Configuration reference

This page lists every configuration key ReputeCast reads, with the ReputeCast environment variables that set them and their defaults.

ReputeCast builds its configuration from five layers; a later layer overrides an earlier one:

1. Built-in defaults (the Default column below).
2. The YAML file named by --config or REPUTECAST_CONFIG.
3. REPUTECAST_* environment variables. A double underscore separates levels: REPUTECAST_HTTP__PUBLIC_URL sets http.public_url.
4. DATABASE_URL, only when REPUTECAST_DATABASE__URL is not set.
5. Command-line flags you pass explicitly: --role, --addr, --database-url and --log-level.

For list keys (roles, http.trusted_proxies, secrets.previous_keys, dns.servers), separate the values in an environment variable with commas. ReputeCast refuses to start when a value can’t be parsed, a role is not web, worker or ingest, http.public_url is not an absolute URL, secrets.key is not a base64-encoded 32-byte key, or auth.password_min_length is below 8. Configure ReputeCast explains the layers with a complete YAML example.

general

Key	Environment variable	Default	Description
envstring	REPUTECAST_ENV	production	Run mode: production or development. development enables the seed and demo commands, the demo's simulated providers, DNS and other services, delivery of the demo's mail to mail.dev_smtp and the pseudo-locale. Use production for every real instance.
roleslist	REPUTECAST_ROLES	web,worker,ingest	Roles this process runs: web (app, API, public pages, MCP and the SMTP relay), ingest (provider webhooks) and worker (background jobs). The --role flag of serve overrides it. As an environment variable, separate roles with commas.

http

Key	Environment variable	Default	Description
http.addrstring	REPUTECAST_HTTP__ADDR	:8080	Address the HTTP server listens on. The --addr flag of serve overrides it.
http.public_urlstring	REPUTECAST_HTTP__PUBLIC_URL	http://localhost:8080	Address people and sending providers use to reach this instance. ReputeCast builds provider webhook URLs, sign-in redirects, passkeys, public pages and links in emails from it, so providers must be able to reach it from the internet. Must be an absolute URL; an https:// address turns on HSTS and Secure cookies. A public URL saved in Instance admin › Instance & updates replaces it.
http.trusted_proxieslist	REPUTECAST_HTTP__TRUSTED_PROXIES	—	IP addresses or CIDR ranges of your reverse proxies. Only requests from them may set the client address with X-Forwarded-For or X-Real-IP, which rate limits and the audit log use. As an environment variable, separate entries with commas.
http.rate_limit_authint	REPUTECAST_HTTP__RATE_LIMIT_AUTH	30	Requests per minute each client IP address may make to the sign-in endpoints (/api/v1/auth/*).
http.rate_limit_apiint	REPUTECAST_HTTP__RATE_LIMIT_API	600	Requests per minute each API key may make to the API, or each IP address for browser sessions. 0 or less turns off both this limit and http.rate_limit_auth.
http.read_timeoutduration	REPUTECAST_HTTP__READ_TIMEOUT	30s	Longest time the server waits to read a whole request, body included.
http.write_timeoutduration	REPUTECAST_HTTP__WRITE_TIMEOUT	60s	Longest time the server spends writing a response.
http.shutdown_timeoutduration	REPUTECAST_HTTP__SHUTDOWN_TIMEOUT	20s	How long a stopping process waits for open requests to finish.

database

Key	Environment variable	Default	Description
database.urlstring	REPUTECAST_DATABASE__URL	postgres://reputecast:reputecast@localhost:5432/reputecast?sslmode=disable	PostgreSQL connection URL. When REPUTECAST_DATABASE__URL is unset, DATABASE_URL is used instead. The --database-url flag overrides both. The default matches the development database.
database.max_connsint	REPUTECAST_DATABASE__MAX_CONNS	20	Size of each process's connection pool. Keep the total over all processes below PostgreSQL's max_connections.

secrets

Key	Environment variable	Default	Description
secrets.keystring	REPUTECAST_SECRETS__KEY	—	Base64-encoded 32-byte key that encrypts provider credentials and other secrets in the database (AES-256-GCM). Create one with reputecast secrets generate-key. When it is empty, the key is read from secrets.key_file. Back it up with the database: without it, stored credentials can't be decrypted.
secrets.previous_keyslist	REPUTECAST_SECRETS__PREVIOUS_KEYS	—	Earlier keys, still accepted for decrypting while you rotate. To rotate, move the current key here and set a new secrets.key. As an environment variable, separate keys with commas.
secrets.key_filestring	REPUTECAST_SECRETS__KEY_FILE	data/secret.key	File that holds the key when secrets.key is empty, relative to the working directory unless absolute. If the file doesn't exist, ReputeCast creates it with a new key (mode 0600) and logs a warning to back it up. The Docker image sets /var/lib/reputecast/secret.key.

log

Key	Environment variable	Default	Description
log.levelstring	REPUTECAST_LOG__LEVEL	info	Lowest level logged: debug, info, warn or error. The --log-level flag overrides it.
log.formatstring	REPUTECAST_LOG__FORMAT	text	Log format, text or json. Logs go to standard error. The Docker image sets json.

auth

Key	Environment variable	Default	Description
auth.session_idleduration	REPUTECAST_AUTH__SESSION_IDLE	12h	Idle timeout used only when the authentication policy can't be read from the database. Set the idle timeout in Instance admin › Authentication.
auth.cookie_namestring	REPUTECAST_AUTH__COOKIE_NAME	rc_session	Name of the session cookie.
auth.cookie_securebool	REPUTECAST_AUTH__COOKIE_SECURE	true	Mark the session cookie Secure, so browsers send it over HTTPS only. Ignored in development. An http.public_url that starts with https:// always makes the cookie Secure.
auth.password_min_lengthint	REPUTECAST_AUTH__PASSWORD_MIN_LENGTH	12	Minimum length of passwords set with reputecast install and reputecast user reset-password --password. At least 8. Passwords set in the app follow the policy in Instance admin › Authentication.

worker

Key	Environment variable	Default	Description
worker.concurrencyint	REPUTECAST_WORKER__CONCURRENCY	50	Background jobs a worker process runs at once on its sending queue. The other queues get a share of it: events half, default a quarter and system a fifth, at least 2 each. Values below 4 count as 4.

updates

Key	Environment variable	Default	Description
updates.checkbool	REPUTECAST_UPDATES__CHECK	true	Allow the daily check for a newer ReputeCast release on GitHub and for a newer WordPress plugin. false turns both off for the whole instance. When it is true, instance admins can still turn the check off in Instance admin › Instance & updates.
updates.repostring	REPUTECAST_UPDATES__REPO	hostrepute/reputecast	GitHub repository the release check reads, as owner/name.

metrics

Key	Environment variable	Default	Description
metrics.enabledbool	REPUTECAST_METRICS__ENABLED	true	Serve Prometheus metrics at /metrics.
metrics.addrstring	REPUTECAST_METRICS__ADDR	—	Separate listen address for /metrics, such as :9090. Empty serves /metrics on the main HTTP listener. A process that runs only the worker role has no main listener, so set this to collect its metrics.

webhooks

Key	Environment variable	Default	Description
webhooks.allow_private_networksbool	REPUTECAST_WEBHOOKS__ALLOW_PRIVATE_NETWORKS	false	Let URLs that ReputeCast sends webhooks to (webhook endpoints, the audit log stream, integration hooks such as a private n8n, and referral reward webhooks) resolve to loopback and private (RFC 1918) addresses. Off by default, so users can't reach internal services. Link-local and cloud metadata addresses are always blocked.

providers

Key	Environment variable	Default	Description
providers.allow_private_networksbool	REPUTECAST_PROVIDERS__ALLOW_PRIVATE_NETWORKS	false	Let addresses that workspace admins enter for outside services resolve to loopback and private (RFC 1918) addresses: sending provider APIs and SMTP servers, community adapter processes, AI model servers, importers, feeds, verification services, seed mailboxes and other connected services. Off by default, so users can't reach internal services. Link-local and cloud metadata addresses are always blocked. Community adapters on such addresses may use plain http://.

hostrepute

Key	Environment variable	Default	Description
hostrepute.api_urlstring	REPUTECAST_HOSTREPUTE__API_URL	https://api.hostrepute.com/v1	HostRepute API base URL for new connections.
hostrepute.auth_urlstring	REPUTECAST_HOSTREPUTE__AUTH_URL	https://app.hostrepute.com/oauth/authorize	HostRepute OAuth authorization endpoint.
hostrepute.token_urlstring	REPUTECAST_HOSTREPUTE__TOKEN_URL	https://api.hostrepute.com/oauth/token	HostRepute OAuth token endpoint.
hostrepute.revoke_urlstring	REPUTECAST_HOSTREPUTE__REVOKE_URL	https://api.hostrepute.com/oauth/revoke	HostRepute OAuth token revocation endpoint, called when a workspace disconnects.
hostrepute.client_idstring	REPUTECAST_HOSTREPUTE__CLIENT_ID	reputecast	OAuth client ID. ReputeCast connects as a public client with PKCE; set this and hostrepute.client_secret only if you registered your own client with HostRepute.
hostrepute.client_secretstring	REPUTECAST_HOSTREPUTE__CLIENT_SECRET	—	OAuth client secret of your own registered client. Leave it empty for the default public client.
hostrepute.demobool	REPUTECAST_HOSTREPUTE__DEMO	false	Use a built-in offline HostRepute with sample data and instant OAuth approval, for development and screenshots.

dns

Key	Environment variable	Default	Description
dns.serverslist	REPUTECAST_DNS__SERVERS	—	DNS resolvers for authentication checks and blocklist lookups, as host or host:port. Empty uses the system resolvers. Blocklists such as Spamhaus refuse queries that come through public resolvers, so use your own resolver. As an environment variable, separate servers with commas.
dns.timeoutduration	REPUTECAST_DNS__TIMEOUT	4s	Timeout of one DNS lookup.

mail

Key	Environment variable	Default	Description
mail.dev_smtpstring	REPUTECAST_MAIL__DEV_SMTP	localhost:1025	Development only: SMTP address (host:port) of a mail catcher such as Mailpit, where mail for the demo's sample providers goes instead of a real provider.

connect

Key	Environment variable	Default	Description
connect.ses_template_urlstring	REPUTECAST_CONNECT__SES_TEMPLATE_URL	https://reputecast.com/cf/reputecast-ses.yaml	CloudFormation template that the Launch stack link opens when you connect Amazon SES. Point it at your own published copy to use a different template.

i18n

Key	Environment variable	Default	Description
i18n.pseudo_localebool	REPUTECAST_I18N__PSEUDO_LOCALE	false	Offer the Pseudo (+40%) app language outside development, to check layouts on a staging instance. Every string is accented, about 40% longer and wrapped in ⟦ ⟧. Development always offers it.

files

Key	Environment variable	Default	Description
files.dirstring	REPUTECAST_FILES__DIR	—	Folder for uploaded files such as digital products and lead magnets. Empty uses a files folder next to secrets.key_file (/var/lib/reputecast/files in the Docker image). When you split roles across machines, every web and worker process needs the same folder.

Environment-only variables

Environment variable	Default	Description
REPUTECAST_CONFIGstring	—	Path to a YAML config file, read when the --config flag is not passed.
DATABASE_URLstring	—	PostgreSQL connection URL, used when REPUTECAST_DATABASE__URL is unset. It overrides database.url from the config file.
REPUTECAST_AUTO_MIGRATEbool	false	Default of reputecast serve --auto-migrate: true applies pending migrations at start. The Docker image's start command passes the flag, and the shipped docker-compose.yml sets the variable to true.
REPUTECAST_AUTO_INSTALLbool	false	Default of reputecast serve --auto-install: true creates the first Owner at start when the database has no users. The Docker image's start command passes the flag, and the shipped docker-compose.yml sets the variable to true.
REPUTECAST_ADMIN_EMAILstring	—	Email of the first Owner, read by reputecast install when --email is not passed and by serve --auto-install. The shipped docker-compose.yml passes [email protected] when you don't set it.
REPUTECAST_ADMIN_NAMEstring	—	Name of the first Owner, read by reputecast install when --name is not passed and by serve --auto-install.
REPUTECAST_ADMIN_PASSWORDstring	—	Password of the first Owner, read by reputecast install when --password is not passed and by serve --auto-install. When it is unset, a temporary password is printed instead.
REPUTECAST_IMAGEstring	ghcr.io/hostrepute/reputecast	Read by the shipped docker-compose.yml, not by ReputeCast: the image the app service runs. Set it to reputecast with REPUTECAST_VERSION=local to run an image built from a checkout with make docker VERSION=local.
REPUTECAST_VERSIONstring	latest	Read by the shipped docker-compose.yml, not by ReputeCast: the image tag the app service runs.
REPUTECAST_PORTint	8080	Read by the shipped docker-compose.yml, not by ReputeCast: the host port published to the app container's port 8080.
REPUTECAST_PUBLIC_URLstring	http://localhost:8080	Read by the shipped docker-compose.yml, which passes it to the app as REPUTECAST_HTTP__PUBLIC_URL. Setting it on a binary you run yourself does nothing; set REPUTECAST_HTTP__PUBLIC_URL there.
POSTGRES_PASSWORDstring	reputecast	Read by the shipped docker-compose.yml: the password of the postgres service's reputecast user, also used in the app's database URL. Set your own before the first start.
REPUTECAST_ADAPTER_SECRETlist	—	Read by community adapter processes built with the adapter SDK: the signing secret that reputecast adapter install or reputecast adapter secret printed. During a rotation, set several secrets separated by commas.
REPUTECAST_ADAPTER_ALLOW_HOSTSlist	—	Read by community adapter processes built with the adapter SDK: extra hosts the adapter may call on top of those in its manifest, separated by commas, for example a local fake provider in tests.
REPUTECAST_ADAPTER_LOG_LEVELstring	info	Read by community adapter processes built with the adapter SDK: the lowest level logged, debug, info, warn or error.
PORTint	4600	Read by community adapter processes built with the adapter SDK: the port the adapter listens on.
HOSTstring	127.0.0.1	Read by community adapter processes built with the adapter SDK: the address the adapter listens on. The adapter template's Docker image sets 0.0.0.0.

Related

• Install with Docker Compose shows where the Compose file sets these variables.
• Reverse proxy and TLS covers http.public_url and http.trusted_proxies.
• Security and hardening explains the secret key and key rotation.
• CLI reference lists the commands that read this configuration.