access] Nitrate URIVariable

Advanced upstream Penpot environment variable PENPOT_NITRATE_URI.

Target: PENPOT_NITRATE_URI

[Storage] Objects StorageVariable

Advanced upstream Penpot environment variable PENPOT_OBJECTS_STORAGE_.

Target: PENPOT_OBJECTS_STORAGE_

[Storage] Objects Storage BackendVariable

Object storage backend. The AIO default stores assets on the AppData filesystem; S3 requires the matching S3 fields.

Target: PENPOT_OBJECTS_STORAGE_BACKEND
Default: fs|s3
Value: fs

[Storage] Objects Storage Fs DirectoryVariable

Filesystem asset directory for the bundled storage path.

Target: PENPOT_OBJECTS_STORAGE_FS_DIRECTORY
Default: /appdata/assets
Value: /appdata/assets

[Storage] Objects Storage S3 BucketVariable

Advanced upstream Penpot environment variable PENPOT_OBJECTS_STORAGE_S3_BUCKET.

Target: PENPOT_OBJECTS_STORAGE_S3_BUCKET

[Storage] Objects Storage S3 EndpointVariable

Advanced upstream Penpot environment variable PENPOT_OBJECTS_STORAGE_S3_ENDPOINT.

Target: PENPOT_OBJECTS_STORAGE_S3_ENDPOINT

[Storage] Objects Storage S3 RegionVariable

Advanced upstream Penpot environment variable PENPOT_OBJECTS_STORAGE_S3_REGION.

Target: PENPOT_OBJECTS_STORAGE_S3_REGION

[Auth] OIDC Auth URIVariable

Advanced upstream Penpot environment variable PENPOT_OIDC_AUTH_URI.

Target: PENPOT_OIDC_AUTH_URI

[Auth] OIDC Base URIVariable

Advanced upstream Penpot environment variable PENPOT_OIDC_BASE_URI.

Target: PENPOT_OIDC_BASE_URI

[Auth] OIDC Client IdVariable

Advanced upstream Penpot environment variable PENPOT_OIDC_CLIENT_ID.

Target: PENPOT_OIDC_CLIENT_ID

[Auth] OIDC Client SecretVariable

Advanced upstream Penpot environment variable PENPOT_OIDC_CLIENT_SECRET.

Target: PENPOT_OIDC_CLIENT_SECRET

[Auth] OIDC Email AttrVariable

Advanced upstream Penpot environment variable PENPOT_OIDC_EMAIL_ATTR.

Target: PENPOT_OIDC_EMAIL_ATTR

[Auth] OIDC Jwks URIVariable

Advanced upstream Penpot environment variable PENPOT_OIDC_JWKS_URI.

Target: PENPOT_OIDC_JWKS_URI

[Auth] OIDC Name AttrVariable

Advanced upstream Penpot environment variable PENPOT_OIDC_NAME_ATTR.

Target: PENPOT_OIDC_NAME_ATTR

[Auth] OIDC RolesVariable

Advanced upstream Penpot environment variable PENPOT_OIDC_ROLES.

Target: PENPOT_OIDC_ROLES

[Auth] OIDC Roles AttrVariable

Advanced upstream Penpot environment variable PENPOT_OIDC_ROLES_ATTR.

Target: PENPOT_OIDC_ROLES_ATTR

[Auth] OIDC ScopesVariable

Advanced upstream Penpot environment variable PENPOT_OIDC_SCOPES.

Target: PENPOT_OIDC_SCOPES

[Auth] OIDC Token URIVariable

Advanced upstream Penpot environment variable PENPOT_OIDC_TOKEN_URI.

Target: PENPOT_OIDC_TOKEN_URI

[Auth] OIDC User Info SourceVariable

Advanced upstream Penpot environment variable PENPOT_OIDC_USER_INFO_SOURCE.

Target: PENPOT_OIDC_USER_INFO_SOURCE
Default: auto|userinfo|token
Value: auto

[Auth] OIDC User URIVariable

Advanced upstream Penpot environment variable PENPOT_OIDC_USER_URI.

Target: PENPOT_OIDC_USER_URI

[Advanced Upstream] Prepl HostVariable

Advanced upstream Penpot environment variable PENPOT_PREPL_HOST.

Target: PENPOT_PREPL_HOST

[Advanced Upstream] Prepl PortVariable

Advanced upstream Penpot environment variable PENPOT_PREPL_PORT.

Target: PENPOT_PREPL_PORT

[Limits/Performance] Profile Bounce Max AgeVariable

Advanced upstream Penpot environment variable PENPOT_PROFILE_BOUNCE_MAX_AGE.

Target: PENPOT_PROFILE_BOUNCE_MAX_AGE

[Advanced Upstream] Profile Bounce ThresholdVariable

Advanced upstream Penpot environment variable PENPOT_PROFILE_BOUNCE_THRESHOLD.

Target: PENPOT_PROFILE_BOUNCE_THRESHOLD
Default: 10
Value: 10

[Limits/Performance] Profile Complaint Max AgeVariable

Advanced upstream Penpot environment variable PENPOT_PROFILE_COMPLAINT_MAX_AGE.

Target: PENPOT_PROFILE_COMPLAINT_MAX_AGE

[Advanced Upstream] Profile Complaint ThresholdVariable

Advanced upstream Penpot environment variable PENPOT_PROFILE_COMPLAINT_THRESHOLD.

Target: PENPOT_PROFILE_COMPLAINT_THRESHOLD
Default: 2
Value: 2

[Limits/Performance] Quotes Access Tokens Per ProfileVariable

Advanced upstream Penpot environment variable PENPOT_QUOTES_ACCESS_TOKENS_PER_PROFILE.

Target: PENPOT_QUOTES_ACCESS_TOKENS_PER_PROFILE

[Limits/Performance] Quotes Comments Per FileVariable

Advanced upstream Penpot environment variable PENPOT_QUOTES_COMMENTS_PER_FILE.

Target: PENPOT_QUOTES_COMMENTS_PER_FILE

[Limits/Performance] Quotes Comment Threads Per FileVariable

Advanced upstream Penpot environment variable PENPOT_QUOTES_COMMENT_THREADS_PER_FILE.

Target: PENPOT_QUOTES_COMMENT_THREADS_PER_FILE

[Limits/Performance] Quotes Files Per ProjectVariable

Advanced upstream Penpot environment variable PENPOT_QUOTES_FILES_PER_PROJECT.

Target: PENPOT_QUOTES_FILES_PER_PROJECT

[Limits/Performance] Quotes Files Per TeamVariable

Advanced upstream Penpot environment variable PENPOT_QUOTES_FILES_PER_TEAM.

Target: PENPOT_QUOTES_FILES_PER_TEAM

[Limits/Performance] Quotes Font Variants Per TeamVariable

Advanced upstream Penpot environment variable PENPOT_QUOTES_FONT_VARIANTS_PER_TEAM.

Target: PENPOT_QUOTES_FONT_VARIANTS_PER_TEAM

[Limits/Performance] Quotes Invitations Per TeamVariable

Advanced upstream Penpot environment variable PENPOT_QUOTES_INVITATIONS_PER_TEAM.

Target: PENPOT_QUOTES_INVITATIONS_PER_TEAM

[Limits/Performance] Quotes Profiles Per TeamVariable

Advanced upstream Penpot environment variable PENPOT_QUOTES_PROFILES_PER_TEAM.

Target: PENPOT_QUOTES_PROFILES_PER_TEAM

[Limits/Performance] Quotes Projects Per TeamVariable

Advanced upstream Penpot environment variable PENPOT_QUOTES_PROJECTS_PER_TEAM.

Target: PENPOT_QUOTES_PROJECTS_PER_TEAM

[Limits/Performance] Quotes Snapshots Per FileVariable

Advanced upstream Penpot environment variable PENPOT_QUOTES_SNAPSHOTS_PER_FILE.

Target: PENPOT_QUOTES_SNAPSHOTS_PER_FILE

[Limits/Performance] Quotes Snapshots Per TeamVariable

Advanced upstream Penpot environment variable PENPOT_QUOTES_SNAPSHOTS_PER_TEAM.

Target: PENPOT_QUOTES_SNAPSHOTS_PER_TEAM

[Limits/Performance] Quotes Teams Per ProfileVariable

Advanced upstream Penpot environment variable PENPOT_QUOTES_TEAMS_PER_PROFILE.

Target: PENPOT_QUOTES_TEAMS_PER_PROFILE

[Limits/Performance] Quotes Team Access Requests Per RequesterVariable

Advanced upstream Penpot environment variable PENPOT_QUOTES_TEAM_ACCESS_REQUESTS_PER_REQUESTER.

Target: PENPOT_QUOTES_TEAM_ACCESS_REQUESTS_PER_REQUESTER

[Limits/Performance] Quotes Team Access Requests Per TeamVariable

Advanced upstream Penpot environment variable PENPOT_QUOTES_TEAM_ACCESS_REQUESTS_PER_TEAM.

Target: PENPOT_QUOTES_TEAM_ACCESS_REQUESTS_PER_TEAM

[Limits/Performance] Quotes Upload Chunks Per SessionVariable

Advanced upstream Penpot environment variable PENPOT_QUOTES_UPLOAD_CHUNKS_PER_SESSION.

Target: PENPOT_QUOTES_UPLOAD_CHUNKS_PER_SESSION
Default: 20
Value: 20

[Limits/Performance] Quotes Upload Sessions Per ProfileVariable

Advanced upstream Penpot environment variable PENPOT_QUOTES_UPLOAD_SESSIONS_PER_PROFILE.

Target: PENPOT_QUOTES_UPLOAD_SESSIONS_PER_PROFILE
Default: 5
Value: 5

[Cache] Redis URIVariable

Leave blank for bundled Redis-compatible cache. Set an external Redis or Valkey URI only when disabling the internal cache.

Target: PENPOT_REDIS_URI

[Auth] Registration Domain WhitelistVariable

Advanced upstream Penpot environment variable PENPOT_REGISTRATION_DOMAIN_WHITELIST.

Target: PENPOT_REGISTRATION_DOMAIN_WHITELIST

[Limits/Performance] Rpc Climit ConfigVariable

Advanced upstream Penpot environment variable PENPOT_RPC_CLIMIT_CONFIG.

Target: PENPOT_RPC_CLIMIT_CONFIG
Default: resources/climit.edn
Value: resources/climit.edn

[Limits/Performance] Rpc Rlimit ConfigVariable

Advanced upstream Penpot environment variable PENPOT_RPC_RLIMIT_CONFIG.

Target: PENPOT_RPC_RLIMIT_CONFIG
Default: resources/rlimit.edn
Value: resources/rlimit.edn

[Limits/Performance] Scheduled Executor ParallelismVariable

Advanced upstream Penpot environment variable PENPOT_SCHEDULED_EXECUTOR_PARALLELISM.

Target: PENPOT_SCHEDULED_EXECUTOR_PARALLELISM

[Core] Secret KeyVariable

Penpot master secret key. Leave blank to generate and persist a strong value on first boot. Changing this later can invalidate sessions and encrypted data.

Target: PENPOT_SECRET_KEY

[SMTP] SMTP Default FromVariable

Advanced upstream Penpot environment variable PENPOT_SMTP_DEFAULT_FROM.

Target: PENPOT_SMTP_DEFAULT_FROM
Default: Penpot <no-reply@penpot.local>
Value: Penpot <no-reply@penpot.local>

[SMTP] SMTP Default Reply ToVariable

Advanced upstream Penpot environment variable PENPOT_SMTP_DEFAULT_REPLY_TO.

Target: PENPOT_SMTP_DEFAULT_REPLY_TO
Default: Penpot <no-reply@penpot.local>
Value: Penpot <no-reply@penpot.local>

[SMTP] SMTP HostVariable

External SMTP hostname. Leave blank to use bundled Mailpit for local/lab email capture.

Target: PENPOT_SMTP_HOST

[SMTP] SMTP PasswordVariable

Advanced upstream Penpot environment variable PENPOT_SMTP_PASSWORD.

Target: PENPOT_SMTP_PASSWORD

[SMTP] SMTP PortVariable

External SMTP port. Leave blank with SMTP Host to use bundled Mailpit on internal port 1025.

Target: PENPOT_SMTP_PORT

[SMTP] SMTP SslVariable

Advanced upstream Penpot environment variable PENPOT_SMTP_SSL.

Target: PENPOT_SMTP_SSL
Default: false|true
Value: false

[SMTP] SMTP TlsVariable

Advanced upstream Penpot environment variable PENPOT_SMTP_TLS.

Target: PENPOT_SMTP_TLS
Default: false|true
Value: false

[SMTP] SMTP UsernameVariable

Advanced upstream Penpot environment variable PENPOT_SMTP_USERNAME.

Target: PENPOT_SMTP_USERNAME

[Security/SSRF] SSRF Allowed HostsVariable

Advanced upstream Penpot environment variable PENPOT_SSRF_ALLOWED_HOSTS.

Target: PENPOT_SSRF_ALLOWED_HOSTS

[Security/SSRF] SSRF Extra Blocked CidrsVariable

Advanced upstream Penpot environment variable PENPOT_SSRF_EXTRA_BLOCKED_CIDRS.

Target: PENPOT_SSRF_EXTRA_BLOCKED_CIDRS

[Storage] Storage AssetsVariable

Advanced upstream Penpot environment variable PENPOT_STORAGE_ASSETS_.

Target: PENPOT_STORAGE_ASSETS_

[Storage] Storage Assets Fs DirectoryVariable

Advanced upstream Penpot environment variable PENPOT_STORAGE_ASSETS_FS_DIRECTORY.

Target: PENPOT_STORAGE_ASSETS_FS_DIRECTORY

[Storage] Storage Assets S3 BucketVariable

Advanced upstream Penpot environment variable PENPOT_STORAGE_ASSETS_S3_BUCKET.

Target: PENPOT_STORAGE_ASSETS_S3_BUCKET

[Storage] Storage Assets S3 EndpointVariable

Advanced upstream Penpot environment variable PENPOT_STORAGE_ASSETS_S3_ENDPOINT.

Target: PENPOT_STORAGE_ASSETS_S3_ENDPOINT

[Storage] Storage Assets S3 RegionVariable

Advanced upstream Penpot environment variable PENPOT_STORAGE_ASSETS_S3_REGION.

Target: PENPOT_STORAGE_ASSETS_S3_REGION

[Telemetry] Telemetry EnabledVariable

Usage telemetry toggle. The AIO default is false for privacy-first self-hosting.

Target: PENPOT_TELEMETRY_ENABLED
Default: false|true
Value: false

[Telemetry] Telemetry RefererVariable

Advanced upstream Penpot environment variable PENPOT_TELEMETRY_REFERER.

Target: PENPOT_TELEMETRY_REFERER
Default: unraid-aio
Value: unraid-aio

[Telemetry] Telemetry URIVariable

Advanced upstream Penpot environment variable PENPOT_TELEMETRY_URI.

Target: PENPOT_TELEMETRY_URI
Default: https://telemetry.penpot.app/
Value: https://telemetry.penpot.app/

[Telemetry] Telemetry With TaigaVariable

Advanced upstream Penpot environment variable PENPOT_TELEMETRY_WITH_TAIGA.

Target: PENPOT_TELEMETRY_WITH_TAIGA
Default: false|true
Value: false

[Core] TenantVariable

Advanced upstream Penpot environment variable PENPOT_TENANT.

Target: PENPOT_TENANT
Default: default
Value: default

[Advanced Upstream] Urepl HostVariable

Advanced upstream Penpot environment variable PENPOT_UREPL_HOST.

Target: PENPOT_UREPL_HOST

[Advanced Upstream] Urepl PortVariable

Advanced upstream Penpot environment variable PENPOT_UREPL_PORT.

Target: PENPOT_UREPL_PORT

[Telemetry] User Feedback DestinationVariable

Advanced upstream Penpot environment variable PENPOT_USER_FEEDBACK_DESTINATION.

Target: PENPOT_USER_FEEDBACK_DESTINATION

[Limits/Performance] Worker Default ParallelismVariable

Advanced upstream Penpot environment variable PENPOT_WORKER_DEFAULT_PARALLELISM.

Target: PENPOT_WORKER_DEFAULT_PARALLELISM

[Telemetry] Worker Webhook ParallelismVariable

Advanced upstream Penpot environment variable PENPOT_WORKER_WEBHOOK_PARALLELISM.

Target: PENPOT_WORKER_WEBHOOK_PARALLELISM

[Flags] access-tokensVariable

Per-flag control for Penpot flag access-tokens. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_ACCESS_TOKENS
Default: default|enable|disable
Value: default

[Flags] audit-logVariable

Per-flag control for Penpot flag audit-log. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_AUDIT_LOG
Default: default|enable|disable
Value: default

[Flags] audit-log-archiveVariable

Per-flag control for Penpot flag audit-log-archive. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_AUDIT_LOG_ARCHIVE
Default: default|enable|disable
Value: default

[Flags] audit-log-gcVariable

Per-flag control for Penpot flag audit-log-gc. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_AUDIT_LOG_GC
Default: default|enable|disable
Value: default

[Flags] audit-log-loggerVariable

Per-flag control for Penpot flag audit-log-logger. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_AUDIT_LOG_LOGGER
Default: default|enable|disable
Value: default

[Flags] auto-file-snapshotVariable

Per-flag control for Penpot flag auto-file-snapshot. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_AUTO_FILE_SNAPSHOT
Default: default|enable|disable
Value: default

[Flags] backend-api-docVariable

Per-flag control for Penpot flag backend-api-doc. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_BACKEND_API_DOC
Default: default|enable|disable
Value: default

[Flags] backend-openapi-docVariable

Per-flag control for Penpot flag backend-openapi-doc. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_BACKEND_OPENAPI_DOC
Default: default|enable|disable
Value: default

[Flags] backend-svgoVariable

Per-flag control for Penpot flag backend-svgo. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_BACKEND_SVGO
Default: default|enable|disable
Value: default

[Flags] backend-workerVariable

Per-flag control for Penpot flag backend-worker. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_BACKEND_WORKER
Default: default|enable|disable
Value: default

[Flags] client-header-check-middlewareVariable

Per-flag control for Penpot flag client-header-check-middleware. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_CLIENT_HEADER_CHECK_MIDDLEWARE
Default: default|enable|disable
Value: default

[Flags] component-thumbnailsVariable

Per-flag control for Penpot flag component-thumbnails. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_COMPONENT_THUMBNAILS
Default: default|enable|disable
Value: default

[Flags] corsVariable

Per-flag control for Penpot flag cors. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_CORS
Default: default|enable|disable
Value: default

[Flags] dashboard-templates-sectionVariable

Per-flag control for Penpot flag dashboard-templates-section. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_DASHBOARD_TEMPLATES_SECTION
Default: default|enable|disable
Value: default

[Flags] demo-usersVariable

Per-flag control for Penpot flag demo-users. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_DEMO_USERS
Default: default|enable|disable
Value: default

[Flags] demo-warningVariable

Per-flag control for Penpot flag demo-warning. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_DEMO_WARNING
Default: default|enable|disable
Value: default

[Flags] email-blacklistVariable

Per-flag control for Penpot flag email-blacklist. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_EMAIL_BLACKLIST
Default: default|enable|disable
Value: default

[Flags] email-verificationVariable

Per-flag control for Penpot flag email-verification. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_EMAIL_VERIFICATION
Default: default|enable|disable
Value: default

[Flags] email-whitelistVariable

Per-flag control for Penpot flag email-whitelist. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_EMAIL_WHITELIST
Default: default|enable|disable
Value: default

[Flags] export-file-v3Variable

Per-flag control for Penpot flag export-file-v3. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_EXPORT_FILE_V3
Default: default|enable|disable
Value: default

[Flags] exporter-svgoVariable

Per-flag control for Penpot flag exporter-svgo. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_EXPORTER_SVGO
Default: default|enable|disable
Value: default

[Flags] feature-fdata-objects-mapVariable

Per-flag control for Penpot flag feature-fdata-objects-map. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_FEATURE_FDATA_OBJECTS_MAP
Default: default|enable|disable
Value: default

[Flags] file-schema-validationVariable

Per-flag control for Penpot flag file-schema-validation. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_FILE_SCHEMA_VALIDATION
Default: default|enable|disable
Value: default

[Flags] file-validationVariable

Per-flag control for Penpot flag file-validation. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_FILE_VALIDATION
Default: default|enable|disable
Value: default

[Flags] frontend-svgoVariable

Per-flag control for Penpot flag frontend-svgo. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_FRONTEND_SVGO
Default: default|enable|disable
Value: default

[Flags] google-fonts-providerVariable

Per-flag control for Penpot flag google-fonts-provider. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_GOOGLE_FONTS_PROVIDER
Default: default|enable|disable
Value: default

[Flags] hide-release-modalVariable

Per-flag control for Penpot flag hide-release-modal. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_HIDE_RELEASE_MODAL
Default: default|enable|disable
Value: default

[Flags] inspect-stylesVariable

Per-flag control for Penpot flag inspect-styles. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_INSPECT_STYLES
Default: default|enable|disable
Value: default

[Flags] log-emailsVariable

Per-flag control for Penpot flag log-emails. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_LOG_EMAILS
Default: default|enable|disable
Value: default

[Flags] log-invitation-tokensVariable

Per-flag control for Penpot flag log-invitation-tokens. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_LOG_INVITATION_TOKENS
Default: default|enable|disable
Value: default

[Flags] loginVariable

Per-flag control for Penpot flag login. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_LOGIN
Default: default|enable|disable
Value: default

[Flags] login-with-custom-ssoVariable

Per-flag control for Penpot flag login-with-custom-sso. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_LOGIN_WITH_CUSTOM_SSO
Default: default|enable|disable
Value: default

[Flags] login-with-githubVariable

Per-flag control for Penpot flag login-with-github. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_LOGIN_WITH_GITHUB
Default: default|enable|disable
Value: default

[Flags] login-with-gitlabVariable

Per-flag control for Penpot flag login-with-gitlab. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_LOGIN_WITH_GITLAB
Default: default|enable|disable
Value: default

[Flags] login-with-googleVariable

Per-flag control for Penpot flag login-with-google. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_LOGIN_WITH_GOOGLE
Default: default|enable|disable
Value: default

[Flags] login-with-ldapVariable

Per-flag control for Penpot flag login-with-ldap. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_LOGIN_WITH_LDAP
Default: default|enable|disable
Value: default

[Flags] login-with-oidcVariable

Per-flag control for Penpot flag login-with-oidc. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_LOGIN_WITH_OIDC
Default: default|enable|disable
Value: default

[Flags] login-with-passwordVariable

Per-flag control for Penpot flag login-with-password. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_LOGIN_WITH_PASSWORD
Default: default|enable|disable
Value: default

[Flags] mcpVariable

Per-flag control for Penpot flag mcp. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_MCP
Default: default|enable|disable
Value: default

[Flags] nitrateVariable

Per-flag control for Penpot flag nitrate. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_NITRATE
Default: default|enable|disable
Value: default

[Flags] nrepl-serverVariable

Per-flag control for Penpot flag nrepl-server. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_NREPL_SERVER
Default: default|enable|disable
Value: default

[Flags] oidc-registrationVariable

Per-flag control for Penpot flag oidc-registration. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_OIDC_REGISTRATION
Default: default|enable|disable
Value: default

[Flags] onboardingVariable

Per-flag control for Penpot flag onboarding. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_ONBOARDING
Default: default|enable|disable
Value: default

[Flags] perf-logsVariable

Per-flag control for Penpot flag perf-logs. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_PERF_LOGS
Default: default|enable|disable
Value: default

[Flags] prepl-serverVariable

Per-flag control for Penpot flag prepl-server. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_PREPL_SERVER
Default: default|enable|disable
Value: default

[Flags] quotesVariable

Per-flag control for Penpot flag quotes. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_QUOTES
Default: default|enable|disable
Value: default

[Flags] redis-cacheVariable

Per-flag control for Penpot flag redis-cache. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_REDIS_CACHE
Default: default|enable|disable
Value: default

[Flags] registrationVariable

Per-flag control for Penpot flag registration. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_REGISTRATION
Default: default|enable|disable
Value: default

[Flags] render-wasm-dprVariable

Per-flag control for Penpot flag render-wasm-dpr. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_RENDER_WASM_DPR
Default: default|enable|disable
Value: default

[Flags] rpc-climitVariable

Per-flag control for Penpot flag rpc-climit. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_RPC_CLIMIT
Default: default|enable|disable
Value: default

[Flags] rpc-rlimitVariable

Per-flag control for Penpot flag rpc-rlimit. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_RPC_RLIMIT
Default: default|enable|disable
Value: default

[Flags] sec-fetch-metadata-middlewareVariable

Per-flag control for Penpot flag sec-fetch-metadata-middleware. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_SEC_FETCH_METADATA_MIDDLEWARE
Default: default|enable|disable
Value: default

[Flags] secure-session-cookiesVariable

Per-flag control for Penpot flag secure-session-cookies. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_SECURE_SESSION_COOKIES
Default: default|enable|disable
Value: default

[Flags] smtpVariable

Per-flag control for Penpot flag smtp. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_SMTP
Default: default|enable|disable
Value: default

[Flags] smtp-debugVariable

Per-flag control for Penpot flag smtp-debug. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_SMTP_DEBUG
Default: default|enable|disable
Value: default

[Flags] soft-file-schema-validationVariable

Per-flag control for Penpot flag soft-file-schema-validation. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_SOFT_FILE_SCHEMA_VALIDATION
Default: default|enable|disable
Value: default

[Flags] soft-file-validationVariable

Per-flag control for Penpot flag soft-file-validation. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_SOFT_FILE_VALIDATION
Default: default|enable|disable
Value: default

[Flags] soft-quotesVariable

Per-flag control for Penpot flag soft-quotes. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_SOFT_QUOTES
Default: default|enable|disable
Value: default

[Flags] soft-rpc-rlimitVariable

Per-flag control for Penpot flag soft-rpc-rlimit. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_SOFT_RPC_RLIMIT
Default: default|enable|disable
Value: default

[Flags] strict-session-cookiesVariable

Per-flag control for Penpot flag strict-session-cookies. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_STRICT_SESSION_COOKIES
Default: default|enable|disable
Value: default

[Flags] subscriptionsVariable

Per-flag control for Penpot flag subscriptions. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_SUBSCRIPTIONS
Default: default|enable|disable
Value: default

[Flags] subscriptions-oldVariable

Per-flag control for Penpot flag subscriptions-old. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_SUBSCRIPTIONS_OLD
Default: default|enable|disable
Value: default

[Flags] telemetryVariable

Per-flag control for Penpot flag telemetry. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_TELEMETRY
Default: default|enable|disable
Value: default

[Flags] terms-and-privacy-checkboxVariable

Per-flag control for Penpot flag terms-and-privacy-checkbox. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_TERMS_AND_PRIVACY_CHECKBOX
Default: default|enable|disable
Value: default

[Flags] tiered-file-data-storageVariable

Per-flag control for Penpot flag tiered-file-data-storage. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_TIERED_FILE_DATA_STORAGE
Default: default|enable|disable
Value: default

[Flags] token-base-font-sizeVariable

Per-flag control for Penpot flag token-base-font-size. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_TOKEN_BASE_FONT_SIZE
Default: default|enable|disable
Value: default

[Flags] token-colorVariable

Per-flag control for Penpot flag token-color. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_TOKEN_COLOR
Default: default|enable|disable
Value: default

[Flags] token-shadowVariable

Per-flag control for Penpot flag token-shadow. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_TOKEN_SHADOW
Default: default|enable|disable
Value: default

[Flags] token-tokenscriptVariable

Per-flag control for Penpot flag token-tokenscript. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_TOKEN_TOKENSCRIPT
Default: default|enable|disable
Value: default

[Flags] transit-readable-responseVariable

Per-flag control for Penpot flag transit-readable-response. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_TRANSIT_READABLE_RESPONSE
Default: default|enable|disable
Value: default

[Flags] urepl-serverVariable

Per-flag control for Penpot flag urepl-server. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_UREPL_SERVER
Default: default|enable|disable
Value: default

[Flags] user-feedbackVariable

Per-flag control for Penpot flag user-feedback. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_USER_FEEDBACK
Default: default|enable|disable
Value: default

[Flags] v2-migrationVariable

Per-flag control for Penpot flag v2-migration. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_V2_MIGRATION
Default: default|enable|disable
Value: default

[Flags] webhooksVariable

Per-flag control for Penpot flag webhooks. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank.

Target: PENPOT_AIO_FLAG_WEBHOOKS
Default: default|enable|disable
Value: default

Links

Template Support Docker Hub Project

Details

Repository

jsonbored/penpot-aio:latest

Registry

https://hub.docker.com/r/jsonbored/penpot-aio

Last Updated2026-05-23

First Seen2026-05-20

Run penpot-aio on Unraid.

penpot-aio is listed in Community Apps for Unraid OS. Explore Unraid to build a flexible home server, NAS, or homelab.

Explore Unraid OS