Host port to expose. Change if 8088 clashes with another container.

Target

8088

Default

8088

Value

8088

Holds the SQLite database (wealthfolio.db) and the encrypted secrets file. BACK THIS UP.

Target

/data

Default

/mnt/user/appdata/wealthfolio

Value

/mnt/user/appdata/wealthfolio

REQUIRED. 32-byte key used to encrypt secrets at rest and sign session tokens. Generate ONCE with: openssl rand -base64 32 -- then save it somewhere safe. Losing it means losing all stored API keys and broker credentials.

Required for password login unless using OIDC SSO or WF_AUTH_REQUIRED=false. Argon2id PHC hash of your login password. Generate with: printf '%s' 'your-password' | argon2 yoursalt16chars -id -e -- then paste the full argon2id PHC string here.

REQUIRED when auth is enabled. Comma-separated list of origins allowed to call the API. Must EXACTLY match the URL in your browser address bar (scheme, host, and port). Example: http://192.168.1.10:8088 or https://wealthfolio.example.com

Set to false only if a reverse proxy handles authentication and you are not using Wealthfolio login or SSO. Reverse-proxy-only auth does not satisfy MCP: WF_MCP_ENABLED=true still requires WF_AUTH_PASSWORD_HASH or OIDC.

Default

true

Value

true

Session access token lifetime in minutes.

Default

60

Value

60

Optional SSO. OIDC issuer URL, for example https://auth.example.com/application/o/wealthfolio/. OIDC is enabled when this and WF_OIDC_CLIENT_ID are both set.

Optional SSO. Client ID registered with your OIDC provider. Required when WF_OIDC_ISSUER_URL is set.

Optional SSO. Client secret if your OIDC provider requires one. PKCE is always used, so many providers can leave this blank.

Required when OIDC is enabled. Must be registered in your identity provider. Example: https://wealthfolio.example.com/api/v1/auth/oidc/callback

Optional SSO. Space-separated scopes. Leave blank for the default: openid email profile.

Optional SSO allowlist. Comma-separated verified email addresses allowed to sign in. OIDC requires this and/or WF_OIDC_ALLOWED_SUBS unless WF_OIDC_ALLOW_ANY=true.

Optional SSO allowlist. Comma-separated OIDC subject IDs allowed to sign in. Preferred over email allowlists when available.

Optional SSO. Set true only to allow any user authenticated by your identity provider. Only safe on a dedicated single-user identity provider.

Optional SSO logout. URL where the identity provider returns the browser after logout. Must be registered with the provider if set.

Optional SSO logout. Set false to force local-only logout even when the identity provider supports RP-initiated logout. Default is true.

Default

true

Value

true

Enable AI Agent Access (MCP) at /mcp. Requires Wealthfolio auth via WF_AUTH_PASSWORD_HASH or OIDC. The container refuses to start with MCP enabled if WF_AUTH_REQUIRED=false and no app auth is configured.

Default

false

Value

false

When MCP is enabled, write agent tool calls to the audit log. Set false to disable new audit entries.

Default

true

Value

true

HTTP request timeout in milliseconds. Default is 5 minutes -- generous to accommodate large broker syncs.

Default

300000

Value

300000

Bind address inside the container. Leave at 0.0.0.0:8088 unless you know what you are doing.

Default

0.0.0.0:8088

Value

0.0.0.0:8088

SQLite database path inside the container. Must live under /data so it persists.

Default

/data/wealthfolio.db

Value

/data/wealthfolio.db

Log format: text (human-readable) or json (structured).

Default

text

Value

text