Primary persistent directory for PostgreSQL, Redis, DKIM keys, uploads, generated JWT keys, and application state.

Cible

/appdata

Défaut

/mnt/user/appdata/simplelogin-aio

Valeur

/mnt/user/appdata/simplelogin-aio

Persistent directory for your GnuPG keyring and optional server-generated PGP signing keys.

Cible

/pgp

Défaut

/mnt/user/appdata/simplelogin-aio/pgp

Optional host path mounted at /custom-assets for advanced file-based settings such as custom words lists, OpenID keys, Paddle public keys, or imported PGP material.

Cible

/custom-assets

Port used by the SimpleLogin web UI.

Cible

7777

Défaut

7777

Valeur

7777

Inbound SMTP port. Forward TCP 25 from your router or firewall to the Unraid host if you want aliases to receive internet mail.

Cible

25

Défaut

25

Valeur

25

Canonical HTTPS URL for the dashboard, for example https://app.example.com. This does not need to be the same as your SMTP/MX hostname.

Cible

URL

Défaut

https://app.example.com

Real public alias domain, for example example.com. Do not use a private-only tailnet domain here. First-account registration must use a separate existing mailbox, not this alias domain.

Cible

EMAIL_DOMAIN

Défaut

example.com

Working mailbox used for system mail, for example support@example.com. Use an address that already exists.

Cible

SUPPORT_EMAIL

Défaut

support@example.com

Long random app secret. Generate with: openssl rand -hex 32

Cible

FLASK_SECRET

Outbound mail mode. Choose one of the built-in dropdown values only: direct, brevo, protonmail, gmail, mailgun, or custom. Use a relay provider if your ISP blocks outbound TCP 25.

Cible

RELAY_MODE

Défaut

direct|brevo|protonmail|gmail|mailgun|custom

Valeur

direct

Brevo SMTP username, usually your account email. Required when RELAY_MODE=brevo.

Cible

BREVO_USERNAME

Brevo SMTP key or password. Required when RELAY_MODE=brevo.

Cible

BREVO_PASSWORD

Proton SMTP token. Required when RELAY_MODE=protonmail. The username stays SUPPORT_EMAIL.

Cible

PROTONMAIL_TOKEN

Full Gmail address used for relay auth. Required when RELAY_MODE=gmail.

Cible

GMAIL_USERNAME

16-character Gmail app password. Required when RELAY_MODE=gmail.

Cible

GMAIL_APP_PASSWORD

Mailgun SMTP username, usually postmaster@yourdomain. Required when RELAY_MODE=mailgun.

Cible

MAILGUN_USERNAME

Mailgun SMTP password. Required when RELAY_MODE=mailgun.

Cible

MAILGUN_PASSWORD

Required when RELAY_MODE=custom. Example: [smtp.provider.com]:587

Cible

CUSTOM_RELAYHOST

SMTP username for your custom relay. Required when RELAY_MODE=custom.

Cible

CUSTOM_USERNAME

SMTP password for your custom relay. Required when RELAY_MODE=custom.

Cible

CUSTOM_PASSWORD

Leave blank for the bundled database. When set to an external host, the bundled PostgreSQL stays idle. Format: postgresql://user:pass@host:5432/dbname

Cible

DB_URI

Leave blank for the bundled Redis. When set to an external host, the bundled Redis stays idle. Format: redis://:pass@host:6379/0

Cible

REDIS_URL

Advanced escape hatch. Leave at 127.0.0.1 to keep the bundled Postfix path.

Cible

POSTFIX_SERVER

Défaut

127.0.0.1

Valeur

127.0.0.1

Advanced escape hatch. Leave at 25 for the bundled Postfix path.

Cible

POSTFIX_PORT

Défaut

25

Valeur

25

Comma-separated resolvers used for lookups, for example 1.1.1.1,1.0.0.1.

Cible

NAMESERVERS

Défaut

1.1.1.1,1.0.0.1

Valeur

1.1.1.1,1.0.0.1

Optional temp directory path inside the container or a mounted path.

Cible

TEMP_DIR

Advanced path override for the words file used for random alias generation. Use /custom-assets if you mount your own file.

Cible

WORDS_FILE_PATH

Défaut

/code/local_data/test_words.txt

Valeur

/code/local_data/test_words.txt

Leave true for local file storage inside /appdata.

Cible

LOCAL_FILE_UPLOAD

Défaut

true|false

Valeur

true

GnuPG home directory path used for PGP features.

Cible

GNUPGHOME

Défaut

/pgp

Valeur

/pgp

Optional partner token secret. Generate with: openssl rand -hex 32. Blank uses FLASK_SECRET.

Cible

PARTNER_API_TOKEN_SECRET

Recommended default. Keep true to block public sign-up. Temporarily switch to false only while creating a first account, then set true again and restart.

Cible

DISABLE_REGISTRATION

Défaut

true|false

Valeur

true

Recommended for self-hosted installs.

Cible

DISABLE_ONBOARDING

Défaut

true|false

Valeur

true

Recommended for self-hosted installs to allow cleaner aliases without the random suffix.

Cible

DISABLE_ALIAS_SUFFIX

Défaut

true|false

Valeur

true

Enable SPF enforcement using the extra headers provided by Postfix.

Cible

ENFORCE_SPF

Défaut

true|false

Valeur

true

For testing only. When true, email bodies are logged instead of sent.

Cible

NOT_SEND_EMAIL

Défaut

false|true

Valeur

false

Optional colored log output for debugging.

Cible

COLOR_LOG

General stats and admin alert email recipient. This is not a login credential.

Cible

ADMIN_EMAIL

Display name used alongside SUPPORT_EMAIL.

Cible

SUPPORT_NAME

Postmaster email used by some mail-related features.

Cible

POSTMASTER

Max number of emails a non-premium user can generate.

Cible

MAX_NB_EMAIL_FREE_PLAN

Défaut

10

Valeur

10

Alias creation rate limit. Example: 100/day;50/hour;5/minute

Cible

ALIAS_LIMIT

Optional automatic alias disable behavior.

Cible

ALIAS_AUTOMATIC_DISABLE

JSON list of allowed redirect domains. Example: ["app.example.com"]

Cible

ALLOWED_REDIRECT_DOMAINS

Optional landing page URL shown by the app.

Cible

LANDING_PAGE_URL

Optional status page URL shown by the app.

Cible

STATUS_PAGE_URL

hCaptcha secret key from your hCaptcha site. Set both hCaptcha fields to enable.

Cible

HCAPTCHA_SECRET

hCaptcha site key from your hCaptcha site. Set both hCaptcha fields to enable.

Cible

HCAPTCHA_SITEKEY

Leave blank to auto-use mail.EMAIL_DOMAIN. Set this only if your MX host should be something else, for example [(10, "mx.example.com.")].

Cible

EMAIL_SERVERS_WITH_PRIORITY

JSON list of extra alias domains. Example: ["example.net","example.org"]

Cible

OTHER_ALIAS_DOMAINS

Full alias-domain override as a JSON list. If set, it replaces OTHER_ALIAS_DOMAINS.

Cible

ALIAS_DOMAINS

JSON list of premium-only domains. Example: ["vip.example.com"]

Cible

PREMIUM_ALIAS_DOMAINS

Alias domain used when creating the first alias.

Cible

FIRST_ALIAS_DOMAIN

VERP bounce prefix. Must end with + if used.

Cible

BOUNCE_PREFIX

VERP bounce suffix. Must start with + if used.

Cible

BOUNCE_SUFFIX

Reply-phase bounce prefix without a trailing +.

Cible

BOUNCE_PREFIX_FOR_REPLY_PHASE

GitHub OAuth app client ID.

Cible

GITHUB_CLIENT_ID

GitHub OAuth app client secret.

Cible

GITHUB_CLIENT_SECRET

Google OAuth client ID.

Cible

GOOGLE_CLIENT_ID

Google OAuth client secret.

Cible

GOOGLE_CLIENT_SECRET

Facebook OAuth client ID.

Cible

FACEBOOK_CLIENT_ID

Facebook OAuth client secret.

Cible

FACEBOOK_CLIENT_SECRET

Proton OAuth client ID.

Cible

PROTON_CLIENT_ID

Proton OAuth client secret.

Cible

PROTON_CLIENT_SECRET

Proton API base URL override.

Cible

PROTON_BASE_URL

Certificate verification for Proton integration.

Cible

PROTON_VALIDATE_CERTS

Défaut

true|false

Valeur

true

Enable Proton login integration.

Cible

CONNECT_WITH_PROTON

Cookie name for Proton login integration.

Cible

CONNECT_WITH_PROTON_COOKIE_NAME

Font Awesome icon slug for generic OIDC login button.

Cible

CONNECT_WITH_OIDC_ICON

OIDC discovery URL, usually ending in /.well-known/openid-configuration.

Cible

OIDC_WELL_KNOWN_URL

Space-separated OIDC scopes. Default works for most providers.

Cible

OIDC_SCOPES

Défaut

openid email profile

Valeur

openid email profile

OIDC user-info field used for display name.

Cible

OIDC_NAME_FIELD

Défaut

name

Valeur

name

OIDC client ID.

Cible

OIDC_CLIENT_ID

OIDC client secret.

Cible

OIDC_CLIENT_SECRET

Set to 1 to enable SimpleLogin as an OpenID provider.

Cible

ENABLE_OIDC_SERVER

Défaut

0|1

Valeur

0

Optional OpenID private key path. Blank auto-generates when ENABLE_OIDC_SERVER=1.

Cible

OPENID_PRIVATE_KEY_PATH

Optional OpenID public key path matching the private key above.

Cible

OPENID_PUBLIC_KEY_PATH

Apple sign-in API secret.

Cible

APPLE_API_SECRET

Apple sign-in secret for the native Mac app.

Cible

MACAPP_APPLE_API_SECRET

Sentry DSN for backend error tracking.

Cible

SENTRY_DSN

Optional separate Sentry DSN for front-end error tracking.

Cible

SENTRY_FRONT_END_DSN

Plausible Analytics host.

Cible

PLAUSIBLE_HOST

Plausible tracked domain.

Cible

PLAUSIBLE_DOMAIN

Optional Flask profiler sqlite path.

Cible

FLASK_PROFILER_PATH

Optional Flask profiler password.

Cible

FLASK_PROFILER_PASSWORD

Set to 1 to enable SpamAssassin integration.

Cible

ENABLE_SPAM_ASSASSIN

Défaut

0|1

Valeur

0

SpamAssassin server host or IP.

Cible

SPAMASSASSIN_HOST

How often to check Have I Been Pwned data.

Cible

HIBP_SCAN_INTERVAL_DAYS

Défaut

7

Valeur

7

JSON list of HIBP API keys. Example: ["key1","key2"]

Cible

HIBP_API_KEYS

Set to 1 to auto-generate a PGP server key pair.

Cible

AUTO_GENERATE_PGP

Défaut

0|1

Valeur

0

Optional path to a private PGP key used to sign forwarding emails. Use /custom-assets or /pgp if you provide your own key.

Cible

PGP_SENDER_PRIVATE_KEY_PATH

Advanced DKIM private key path override. Leave at /dkim.key for the wrapper-managed default.

Cible

DKIM_PRIVATE_KEY_PATH

Défaut

/dkim.key

Valeur

/dkim.key

Bucket name used by upstream S3-backed features.

Cible

BUCKET

AWS or S3-compatible access key ID.

Cible

AWS_ACCESS_KEY_ID

AWS or S3-compatible secret access key.

Cible

AWS_SECRET_ACCESS_KEY

AWS region.

Cible

AWS_REGION

Paddle vendor ID.

Cible

PADDLE_VENDOR_ID

Paddle monthly product ID.

Cible

PADDLE_MONTHLY_PRODUCT_ID

Paddle yearly product ID.

Cible

PADDLE_YEARLY_PRODUCT_ID

Path to your Paddle public key file, for example /custom-assets/paddle_public.pem.

Cible

PADDLE_PUBLIC_KEY_PATH

Paddle auth code.

Cible

PADDLE_AUTH_CODE

Coinbase webhook secret.

Cible

COINBASE_WEBHOOK_SECRET

Coinbase checkout ID.

Cible

COINBASE_CHECKOUT_ID

Coinbase API key.

Cible

COINBASE_API_KEY

Coinbase yearly price value.

Cible

COINBASE_YEARLY_PRICE

Expert-only alternate dotenv file path. Usually leave blank and use the template fields instead.

Cible

CONFIG

Optional monitoring report email recipient.

Cible

MONITORING_EMAIL

Optional address that receives unsubscribe requests.

Cible

UNSUBSCRIBER

Legacy alias for unsubscribe routing.

Cible

OLD_UNSUBSCRIBER

Comma-separated users allowed to use HTTP unsubscribe.

Cible

USERS_WITH_HTTP_UNSUBSCRIBE

Legacy free-plan alias cap used for old accounts.

Cible

MAX_NB_EMAIL_OLD_FREE_PLAN

Optional PostgreSQL application_name override.

Cible

DB_CONN_NAME

Optional custom S3-compatible endpoint URL.

Cible

AWS_ENDPOINT_URL

JSON list of extra Paddle monthly product IDs. Example: [12345,67890]

Cible

PADDLE_MONTHLY_PRODUCT_IDS

JSON list of extra Paddle yearly product IDs. Example: [12345,67890]

Cible

PADDLE_YEARLY_PRODUCT_IDS

Optional Paddle coupon product ID.

Cible

PADDLE_COUPON_ID

Optional Proton integration header name override.

Cible

PROTON_EXTRA_HEADER_NAME

Optional Proton integration header value.

Cible

PROTON_EXTRA_HEADER_VALUE

Presence-based upstream flag. Set true to prevent linked Proton account changes.

Cible

PROTON_PREVENT_CHANGE_LINKED_ACCOUNT

Défaut

false|true

Valeur

false

Optional Sentry trace sample rate. Example: 0.001

Cible

SENTRY_TRACE_RATE

Comma-separated backup outbound SMTP servers.

Cible

POSTFIX_BACKUP_SERVERS

Presence-based upstream flag. Set true to use Postfix submission with TLS on port 587.

Cible

POSTFIX_SUBMISSION_TLS

Défaut

false|true

Valeur

false

Postfix send timeout in seconds.

Cible

POSTFIX_TIMEOUT

Postfix connect timeout in seconds.

Cible

POSTFIX_CONNECT_TIMEOUT

Comma-separated Proton MX servers.

Cible

PROTON_MX_SERVERS

Comma-separated Proton email domains.

Cible

PROTON_EMAIL_DOMAINS

Presence-based upstream flag for niche local PGP loading behavior.

Cible

LOAD_PGP_EMAIL_HANDLER

Défaut

false|true

Valeur

false

Presence-based upstream flag to validate Apple webhook shared secret.

Cible

APPLE_WEBHOOK_SECRET_CHECK_ENABLED

Défaut

false|true

Valeur

false

SpamAssassin spam score threshold for forwarded mail.

Cible

MAX_SPAM_SCORE

SpamAssassin spam score threshold for reply-phase mail.

Cible

MAX_REPLY_PHASE_SPAM_SCORE

Optional signer address used for outgoing encrypted email.

Cible

PGP_SIGNER

Formatted no-reply address override.

Cible

NOREPLY

Formatted partner no-reply address override.

Cible

PARTNER_NOREPLY

Have I Been Pwned requests-per-minute limit.

Cible

HIBP_API_RPM

Optional HIBP behavior override for partner aliases.

Cible

HIBP_SKIP_PARTNER_ALIAS

Optional directory where unsent emails are stored.

Cible

SAVE_UNSENT_DIR

Presence-based upstream flag indicating DKIM signing is handled by Rspamd.

Cible

RSPAMD_SIGN_DKIM

Défaut

false|true

Valeur

false

Optional Twilio auth token for phone-related integrations.

Cible

TWILIO_AUTH_TOKEN

Optional phone provider secret.

Cible

PHONE_PROVIDER_1_SECRET

Optional phone provider header name.

Cible

PHONE_PROVIDER_2_HEADER

Optional phone provider secret.

Cible

PHONE_PROVIDER_2_SECRET

Optional Zendesk host for support integrations.

Cible

ZENDESK_HOST

Optional Zendesk API token.

Cible

ZENDESK_API_TOKEN

Presence-based upstream flag to enable Zendesk integration.

Cible

ZENDESK_ENABLED

Défaut

false|true

Valeur

false

Presence-based upstream flag to enable DMARC checks.

Cible

DMARC_CHECK_ENABLED

Défaut

false|true

Valeur

false

VERP prefix override.

Cible

VERP_PREFIX

Custom VERP secret. Generate with: openssl rand -hex 32. Must be at least 32 chars.

Cible

VERP_EMAIL_SECRET

Optional transactional bounce prefix.

Cible

TRANSACTIONAL_BOUNCE_PREFIX

Optional transactional bounce suffix.

Cible

TRANSACTIONAL_BOUNCE_SUFFIX

Alias transfer token secret. Generate with: openssl rand -hex 32

Cible

ALIAS_TRANSFER_TOKEN_SECRET

Optional upstream behavior override for free-user contact creation.

Cible

DISABLE_CREATE_CONTACTS_FOR_FREE_USERS

Length of generated alias random suffix.

Cible

ALIAS_RAND_SUFFIX_LENGTH

Optional event webhook destination URL.

Cible

EVENT_WEBHOOK

Presence-based upstream flag to skip SSL verification for the event webhook.

Cible

EVENT_WEBHOOK_SKIP_VERIFY_SSL

Défaut

false|true

Valeur

false

Presence-based upstream flag to disable event webhooks.

Cible

EVENT_WEBHOOK_DISABLE

Défaut

false|true

Valeur

false

Comma-separated user IDs allowed to emit event webhooks.

Cible

EVENT_WEBHOOK_ENABLED_USER_IDS

Optional dedicated DB URI for the event listener.

Cible

EVENT_LISTENER_DB_URI

Maximum number of API keys per user.

Cible

MAX_API_KEYS

Optional memory store URI override.

Cible

MEM_STORE_URI

Recovery-code HMAC secret. Generate with: openssl rand -hex 32. Must be at least 16 chars.

Cible

RECOVERY_CODE_HMAC_SECRET

Rspamd score threshold for quarantining DMARC-failed email.

Cible

MIN_RSPAMD_SCORE_FOR_FAILED_DMARC

Presence-based upstream flag to replace all reverse aliases.

Cible

ENABLE_ALL_REVERSE_ALIAS_REPLACEMENT

Défaut

false|true

Valeur

false

Maximum reverse aliases replaced when the related feature is enabled.

Cible

MAX_NB_REVERSE_ALIAS_REPLACEMENT

Presence-based upstream flag to disable rate limiting.

Cible

DISABLE_RATE_LIMIT

Défaut

false|true

Valeur

false

Free-user alias create rate limits in hits,seconds:hits,seconds format.

Cible

ALIAS_CREATE_RATE_LIMIT_FREE

Paid-user alias create rate limits in hits,seconds:hits,seconds format.

Cible

ALIAS_CREATE_RATE_LIMIT_PAID

Single-alias restore rate limits in hits,seconds:hits,seconds format.

Cible

ALIAS_RESTORE_ONE_RATE_LIMIT

Bulk alias restore rate limits in hits,seconds:hits,seconds format.

Cible

ALIAS_RESTORE_ALL_RATE_LIMIT

Maximum daily bounces before automatic handling triggers.

Cible

MAX_BOUNCES_1D

Maximum weekly bounces before automatic handling triggers.

Cible

MAX_BOUNCES_1W

Expert partner mapping in key=value;key=value format. Example: a.com=x.com;b.com=y.com

Cible

PARTNER_DNS_CUSTOM_DOMAINS

Expert validation prefixes in key=value;key=value format.

Cible

PARTNER_CUSTOM_DOMAIN_VALIDATION_PREFIXES

Optional mailbox verification override code for controlled environments.

Cible

MAILBOX_VERIFICATION_OVERRIDE_CODE

Maximum audit log retention in days.

Cible

AUDIT_LOG_MAX_DAYS

Days before trashed aliases are purged.

Cible

ALIAS_TRASH_DAYS

Comma-separated allowed OAuth callback schemes.

Cible

ALLOWED_OAUTH_SCHEMES

Maximum forward recipients per email.

Cible

MAX_EMAIL_FORWARD_RECIPIENTS

Hex-encoded master encryption key. Generate with: openssl rand -hex 32

Cible

MASTER_ENC_KEY_HEX

Hex-encoded MAC key. Generate with: openssl rand -hex 32

Cible

MAC_KEY_HEX

Hex-encoded HKDF salt. Generate with: openssl rand -hex 32

Cible

ABUSER_HKDF_SALT

Comma-separated invalid MX IPs ignored by validation logic.

Cible

INVALID_MX_IPS

Presence-based upstream flag to use the Rust PGP implementation.

Cible

USE_RUST_PGP

Défaut

false|true

Valeur

false

Maximum SMTP message size in bytes.

Cible

SMTP_SIZE_LIMIT

Optional partner support URL shown by the app.

Cible

PARTNER_SUPPORT_URL

Admin FIDO requirement. Choose one of the built-in dropdown values only: none, any, or hardware. Leave this at none unless you already intend to enforce admin FIDO or security keys.

Cible

ADMIN_FIDO_REQUIRED

Défaut

none|any|hardware

Valeur

none

Admin grace period in seconds before FIDO enforcement.

Cible

ADMIN_GRACE_PERIOD

Presence-based upstream flag to drop PGP key attachments on reply.

Cible

DROP_PGP_KEY_ATTACHMENTS_ON_REPLY

Défaut

false|true

Valeur

false

Optional UpCloud username for niche upstream integrations.

Cible

UPCLOUD_USERNAME

Optional UpCloud password for niche upstream integrations.

Cible

UPCLOUD_PASSWORD

Optional UpCloud database ID for niche upstream integrations.

Cible

UPCLOUD_DB_ID

Presence-based upstream flag to store transactional emails.

Cible

STORE_TRANSACTIONAL_EMAILS

Défaut

false|true

Valeur

false