Environment variables

Environment Variables

All environment variables are optional unless noted. Docker users can pass them via a .env file or directly in the compose file. For npm installs, copy .env.example to .env and uncomment what you need.

Main

Variable	Description	Default	Mandatory
ALLOWED_ORIGINS	Comma-separated CORS allowlist used by server CORS config.	http://localhost:<PORT> (computed in code if unset)	No
APP_URL	Public app URL used for URL-aware security behavior (e.g. HSTS).	None	No
DISABLE_HSTS	Disables HSTS behavior when set to "true". Has no effect when SSL is disabled.	Unset (false behavior)	No
HOST	Bind host for HTTP server.	0.0.0.0 (code default)	No
IGDB_CLIENT_ID	IGDB API client ID for game metadata/discovery. Can also be set via the UI (recommended).	None	Conditional
IGDB_CLIENT_SECRET	IGDB API client secret for game metadata/discovery. Can also be set via the UI (recommended).	None	Conditional
JWT_SECRET	JWT signing secret for auth tokens. If not set, a secure random secret is auto-generated and stored in the database — sessions will reset on restart unless this is set.	Auto-generated	No (recommended in production)
LOG_LEVEL	Logger level used by server logger.	debug	No
NODE_ENV	Runtime environment mode.	production (code and Dockerfile)	No
PGID	Container process group ID mapping for file permissions.	1000 (Dockerfile + compose)	No
PUID	Container process user ID mapping for file permissions.	1000 (Dockerfile + compose)	No
PORT	HTTP server port. Compose maps ${PORT:-5000}:5000.	5000	No
SQLITE_DB_PATH	SQLite file path used by the app.	sqlite.db (bare); /app/data/sqlite.db (Docker)	No
SSL_PORT	HTTPS port, consumed by the SSL config loader and compose port mapping.	9898	No
XREL_API_BASE	xREL API base URL override (validated against allowlist).	https://xrel-api.nfos.to	No

Note: IGDB credentials can be configured through Settings → IGDB API in the UI instead of env vars. UI values take precedence over env vars and do not require a container restart.

PostgreSQL (migrating users only)

These variables are only needed when running the one-time PostgreSQL → SQLite migration with docker-compose.migrate.yml. They are not used by the application itself.

Variable	Description	Default
DATABASE_URL	PostgreSQL connection string for the migration script.	postgresql://postgres:password@db:5432/questarr
POSTGRES_DB	PostgreSQL database name.	questarr
POSTGRES_PASSWORD	PostgreSQL password.	password
POSTGRES_USER	PostgreSQL username.	postgres

Development / CI

Variable	Description	Default
CI	CI flag used by Playwright (forbidOnly, retries, workers).	Unset
CODECOV_TOKEN	Enables and authenticates Vite Codecov plugin upload.	None