Primary persistent directory for PostgreSQL, Redis, DKIM keys, uploads, generated JWT keys, and application state.

Ziel

/appdata

Standard

/mnt/user/appdata/simplelogin-aio

Wert

/mnt/user/appdata/simplelogin-aio

Persistent directory for your GnuPG keyring and optional server-generated PGP signing keys.

Ziel

/pgp

Standard

/mnt/user/appdata/simplelogin-aio/pgp

Optional host path mounted at /custom-assets for advanced file-based settings such as custom words lists, OpenID keys, Paddle public keys, or imported PGP material.

Ziel

/custom-assets

Port used by the SimpleLogin web UI.

Ziel

7777

Standard

7777

Wert

7777

Inbound SMTP port. Forward TCP 25 from your router or firewall to the Unraid host if you want aliases to receive internet mail.

Ziel

25

Standard

25

Wert

25

Canonical HTTPS URL for the dashboard, for example https://app.example.com. This does not need to be the same as your SMTP/MX hostname.

Ziel

URL

Standard

https://app.example.com

Real public alias domain, for example example.com. Do not use a private-only tailnet domain here. First-account registration must use a separate existing mailbox, not this alias domain.

Ziel

EMAIL_DOMAIN

Standard

example.com

Working mailbox used for system mail, for example support@example.com. Use an address that already exists.

Ziel

SUPPORT_EMAIL

Standard

support@example.com

Long random app secret. Generate with: openssl rand -hex 32

Ziel

FLASK_SECRET

Outbound mail mode. Choose one of the built-in dropdown values only: direct, brevo, protonmail, gmail, mailgun, or custom. Use a relay provider if your ISP blocks outbound TCP 25.

Ziel

RELAY_MODE

Standard

direct|brevo|protonmail|gmail|mailgun|custom

Wert

direct

Brevo SMTP username, usually your account email. Required when RELAY_MODE=brevo.

Ziel

BREVO_USERNAME

Brevo SMTP key or password. Required when RELAY_MODE=brevo.

Ziel

BREVO_PASSWORD

Proton SMTP token. Required when RELAY_MODE=protonmail. The username stays SUPPORT_EMAIL.

Ziel

PROTONMAIL_TOKEN

Full Gmail address used for relay auth. Required when RELAY_MODE=gmail.

Ziel

GMAIL_USERNAME

16-character Gmail app password. Required when RELAY_MODE=gmail.

Ziel

GMAIL_APP_PASSWORD

Mailgun SMTP username, usually postmaster@yourdomain. Required when RELAY_MODE=mailgun.

Ziel

MAILGUN_USERNAME

Mailgun SMTP password. Required when RELAY_MODE=mailgun.

Ziel

MAILGUN_PASSWORD

Required when RELAY_MODE=custom. Example: [smtp.provider.com]:587

Ziel

CUSTOM_RELAYHOST

SMTP username for your custom relay. Required when RELAY_MODE=custom.

Ziel

CUSTOM_USERNAME

SMTP password for your custom relay. Required when RELAY_MODE=custom.

Ziel

CUSTOM_PASSWORD

Leave blank for the bundled database. When set to an external host, the bundled PostgreSQL stays idle. Format: postgresql://user:pass@host:5432/dbname

Ziel

DB_URI

Leave blank for the bundled Redis. When set to an external host, the bundled Redis stays idle. Format: redis://:pass@host:6379/0

Ziel

REDIS_URL

Advanced escape hatch. Leave at 127.0.0.1 to keep the bundled Postfix path.

Ziel

POSTFIX_SERVER

Standard

127.0.0.1

Wert

127.0.0.1

Advanced escape hatch. Leave at 25 for the bundled Postfix path.

Ziel

POSTFIX_PORT

Standard

25

Wert

25

Comma-separated resolvers used for lookups, for example 1.1.1.1,1.0.0.1.

Ziel

NAMESERVERS

Standard

1.1.1.1,1.0.0.1

Wert

1.1.1.1,1.0.0.1

Optional temp directory path inside the container or a mounted path.

Ziel

TEMP_DIR

Advanced path override for the words file used for random alias generation. Use /custom-assets if you mount your own file.

Ziel

WORDS_FILE_PATH

Standard

/code/local_data/test_words.txt

Wert

/code/local_data/test_words.txt

Leave true for local file storage inside /appdata.

Ziel

LOCAL_FILE_UPLOAD

Standard

true|false

Wert

true

GnuPG home directory path used for PGP features.

Ziel

GNUPGHOME

Standard

/pgp

Wert

/pgp

Optional partner token secret. Generate with: openssl rand -hex 32. Blank uses FLASK_SECRET.

Ziel

PARTNER_API_TOKEN_SECRET

Recommended default. Keep true to block public sign-up. Temporarily switch to false only while creating a first account, then set true again and restart.

Ziel

DISABLE_REGISTRATION

Standard

true|false

Wert

true

Recommended for self-hosted installs.

Ziel

DISABLE_ONBOARDING

Standard

true|false

Wert

true

Recommended for self-hosted installs to allow cleaner aliases without the random suffix.

Ziel

DISABLE_ALIAS_SUFFIX

Standard

true|false

Wert

true

Enable SPF enforcement using the extra headers provided by Postfix.

Ziel

ENFORCE_SPF

Standard

true|false

Wert

true

For testing only. When true, email bodies are logged instead of sent.

Ziel

NOT_SEND_EMAIL

Standard

false|true

Wert

false

Optional colored log output for debugging.

Ziel

COLOR_LOG

General stats and admin alert email recipient. This is not a login credential.

Ziel

ADMIN_EMAIL

Display name used alongside SUPPORT_EMAIL.

Ziel

SUPPORT_NAME

Postmaster email used by some mail-related features.

Ziel

POSTMASTER

Max number of emails a non-premium user can generate.

Ziel

MAX_NB_EMAIL_FREE_PLAN

Standard

10

Wert

10

Alias creation rate limit. Example: 100/day;50/hour;5/minute

Ziel

ALIAS_LIMIT

Optional automatic alias disable behavior.

Ziel

ALIAS_AUTOMATIC_DISABLE

JSON list of allowed redirect domains. Example: ["app.example.com"]

Ziel

ALLOWED_REDIRECT_DOMAINS

Optional landing page URL shown by the app.

Ziel

LANDING_PAGE_URL

Optional status page URL shown by the app.

Ziel

STATUS_PAGE_URL

hCaptcha secret key from your hCaptcha site. Set both hCaptcha fields to enable.

Ziel

HCAPTCHA_SECRET

hCaptcha site key from your hCaptcha site. Set both hCaptcha fields to enable.

Ziel

HCAPTCHA_SITEKEY

Leave blank to auto-use mail.EMAIL_DOMAIN. Set this only if your MX host should be something else, for example [(10, "mx.example.com.")].

Ziel

EMAIL_SERVERS_WITH_PRIORITY

JSON list of extra alias domains. Example: ["example.net","example.org"]

Ziel

OTHER_ALIAS_DOMAINS

Full alias-domain override as a JSON list. If set, it replaces OTHER_ALIAS_DOMAINS.

Ziel

ALIAS_DOMAINS

JSON list of premium-only domains. Example: ["vip.example.com"]

Ziel

PREMIUM_ALIAS_DOMAINS

Alias domain used when creating the first alias.

Ziel

FIRST_ALIAS_DOMAIN

VERP bounce prefix. Must end with + if used.

Ziel

BOUNCE_PREFIX

VERP bounce suffix. Must start with + if used.

Ziel

BOUNCE_SUFFIX

Reply-phase bounce prefix without a trailing +.

Ziel

BOUNCE_PREFIX_FOR_REPLY_PHASE

GitHub OAuth app client ID.

Ziel

GITHUB_CLIENT_ID

GitHub OAuth app client secret.

Ziel

GITHUB_CLIENT_SECRET

Google OAuth client ID.

Ziel

GOOGLE_CLIENT_ID

Google OAuth client secret.

Ziel

GOOGLE_CLIENT_SECRET

Facebook OAuth client ID.

Ziel

FACEBOOK_CLIENT_ID

Facebook OAuth client secret.

Ziel

FACEBOOK_CLIENT_SECRET

Proton OAuth client ID.

Ziel

PROTON_CLIENT_ID

Proton OAuth client secret.

Ziel

PROTON_CLIENT_SECRET

Proton API base URL override.

Ziel

PROTON_BASE_URL

Certificate verification for Proton integration.

Ziel

PROTON_VALIDATE_CERTS

Standard

true|false

Wert

true

Enable Proton login integration.

Ziel

CONNECT_WITH_PROTON

Cookie name for Proton login integration.

Ziel

CONNECT_WITH_PROTON_COOKIE_NAME

Font Awesome icon slug for generic OIDC login button.

Ziel

CONNECT_WITH_OIDC_ICON

OIDC discovery URL, usually ending in /.well-known/openid-configuration.

Ziel

OIDC_WELL_KNOWN_URL

Space-separated OIDC scopes. Default works for most providers.

Ziel

OIDC_SCOPES

Standard

openid email profile

Wert

openid email profile

OIDC user-info field used for display name.

Ziel

OIDC_NAME_FIELD

Standard

name

Wert

name

OIDC client ID.

Ziel

OIDC_CLIENT_ID

OIDC client secret.

Ziel

OIDC_CLIENT_SECRET

Set to 1 to enable SimpleLogin as an OpenID provider.

Ziel

ENABLE_OIDC_SERVER

Standard

0|1

Wert

0

Optional OpenID private key path. Blank auto-generates when ENABLE_OIDC_SERVER=1.

Ziel

OPENID_PRIVATE_KEY_PATH

Optional OpenID public key path matching the private key above.

Ziel

OPENID_PUBLIC_KEY_PATH

Apple sign-in API secret.

Ziel

APPLE_API_SECRET

Apple sign-in secret for the native Mac app.

Ziel

MACAPP_APPLE_API_SECRET

Sentry DSN for backend error tracking.

Ziel

SENTRY_DSN

Optional separate Sentry DSN for front-end error tracking.

Ziel

SENTRY_FRONT_END_DSN

Plausible Analytics host.

Ziel

PLAUSIBLE_HOST

Plausible tracked domain.

Ziel

PLAUSIBLE_DOMAIN

Optional Flask profiler sqlite path.

Ziel

FLASK_PROFILER_PATH

Optional Flask profiler password.

Ziel

FLASK_PROFILER_PASSWORD

Set to 1 to enable SpamAssassin integration.

Ziel

ENABLE_SPAM_ASSASSIN

Standard

0|1

Wert

0

SpamAssassin server host or IP.

Ziel

SPAMASSASSIN_HOST

How often to check Have I Been Pwned data.

Ziel

HIBP_SCAN_INTERVAL_DAYS

Standard

7

Wert

7

JSON list of HIBP API keys. Example: ["key1","key2"]

Ziel

HIBP_API_KEYS

Set to 1 to auto-generate a PGP server key pair.

Ziel

AUTO_GENERATE_PGP

Standard

0|1

Wert

0

Optional path to a private PGP key used to sign forwarding emails. Use /custom-assets or /pgp if you provide your own key.

Ziel

PGP_SENDER_PRIVATE_KEY_PATH

Advanced DKIM private key path override. Leave at /dkim.key for the wrapper-managed default.

Ziel

DKIM_PRIVATE_KEY_PATH

Standard

/dkim.key

Wert

/dkim.key

Bucket name used by upstream S3-backed features.

Ziel

BUCKET

AWS or S3-compatible access key ID.

Ziel

AWS_ACCESS_KEY_ID

AWS or S3-compatible secret access key.

Ziel

AWS_SECRET_ACCESS_KEY

AWS region.

Ziel

AWS_REGION

Paddle vendor ID.

Ziel

PADDLE_VENDOR_ID

Paddle monthly product ID.

Ziel

PADDLE_MONTHLY_PRODUCT_ID

Paddle yearly product ID.

Ziel

PADDLE_YEARLY_PRODUCT_ID

Path to your Paddle public key file, for example /custom-assets/paddle_public.pem.

Ziel

PADDLE_PUBLIC_KEY_PATH

Paddle auth code.

Ziel

PADDLE_AUTH_CODE

Coinbase webhook secret.

Ziel

COINBASE_WEBHOOK_SECRET

Coinbase checkout ID.

Ziel

COINBASE_CHECKOUT_ID

Coinbase API key.

Ziel

COINBASE_API_KEY

Coinbase yearly price value.

Ziel

COINBASE_YEARLY_PRICE

Expert-only alternate dotenv file path. Usually leave blank and use the template fields instead.

Ziel

CONFIG

Optional monitoring report email recipient.

Ziel

MONITORING_EMAIL

Optional address that receives unsubscribe requests.

Ziel

UNSUBSCRIBER

Legacy alias for unsubscribe routing.

Ziel

OLD_UNSUBSCRIBER

Comma-separated users allowed to use HTTP unsubscribe.

Ziel

USERS_WITH_HTTP_UNSUBSCRIBE

Legacy free-plan alias cap used for old accounts.

Ziel

MAX_NB_EMAIL_OLD_FREE_PLAN

Optional PostgreSQL application_name override.

Ziel

DB_CONN_NAME

Optional custom S3-compatible endpoint URL.

Ziel

AWS_ENDPOINT_URL

JSON list of extra Paddle monthly product IDs. Example: [12345,67890]

Ziel

PADDLE_MONTHLY_PRODUCT_IDS

JSON list of extra Paddle yearly product IDs. Example: [12345,67890]

Ziel

PADDLE_YEARLY_PRODUCT_IDS

Optional Paddle coupon product ID.

Ziel

PADDLE_COUPON_ID

Optional Proton integration header name override.

Ziel

PROTON_EXTRA_HEADER_NAME

Optional Proton integration header value.

Ziel

PROTON_EXTRA_HEADER_VALUE

Presence-based upstream flag. Set true to prevent linked Proton account changes.

Ziel

PROTON_PREVENT_CHANGE_LINKED_ACCOUNT

Standard

false|true

Wert

false

Optional Sentry trace sample rate. Example: 0.001

Ziel

SENTRY_TRACE_RATE

Comma-separated backup outbound SMTP servers.

Ziel

POSTFIX_BACKUP_SERVERS

Presence-based upstream flag. Set true to use Postfix submission with TLS on port 587.

Ziel

POSTFIX_SUBMISSION_TLS

Standard

false|true

Wert

false

Postfix send timeout in seconds.

Ziel

POSTFIX_TIMEOUT

Postfix connect timeout in seconds.

Ziel

POSTFIX_CONNECT_TIMEOUT

Comma-separated Proton MX servers.

Ziel

PROTON_MX_SERVERS

Comma-separated Proton email domains.

Ziel

PROTON_EMAIL_DOMAINS

Presence-based upstream flag for niche local PGP loading behavior.

Ziel

LOAD_PGP_EMAIL_HANDLER

Standard

false|true

Wert

false

Presence-based upstream flag to validate Apple webhook shared secret.

Ziel

APPLE_WEBHOOK_SECRET_CHECK_ENABLED

Standard

false|true

Wert

false

SpamAssassin spam score threshold for forwarded mail.

Ziel

MAX_SPAM_SCORE

SpamAssassin spam score threshold for reply-phase mail.

Ziel

MAX_REPLY_PHASE_SPAM_SCORE

Optional signer address used for outgoing encrypted email.

Ziel

PGP_SIGNER

Formatted no-reply address override.

Ziel

NOREPLY

Formatted partner no-reply address override.

Ziel

PARTNER_NOREPLY

Have I Been Pwned requests-per-minute limit.

Ziel

HIBP_API_RPM

Optional HIBP behavior override for partner aliases.

Ziel

HIBP_SKIP_PARTNER_ALIAS

Optional directory where unsent emails are stored.

Ziel

SAVE_UNSENT_DIR

Presence-based upstream flag indicating DKIM signing is handled by Rspamd.

Ziel

RSPAMD_SIGN_DKIM

Standard

false|true

Wert

false

Optional Twilio auth token for phone-related integrations.

Ziel

TWILIO_AUTH_TOKEN

Optional phone provider secret.

Ziel

PHONE_PROVIDER_1_SECRET

Optional phone provider header name.

Ziel

PHONE_PROVIDER_2_HEADER

Optional phone provider secret.

Ziel

PHONE_PROVIDER_2_SECRET

Optional Zendesk host for support integrations.

Ziel

ZENDESK_HOST

Optional Zendesk API token.

Ziel

ZENDESK_API_TOKEN

Presence-based upstream flag to enable Zendesk integration.

Ziel

ZENDESK_ENABLED

Standard

false|true

Wert

false

Presence-based upstream flag to enable DMARC checks.

Ziel

DMARC_CHECK_ENABLED

Standard

false|true

Wert

false

VERP prefix override.

Ziel

VERP_PREFIX

Custom VERP secret. Generate with: openssl rand -hex 32. Must be at least 32 chars.

Ziel

VERP_EMAIL_SECRET

Optional transactional bounce prefix.

Ziel

TRANSACTIONAL_BOUNCE_PREFIX

Optional transactional bounce suffix.

Ziel

TRANSACTIONAL_BOUNCE_SUFFIX

Alias transfer token secret. Generate with: openssl rand -hex 32

Ziel

ALIAS_TRANSFER_TOKEN_SECRET

Optional upstream behavior override for free-user contact creation.

Ziel

DISABLE_CREATE_CONTACTS_FOR_FREE_USERS

Length of generated alias random suffix.

Ziel

ALIAS_RAND_SUFFIX_LENGTH

Optional event webhook destination URL.

Ziel

EVENT_WEBHOOK

Presence-based upstream flag to skip SSL verification for the event webhook.

Ziel

EVENT_WEBHOOK_SKIP_VERIFY_SSL

Standard

false|true

Wert

false

Presence-based upstream flag to disable event webhooks.

Ziel

EVENT_WEBHOOK_DISABLE

Standard

false|true

Wert

false

Comma-separated user IDs allowed to emit event webhooks.

Ziel

EVENT_WEBHOOK_ENABLED_USER_IDS

Optional dedicated DB URI for the event listener.

Ziel

EVENT_LISTENER_DB_URI

Maximum number of API keys per user.

Ziel

MAX_API_KEYS

Optional memory store URI override.

Ziel

MEM_STORE_URI

Recovery-code HMAC secret. Generate with: openssl rand -hex 32. Must be at least 16 chars.

Ziel

RECOVERY_CODE_HMAC_SECRET

Rspamd score threshold for quarantining DMARC-failed email.

Ziel

MIN_RSPAMD_SCORE_FOR_FAILED_DMARC

Presence-based upstream flag to replace all reverse aliases.

Ziel

ENABLE_ALL_REVERSE_ALIAS_REPLACEMENT

Standard

false|true

Wert

false

Maximum reverse aliases replaced when the related feature is enabled.

Ziel

MAX_NB_REVERSE_ALIAS_REPLACEMENT

Presence-based upstream flag to disable rate limiting.

Ziel

DISABLE_RATE_LIMIT

Standard

false|true

Wert

false

Free-user alias create rate limits in hits,seconds:hits,seconds format.

Ziel

ALIAS_CREATE_RATE_LIMIT_FREE

Paid-user alias create rate limits in hits,seconds:hits,seconds format.

Ziel

ALIAS_CREATE_RATE_LIMIT_PAID

Single-alias restore rate limits in hits,seconds:hits,seconds format.

Ziel

ALIAS_RESTORE_ONE_RATE_LIMIT

Bulk alias restore rate limits in hits,seconds:hits,seconds format.

Ziel

ALIAS_RESTORE_ALL_RATE_LIMIT

Maximum daily bounces before automatic handling triggers.

Ziel

MAX_BOUNCES_1D

Maximum weekly bounces before automatic handling triggers.

Ziel

MAX_BOUNCES_1W

Expert partner mapping in key=value;key=value format. Example: a.com=x.com;b.com=y.com

Ziel

PARTNER_DNS_CUSTOM_DOMAINS

Expert validation prefixes in key=value;key=value format.

Ziel

PARTNER_CUSTOM_DOMAIN_VALIDATION_PREFIXES

Optional mailbox verification override code for controlled environments.

Ziel

MAILBOX_VERIFICATION_OVERRIDE_CODE

Maximum audit log retention in days.

Ziel

AUDIT_LOG_MAX_DAYS

Days before trashed aliases are purged.

Ziel

ALIAS_TRASH_DAYS

Comma-separated allowed OAuth callback schemes.

Ziel

ALLOWED_OAUTH_SCHEMES

Maximum forward recipients per email.

Ziel

MAX_EMAIL_FORWARD_RECIPIENTS

Hex-encoded master encryption key. Generate with: openssl rand -hex 32

Ziel

MASTER_ENC_KEY_HEX

Hex-encoded MAC key. Generate with: openssl rand -hex 32

Ziel

MAC_KEY_HEX

Hex-encoded HKDF salt. Generate with: openssl rand -hex 32

Ziel

ABUSER_HKDF_SALT

Comma-separated invalid MX IPs ignored by validation logic.

Ziel

INVALID_MX_IPS

Presence-based upstream flag to use the Rust PGP implementation.

Ziel

USE_RUST_PGP

Standard

false|true

Wert

false

Maximum SMTP message size in bytes.

Ziel

SMTP_SIZE_LIMIT

Optional partner support URL shown by the app.

Ziel

PARTNER_SUPPORT_URL

Admin FIDO requirement. Choose one of the built-in dropdown values only: none, any, or hardware. Leave this at none unless you already intend to enforce admin FIDO or security keys.

Ziel

ADMIN_FIDO_REQUIRED

Standard

none|any|hardware

Wert

none

Admin grace period in seconds before FIDO enforcement.

Ziel

ADMIN_GRACE_PERIOD

Presence-based upstream flag to drop PGP key attachments on reply.

Ziel

DROP_PGP_KEY_ATTACHMENTS_ON_REPLY

Standard

false|true

Wert

false

Optional UpCloud username for niche upstream integrations.

Ziel

UPCLOUD_USERNAME

Optional UpCloud password for niche upstream integrations.

Ziel

UPCLOUD_PASSWORD

Optional UpCloud database ID for niche upstream integrations.

Ziel

UPCLOUD_DB_ID

Presence-based upstream flag to store transactional emails.

Ziel

STORE_TRANSACTIONAL_EMAILS

Standard

false|true

Wert

false