Primary persistent directory for PostgreSQL, Redis, DKIM keys, uploads, generated JWT keys, and application state.

Target

/appdata

Default

/mnt/user/appdata/simplelogin-aio

Value

/mnt/user/appdata/simplelogin-aio

Persistent directory for your GnuPG keyring and optional server-generated PGP signing keys.

Target

/pgp

Default

/mnt/user/appdata/simplelogin-aio/pgp

Optional host path mounted at /custom-assets for advanced file-based settings such as custom words lists, OpenID keys, Paddle public keys, or imported PGP material.

Target

/custom-assets

Port used by the SimpleLogin web UI.

Target

7777

Default

7777

Value

7777

Inbound SMTP port. Forward TCP 25 from your router or firewall to the Unraid host if you want aliases to receive internet mail.

Target

25

Default

25

Value

25

Canonical HTTPS URL for the dashboard, for example https://app.example.com. This does not need to be the same as your SMTP/MX hostname.

Target

URL

Default

https://app.example.com

Real public alias domain, for example example.com. Do not use a private-only tailnet domain here. First-account registration must use a separate existing mailbox, not this alias domain.

Target

EMAIL_DOMAIN

Default

example.com

Working mailbox used for system mail, for example support@example.com. Use an address that already exists.

Target

SUPPORT_EMAIL

Default

support@example.com

Long random app secret. Generate with: openssl rand -hex 32

Target

FLASK_SECRET

Outbound mail mode. Choose one of the built-in dropdown values only: direct, brevo, protonmail, gmail, mailgun, or custom. Use a relay provider if your ISP blocks outbound TCP 25.

Target

RELAY_MODE

Default

direct|brevo|protonmail|gmail|mailgun|custom

Value

direct

Brevo SMTP username, usually your account email. Required when RELAY_MODE=brevo.

Target

BREVO_USERNAME

Brevo SMTP key or password. Required when RELAY_MODE=brevo.

Target

BREVO_PASSWORD

Proton SMTP token. Required when RELAY_MODE=protonmail. The username stays SUPPORT_EMAIL.

Target

PROTONMAIL_TOKEN

Full Gmail address used for relay auth. Required when RELAY_MODE=gmail.

Target

GMAIL_USERNAME

16-character Gmail app password. Required when RELAY_MODE=gmail.

Target

GMAIL_APP_PASSWORD

Mailgun SMTP username, usually postmaster@yourdomain. Required when RELAY_MODE=mailgun.

Target

MAILGUN_USERNAME

Mailgun SMTP password. Required when RELAY_MODE=mailgun.

Target

MAILGUN_PASSWORD

Required when RELAY_MODE=custom. Example: [smtp.provider.com]:587

Target

CUSTOM_RELAYHOST

SMTP username for your custom relay. Required when RELAY_MODE=custom.

Target

CUSTOM_USERNAME

SMTP password for your custom relay. Required when RELAY_MODE=custom.

Target

CUSTOM_PASSWORD

Leave blank for the bundled database. When set to an external host, the bundled PostgreSQL stays idle. Format: postgresql://user:pass@host:5432/dbname

Target

DB_URI

Leave blank for the bundled Redis. When set to an external host, the bundled Redis stays idle. Format: redis://:pass@host:6379/0

Target

REDIS_URL

Advanced escape hatch. Leave at 127.0.0.1 to keep the bundled Postfix path.

Target

POSTFIX_SERVER

Default

127.0.0.1

Value

127.0.0.1

Advanced escape hatch. Leave at 25 for the bundled Postfix path.

Target

POSTFIX_PORT

Default

25

Value

25

Comma-separated resolvers used for lookups, for example 1.1.1.1,1.0.0.1.

Target

NAMESERVERS

Default

1.1.1.1,1.0.0.1

Value

1.1.1.1,1.0.0.1

Optional temp directory path inside the container or a mounted path.

Target

TEMP_DIR

Advanced path override for the words file used for random alias generation. Use /custom-assets if you mount your own file.

Target

WORDS_FILE_PATH

Default

/code/local_data/test_words.txt

Value

/code/local_data/test_words.txt

Leave true for local file storage inside /appdata.

Target

LOCAL_FILE_UPLOAD

Default

true|false

Value

true

GnuPG home directory path used for PGP features.

Target

GNUPGHOME

Default

/pgp

Value

/pgp

Optional partner token secret. Generate with: openssl rand -hex 32. Blank uses FLASK_SECRET.

Target

PARTNER_API_TOKEN_SECRET

Recommended default. Keep true to block public sign-up. Temporarily switch to false only while creating a first account, then set true again and restart.

Target

DISABLE_REGISTRATION

Default

true|false

Value

true

Recommended for self-hosted installs.

Target

DISABLE_ONBOARDING

Default

true|false

Value

true

Recommended for self-hosted installs to allow cleaner aliases without the random suffix.

Target

DISABLE_ALIAS_SUFFIX

Default

true|false

Value

true

Enable SPF enforcement using the extra headers provided by Postfix.

Target

ENFORCE_SPF

Default

true|false

Value

true

For testing only. When true, email bodies are logged instead of sent.

Target

NOT_SEND_EMAIL

Default

false|true

Value

false

Optional colored log output for debugging.

Target

COLOR_LOG

General stats and admin alert email recipient. This is not a login credential.

Target

ADMIN_EMAIL

Display name used alongside SUPPORT_EMAIL.

Target

SUPPORT_NAME

Postmaster email used by some mail-related features.

Target

POSTMASTER

Max number of emails a non-premium user can generate.

Target

MAX_NB_EMAIL_FREE_PLAN

Default

10

Value

10

Alias creation rate limit. Example: 100/day;50/hour;5/minute

Target

ALIAS_LIMIT

Optional automatic alias disable behavior.

Target

ALIAS_AUTOMATIC_DISABLE

JSON list of allowed redirect domains. Example: ["app.example.com"]

Target

ALLOWED_REDIRECT_DOMAINS

Optional landing page URL shown by the app.

Target

LANDING_PAGE_URL

Optional status page URL shown by the app.

Target

STATUS_PAGE_URL

hCaptcha secret key from your hCaptcha site. Set both hCaptcha fields to enable.

Target

HCAPTCHA_SECRET

hCaptcha site key from your hCaptcha site. Set both hCaptcha fields to enable.

Target

HCAPTCHA_SITEKEY

Leave blank to auto-use mail.EMAIL_DOMAIN. Set this only if your MX host should be something else, for example [(10, "mx.example.com.")].

Target

EMAIL_SERVERS_WITH_PRIORITY

JSON list of extra alias domains. Example: ["example.net","example.org"]

Target

OTHER_ALIAS_DOMAINS

Full alias-domain override as a JSON list. If set, it replaces OTHER_ALIAS_DOMAINS.

Target

ALIAS_DOMAINS

JSON list of premium-only domains. Example: ["vip.example.com"]

Target

PREMIUM_ALIAS_DOMAINS

Alias domain used when creating the first alias.

Target

FIRST_ALIAS_DOMAIN

VERP bounce prefix. Must end with + if used.

Target

BOUNCE_PREFIX

VERP bounce suffix. Must start with + if used.

Target

BOUNCE_SUFFIX

Reply-phase bounce prefix without a trailing +.

Target

BOUNCE_PREFIX_FOR_REPLY_PHASE

GitHub OAuth app client ID.

Target

GITHUB_CLIENT_ID

GitHub OAuth app client secret.

Target

GITHUB_CLIENT_SECRET

Google OAuth client ID.

Target

GOOGLE_CLIENT_ID

Google OAuth client secret.

Target

GOOGLE_CLIENT_SECRET

Facebook OAuth client ID.

Target

FACEBOOK_CLIENT_ID

Facebook OAuth client secret.

Target

FACEBOOK_CLIENT_SECRET

Proton OAuth client ID.

Target

PROTON_CLIENT_ID

Proton OAuth client secret.

Target

PROTON_CLIENT_SECRET

Proton API base URL override.

Target

PROTON_BASE_URL

Certificate verification for Proton integration.

Target

PROTON_VALIDATE_CERTS

Default

true|false

Value

true

Enable Proton login integration.

Target

CONNECT_WITH_PROTON

Cookie name for Proton login integration.

Target

CONNECT_WITH_PROTON_COOKIE_NAME

Font Awesome icon slug for generic OIDC login button.

Target

CONNECT_WITH_OIDC_ICON

OIDC discovery URL, usually ending in /.well-known/openid-configuration.

Target

OIDC_WELL_KNOWN_URL

Space-separated OIDC scopes. Default works for most providers.

Target

OIDC_SCOPES

Default

openid email profile

Value

openid email profile

OIDC user-info field used for display name.

Target

OIDC_NAME_FIELD

Default

name

Value

name

OIDC client ID.

Target

OIDC_CLIENT_ID

OIDC client secret.

Target

OIDC_CLIENT_SECRET

Set to 1 to enable SimpleLogin as an OpenID provider.

Target

ENABLE_OIDC_SERVER

Default

0|1

Value

0

Optional OpenID private key path. Blank auto-generates when ENABLE_OIDC_SERVER=1.

Target

OPENID_PRIVATE_KEY_PATH

Optional OpenID public key path matching the private key above.

Target

OPENID_PUBLIC_KEY_PATH

Apple sign-in API secret.

Target

APPLE_API_SECRET

Apple sign-in secret for the native Mac app.

Target

MACAPP_APPLE_API_SECRET

Sentry DSN for backend error tracking.

Target

SENTRY_DSN

Optional separate Sentry DSN for front-end error tracking.

Target

SENTRY_FRONT_END_DSN

Plausible Analytics host.

Target

PLAUSIBLE_HOST

Plausible tracked domain.

Target

PLAUSIBLE_DOMAIN

Optional Flask profiler sqlite path.

Target

FLASK_PROFILER_PATH

Optional Flask profiler password.

Target

FLASK_PROFILER_PASSWORD

Set to 1 to enable SpamAssassin integration.

Target

ENABLE_SPAM_ASSASSIN

Default

0|1

Value

0

SpamAssassin server host or IP.

Target

SPAMASSASSIN_HOST

How often to check Have I Been Pwned data.

Target

HIBP_SCAN_INTERVAL_DAYS

Default

7

Value

7

JSON list of HIBP API keys. Example: ["key1","key2"]

Target

HIBP_API_KEYS

Set to 1 to auto-generate a PGP server key pair.

Target

AUTO_GENERATE_PGP

Default

0|1

Value

0

Optional path to a private PGP key used to sign forwarding emails. Use /custom-assets or /pgp if you provide your own key.

Target

PGP_SENDER_PRIVATE_KEY_PATH

Advanced DKIM private key path override. Leave at /dkim.key for the wrapper-managed default.

Target

DKIM_PRIVATE_KEY_PATH

Default

/dkim.key

Value

/dkim.key

Bucket name used by upstream S3-backed features.

Target

BUCKET

AWS or S3-compatible access key ID.

Target

AWS_ACCESS_KEY_ID

AWS or S3-compatible secret access key.

Target

AWS_SECRET_ACCESS_KEY

AWS region.

Target

AWS_REGION

Paddle vendor ID.

Target

PADDLE_VENDOR_ID

Paddle monthly product ID.

Target

PADDLE_MONTHLY_PRODUCT_ID

Paddle yearly product ID.

Target

PADDLE_YEARLY_PRODUCT_ID

Path to your Paddle public key file, for example /custom-assets/paddle_public.pem.

Target

PADDLE_PUBLIC_KEY_PATH

Paddle auth code.

Target

PADDLE_AUTH_CODE

Coinbase webhook secret.

Target

COINBASE_WEBHOOK_SECRET

Coinbase checkout ID.

Target

COINBASE_CHECKOUT_ID

Coinbase API key.

Target

COINBASE_API_KEY

Coinbase yearly price value.

Target

COINBASE_YEARLY_PRICE

Expert-only alternate dotenv file path. Usually leave blank and use the template fields instead.

Target

CONFIG

Optional monitoring report email recipient.

Target

MONITORING_EMAIL

Optional address that receives unsubscribe requests.

Target

UNSUBSCRIBER

Legacy alias for unsubscribe routing.

Target

OLD_UNSUBSCRIBER

Comma-separated users allowed to use HTTP unsubscribe.

Target

USERS_WITH_HTTP_UNSUBSCRIBE

Legacy free-plan alias cap used for old accounts.

Target

MAX_NB_EMAIL_OLD_FREE_PLAN

Optional PostgreSQL application_name override.

Target

DB_CONN_NAME

Optional custom S3-compatible endpoint URL.

Target

AWS_ENDPOINT_URL

JSON list of extra Paddle monthly product IDs. Example: [12345,67890]

Target

PADDLE_MONTHLY_PRODUCT_IDS

JSON list of extra Paddle yearly product IDs. Example: [12345,67890]

Target

PADDLE_YEARLY_PRODUCT_IDS

Optional Paddle coupon product ID.

Target

PADDLE_COUPON_ID

Optional Proton integration header name override.

Target

PROTON_EXTRA_HEADER_NAME

Optional Proton integration header value.

Target

PROTON_EXTRA_HEADER_VALUE

Presence-based upstream flag. Set true to prevent linked Proton account changes.

Target

PROTON_PREVENT_CHANGE_LINKED_ACCOUNT

Default

false|true

Value

false

Optional Sentry trace sample rate. Example: 0.001

Target

SENTRY_TRACE_RATE

Comma-separated backup outbound SMTP servers.

Target

POSTFIX_BACKUP_SERVERS

Presence-based upstream flag. Set true to use Postfix submission with TLS on port 587.

Target

POSTFIX_SUBMISSION_TLS

Default

false|true

Value

false

Postfix send timeout in seconds.

Target

POSTFIX_TIMEOUT

Postfix connect timeout in seconds.

Target

POSTFIX_CONNECT_TIMEOUT

Comma-separated Proton MX servers.

Target

PROTON_MX_SERVERS

Comma-separated Proton email domains.

Target

PROTON_EMAIL_DOMAINS

Presence-based upstream flag for niche local PGP loading behavior.

Target

LOAD_PGP_EMAIL_HANDLER

Default

false|true

Value

false

Presence-based upstream flag to validate Apple webhook shared secret.

Target

APPLE_WEBHOOK_SECRET_CHECK_ENABLED

Default

false|true

Value

false

SpamAssassin spam score threshold for forwarded mail.

Target

MAX_SPAM_SCORE

SpamAssassin spam score threshold for reply-phase mail.

Target

MAX_REPLY_PHASE_SPAM_SCORE

Optional signer address used for outgoing encrypted email.

Target

PGP_SIGNER

Formatted no-reply address override.

Target

NOREPLY

Formatted partner no-reply address override.

Target

PARTNER_NOREPLY

Have I Been Pwned requests-per-minute limit.

Target

HIBP_API_RPM

Optional HIBP behavior override for partner aliases.

Target

HIBP_SKIP_PARTNER_ALIAS

Optional directory where unsent emails are stored.

Target

SAVE_UNSENT_DIR

Presence-based upstream flag indicating DKIM signing is handled by Rspamd.

Target

RSPAMD_SIGN_DKIM

Default

false|true

Value

false

Optional Twilio auth token for phone-related integrations.

Target

TWILIO_AUTH_TOKEN

Optional phone provider secret.

Target

PHONE_PROVIDER_1_SECRET

Optional phone provider header name.

Target

PHONE_PROVIDER_2_HEADER

Optional phone provider secret.

Target

PHONE_PROVIDER_2_SECRET

Optional Zendesk host for support integrations.

Target

ZENDESK_HOST

Optional Zendesk API token.

Target

ZENDESK_API_TOKEN

Presence-based upstream flag to enable Zendesk integration.

Target

ZENDESK_ENABLED

Default

false|true

Value

false

Presence-based upstream flag to enable DMARC checks.

Target

DMARC_CHECK_ENABLED

Default

false|true

Value

false

VERP prefix override.

Target

VERP_PREFIX

Custom VERP secret. Generate with: openssl rand -hex 32. Must be at least 32 chars.

Target

VERP_EMAIL_SECRET

Optional transactional bounce prefix.

Target

TRANSACTIONAL_BOUNCE_PREFIX

Optional transactional bounce suffix.

Target

TRANSACTIONAL_BOUNCE_SUFFIX

Alias transfer token secret. Generate with: openssl rand -hex 32

Target

ALIAS_TRANSFER_TOKEN_SECRET

Optional upstream behavior override for free-user contact creation.

Target

DISABLE_CREATE_CONTACTS_FOR_FREE_USERS

Length of generated alias random suffix.

Target

ALIAS_RAND_SUFFIX_LENGTH

Optional event webhook destination URL.

Target

EVENT_WEBHOOK

Presence-based upstream flag to skip SSL verification for the event webhook.

Target

EVENT_WEBHOOK_SKIP_VERIFY_SSL

Default

false|true

Value

false

Presence-based upstream flag to disable event webhooks.

Target

EVENT_WEBHOOK_DISABLE

Default

false|true

Value

false

Comma-separated user IDs allowed to emit event webhooks.

Target

EVENT_WEBHOOK_ENABLED_USER_IDS

Optional dedicated DB URI for the event listener.

Target

EVENT_LISTENER_DB_URI

Maximum number of API keys per user.

Target

MAX_API_KEYS

Optional memory store URI override.

Target

MEM_STORE_URI

Recovery-code HMAC secret. Generate with: openssl rand -hex 32. Must be at least 16 chars.

Target

RECOVERY_CODE_HMAC_SECRET

Rspamd score threshold for quarantining DMARC-failed email.

Target

MIN_RSPAMD_SCORE_FOR_FAILED_DMARC

Presence-based upstream flag to replace all reverse aliases.

Target

ENABLE_ALL_REVERSE_ALIAS_REPLACEMENT

Default

false|true

Value

false

Maximum reverse aliases replaced when the related feature is enabled.

Target

MAX_NB_REVERSE_ALIAS_REPLACEMENT

Presence-based upstream flag to disable rate limiting.

Target

DISABLE_RATE_LIMIT

Default

false|true

Value

false

Free-user alias create rate limits in hits,seconds:hits,seconds format.

Target

ALIAS_CREATE_RATE_LIMIT_FREE

Paid-user alias create rate limits in hits,seconds:hits,seconds format.

Target

ALIAS_CREATE_RATE_LIMIT_PAID

Single-alias restore rate limits in hits,seconds:hits,seconds format.

Target

ALIAS_RESTORE_ONE_RATE_LIMIT

Bulk alias restore rate limits in hits,seconds:hits,seconds format.

Target

ALIAS_RESTORE_ALL_RATE_LIMIT

Maximum daily bounces before automatic handling triggers.

Target

MAX_BOUNCES_1D

Maximum weekly bounces before automatic handling triggers.

Target

MAX_BOUNCES_1W

Expert partner mapping in key=value;key=value format. Example: a.com=x.com;b.com=y.com

Target

PARTNER_DNS_CUSTOM_DOMAINS

Expert validation prefixes in key=value;key=value format.

Target

PARTNER_CUSTOM_DOMAIN_VALIDATION_PREFIXES

Optional mailbox verification override code for controlled environments.

Target

MAILBOX_VERIFICATION_OVERRIDE_CODE

Maximum audit log retention in days.

Target

AUDIT_LOG_MAX_DAYS

Days before trashed aliases are purged.

Target

ALIAS_TRASH_DAYS

Comma-separated allowed OAuth callback schemes.

Target

ALLOWED_OAUTH_SCHEMES

Maximum forward recipients per email.

Target

MAX_EMAIL_FORWARD_RECIPIENTS

Hex-encoded master encryption key. Generate with: openssl rand -hex 32

Target

MASTER_ENC_KEY_HEX

Hex-encoded MAC key. Generate with: openssl rand -hex 32

Target

MAC_KEY_HEX

Hex-encoded HKDF salt. Generate with: openssl rand -hex 32

Target

ABUSER_HKDF_SALT

Comma-separated invalid MX IPs ignored by validation logic.

Target

INVALID_MX_IPS

Presence-based upstream flag to use the Rust PGP implementation.

Target

USE_RUST_PGP

Default

false|true

Value

false

Maximum SMTP message size in bytes.

Target

SMTP_SIZE_LIMIT

Optional partner support URL shown by the app.

Target

PARTNER_SUPPORT_URL

Admin FIDO requirement. Choose one of the built-in dropdown values only: none, any, or hardware. Leave this at none unless you already intend to enforce admin FIDO or security keys.

Target

ADMIN_FIDO_REQUIRED

Default

none|any|hardware

Value

none

Admin grace period in seconds before FIDO enforcement.

Target

ADMIN_GRACE_PERIOD

Presence-based upstream flag to drop PGP key attachments on reply.

Target

DROP_PGP_KEY_ATTACHMENTS_ON_REPLY

Default

false|true

Value

false

Optional UpCloud username for niche upstream integrations.

Target

UPCLOUD_USERNAME

Optional UpCloud password for niche upstream integrations.

Target

UPCLOUD_PASSWORD

Optional UpCloud database ID for niche upstream integrations.

Target

UPCLOUD_DB_ID

Presence-based upstream flag to store transactional emails.

Target

STORE_TRANSACTIONAL_EMAILS

Default

false|true

Value

false