EnvironmentVariables.md

Environment Variables

Environment Variable	Description	Default	Required
App Configuration
DOMAIN	The base URL or domain name where the instance is hosted. Required for link sharing and notifications to work properly.
STEAMGRIDDB_API_KEY	API key for SteamGridDB integration to fetch game metadata and assets.
MINUTES_BETWEEN_VIDEO_SCANS	How often (in minutes) the video library is scanned for new or removed files. 0 disables the automatic scan entirely; you can still scan on demand from the admin panel.	5
ANALYTICS_TRACKING_SCRIPT	A full <script> tag from an analytics provider (e.g. Umami, Plausible) to inject into the frontend.
TZ	Timezone for the container.	UTC
FS_LOGLEVEL	Log level for the application. Valid values: DEBUG, INFO, WARNING, ERROR, CRITICAL.	INFO
THUMBNAIL_VIDEO_LOCATION	The timestamp (in seconds) used to capture the video thumbnail preview.	50
Storage
DATA_DIRECTORY	Absolute path to the directory where application database and metadata are stored.	$(pwd)/fireshare/data/	Yes
PROCESSED_DIRECTORY	Absolute path to the directory where derived data e.x optimized/transcoded videos, symlinks, posters... are stored.	$(pwd)/fireshare/processed/	Yes
VIDEO_DIRECTORY	Absolute path to the source directory containing raw video files.	$(pwd)/path/to/my/videos/	Yes
IMAGE_DIRECTORY	Absolute path to the source directory containing raw image files.	$(pwd)/path/to/my/images/	Yes
Demo Mode
DEMO_MODE	Set to true to enable demo mode. Uses known credentials, disables transcoding, blocks destructive actions, and hides sensitive API keys.	false
DEMO_UPLOAD_LIMIT_MB	Maximum upload size in MB when DEMO_MODE is enabled. Files over the limit are rejected before upload begins. 0 disables the limit.	0
DEMO_MODE_DELETE_ALL	Set to true to wipe all data, processed, video, and image directories on container startup. Only takes effect when DEMO_MODE is also true. Useful for resetting a demo instance to a clean state on every restart.	false
Security
SECRET_KEY	Signs the login cookies. You do not need to set this — a random key is generated on first start and persisted to /data/.secret_key, so sessions survive restarts. Set it only when several containers must share sessions, and never to a value published anywhere. See Docs	(generated)
ADMIN_USERNAME	The username for the initial administrative account.	admin
ADMIN_PASSWORD	The password for the initial administrative account.	admin
DISABLE_ADMINCREATE	Set to true to prevent automatic admin account creation on first run.	false
LOGIN_IP_WHITELIST	Comma-separated list of IP addresses and/or CIDR ranges (IPv4 and IPv6) allowed to log in, e.g. 203.0.113.5,10.0.0.0/8,2001:db8::/32. When set, login requests from any other IP are rejected and the login page is hidden. Empty/unset disables the whitelist. The container fails to start if an entry is malformed. See Docs
LOGIN_IP_WHITELIST_TRUSTED_PROXIES	Number of trusted reverse-proxy hops in front of the app, used to determine the real client IP. The bundled nginx counts as one hop. Set to 2 when running behind an additional reverse proxy (Traefik, Nginx Proxy Manager, Cloudflare, ...). See Docs	1
LDAP	Removed. LDAP authentication is no longer supported. Fireshare refuses to start while any LDAP_* variable is still set — see Users.md.
MFA / 2FA	Authenticator-app two-factor authentication requires no environment variables — enable it per account in Settings → Security. See Security.md.
CORS_ORIGINS	Comma-separated origins allowed to call the API from a different origin, with cookies, e.g. https://app.example.com,http://192.168.1.50:3000. Unset means same-origin only, which is what a normal deployment wants — set it only if the frontend is served separately. Each entry is a full origin (scheme, host, port) matched exactly; * is rejected. See Docs	(unset)
SECURE_COOKIES	Set to true to mark the login cookies Secure so browsers only send them over HTTPS. Leave false if you reach Fireshare over plain HTTP, or logging in will silently fail. The cookies are always HttpOnly and SameSite=Lax regardless. See Docs	false
Transcoding
ENABLE_TRANSCODING	Set to true to enable video transcoding. See README for details.	false
TRANSCODE_GPU	Set to true to use NVIDIA GPU (NVENC) for transcoding instead of CPU. Requires an NVIDIA GPU with NVENC support.	false
NVIDIA_DRIVER_CAPABILITIES	Driver capabilities the NVIDIA Container Toolkit exposes to the container. Must include video (or be all) for NVENC to work. Set by the image; only override it if you know you need to.	compute,utility,video
TRANSCODE_TIMEOUT	Maximum time in seconds allowed for a single transcoding job before it is cancelled.	7200
Integrations
DISCORD_WEBHOOK_URL	Discord Server/Channel webhook URL used to send a notification on new uploads. See Docs
GENERIC_WEBHOOK_URL	Endpoint for a generic webhook POST notification. Must be used with GENERIC_WEBHOOK_PAYLOAD. See Docs
GENERIC_WEBHOOK_PAYLOAD	JSON payload template POSTed to GENERIC_WEBHOOK_URL. See Docs for full example and payload options.
Container
PUID	User ID the container process runs as. Useful for matching host file permissions.	1000
PGID	Group ID the container process runs as. Useful for matching host file permissions.	1000
Web Server
FIRESHARE_PORT	The port the web server (nginx) listens on inside the container. Most users should leave this at 80 and change the host-side ports mapping instead; it is primarily useful with network_mode: host, where the ports mapping is ignored and this value is the port exposed directly on the host.	80
GUNICORN_WORKERS	Number of gunicorn worker processes. On high core-count machines the default formula (cpu_count × 2 + 1) can spawn dozens of processes; set this to a fixed value to stay within container PID limits.	min(cpu_count × 2 + 1, 4)
GUNICORN_WORKER_CAP	Upper bound applied to the auto-calculated worker count. Set to 0 to remove the cap entirely and revert to the original cpu_count × 2 + 1 behaviour.	4
GUNICORN_THREADS	Number of threads per worker process.	8

Note: ADMIN_USERNAME and ADMIN_PASSWORD are re-applied on every start, and they manage exactly one account — the administrator created on first run. Additional accounts created through Settings > Users or fireshare add-user are never touched by these variables, and that pinned account cannot be demoted or deleted while they are set. See Users, Permissions, and Profiles.