Configuration

Canonical list: .env.example in the server repo. Environment variables always win over config/config.json for overlapping keys (including BASE_PATH / USE_HTTPS).

Most runtime settings (email, uploads, image hosting, GitHub, trash retention, registration) are not in .env. They live in the database and are edited in the Admin UI. See Admin-settings.

Required

The process will not start if .env is missing or these are empty:

Variable	Purpose
DB_HOST, DB_PORT, DB_USER, DB_PASSWORD, DB_NAME	PostgreSQL
SESSION_KEY	Session cookies and encryption of stored secrets such as email, S3, and GitHub OAuth credentials (32+ characters)
REDIS_URL	Redis: API auth, rate limits, device SSO, undo tokens, and live updates (SSE)

If REDIS_URL is unset you can use REDIS_ADDR and optional REDIS_PASSWORD instead.

Optional

Variable	Default	Purpose
PORT	8080	Listen port
HOST	127.0.0.1	Listen address. The default only accepts local connections, which suits a reverse proxy on the same machine. Set 0.0.0.0 to reach the server directly from other machines, for example a phone on your LAN or a container port mapping.
ORDRYN_MODE	full	full = UI + API, api = JSON only. --mode=api on the command line wins.
BASE_PATH	/	Public URL prefix, e.g. /gotodo
USE_HTTPS	false	Cookie Secure flag / HTTPS assumptions
DB_SSLMODE	disable	Set require (or true) to use SSL for PostgreSQL
PUBLIC_URL	(unset)	Public origin for {url} task links in extension messages, including any path prefix, e.g. https://todo.example.com/gotodo. Without it, chat messages go out with no link.
EXTENSIONS_DIR	data/extensions	Where extension folders are loaded from. See Extensions. The old name MODS_DIR still works.
ENV	(unset)	production adds a Strict-Transport-Security header. Only set it when the site is served over HTTPS.
GITHUB_REPO, GITHUB_TOKEN	(unset)	owner/repo to pull the in-app changelog from GitHub Releases. The token only raises GitHub's rate limit.
SITE_NAME, DEFAULT_TIMEZONE, SHOW_CHANGELOG, ASSET_VERSION	(see example)	Branding overlay. Site version is the running binary (git tag), not an env/config field. See Building-the-server.

ORDRYN_* variables also accept their older GOTODO_* names. If both are set, ORDRYN_* wins.

First-boot bootstrap

Idempotent; safe to leave set after first run:

ORDRYN_BOOTSTRAP_ADMIN_EMAIL=admin@example.com
ORDRYN_BOOTSTRAP_ADMIN_PASSWORD=change-me
ORDRYN_BOOTSTRAP_ENABLE_API=true
ORDRYN_BOOTSTRAP_CREATE_API_KEY=true

• Creates the admin user if missing.
• ORDRYN_BOOTSTRAP_ENABLE_API=true turns on the REST API (site_settings.enable_api).
• ORDRYN_BOOTSTRAP_CREATE_API_KEY=true mints a key named bootstrap once. The full secret is printed on first boot and is not shown again.

You can also enable the API later in the admin UI (full mode) or create keys under Settings.

Email

Outbound mail (password resets, invites, notification email) is configured in Admin → Email (Mailgun or SMTP), not in .env. See Admin-settings.

Older installs that set MAILGUN_API_KEY, MAILGUN_DOMAIN, and FROM_EMAIL in .env are imported into Admin once, the first time the server starts with no email provider configured. After that the env values are ignored and can be removed.

Rotating SESSION_KEY requires re-entering every stored secret: the Mailgun API key or SMTP password, the S3 secret key, and the GitHub OAuth client secret.

Site overlay JSON

config/config.json.example is an optional overlay (basePath, useHttps, site name, timezone, changelog). Env still wins when both are set.