# All environment variables

Every environment variable of Flowplan in one table, from A to Z – with its default, its meaning in one sentence and the section that describes it in full.

The variables are read when the container starts, for example from the `.env` file next to `compose.yaml` or from the environment variables in Coolify ([Installation](/installation)). Many values can also be set in the **Administration**; what is saved there takes precedence ([In the interface](/configuration#in-the-interface)).

The list is put together from the pages of this documentation; a test checks against Flowplan's code that no variable is missing. The field above the table filters it, also by parts such as `S3_` or `OIDC`.

| Variable | Default | Meaning | Described in |
| --- | --- | --- | --- |
| `APP_URL` | – | The public address exactly as it appears in the browser – scheme, host, port if any, without a trailing slash. | [Configuration › Required](/configuration#required) |
| `DATABASE_SESSION_URL` | `DATABASE_URL` | A direct connection (or a `session`-mode pool) for notifications, the lead in a cluster and `pg_dump`/`pg_restore`, when `DATABASE_URL` points at PgBouncer in `transaction` mode. | [Configuration: storage, database and security › Database and cluster](/configuration-storage#database-and-cluster) |
| `DATABASE_URL` | *empty* | `postgres://…` switches to PostgreSQL. | [Configuration: storage, database and security › Database and cluster](/configuration-storage#database-and-cluster) |
| `DRAWIO_URL` | `https://embed.diagrams.net` | Address of the draw.io editor for the `/drawio` block, e.g. your own `jgraph/drawio` container. https only (http only for `localhost`); an invalid value turns draw.io off. | [Configuration: storage, database and security › Legal and interface](/configuration-storage#legal-and-interface) |
| `EXPORT_GIT_AUTHOR` | – | Author of the commits. | [Markdown export and Git › Push into a Git repository](/markdown-git-export#push-into-a-git-repository) |
| `EXPORT_GIT_BRANCH` | – | Branch, default `main`. | [Markdown export and Git › Push into a Git repository](/markdown-git-export#push-into-a-git-repository) |
| `EXPORT_GIT_EMAIL` | – | Author of the commits. | [Markdown export and Git › Push into a Git repository](/markdown-git-export#push-into-a-git-repository) |
| `EXPORT_GIT_IMPORT` | – | `true`: changes made in the repository since the last run are taken over before exporting. | [Markdown export and Git › Push into a Git repository](/markdown-git-export#push-into-a-git-repository) |
| `EXPORT_GIT_TOKEN` | – | Token with write access to that repository. | [Markdown export and Git › Push into a Git repository](/markdown-git-export#push-into-a-git-repository) |
| `EXPORT_GIT_URL` | – | `https://` address of the repository, without credentials. | [Markdown export and Git › Push into a Git repository](/markdown-git-export#push-into-a-git-repository) |
| `EXPORT_GIT_USERNAME` | – | User name for the token (default `flowplan`; GitLab: `oauth2`). | [Markdown export and Git › Push into a Git repository](/markdown-git-export#push-into-a-git-repository) |
| `FLOWPLAN_AI` | *off* | `on` switches AI on. | [Configuration: AI, voice notes and push › AI](/configuration-ai-push#ai) |
| `FLOWPLAN_AI_ACCESS` | `everyone` | `selected`: only people who were enabled. | [Configuration: AI, voice notes and push › AI](/configuration-ai-push#ai) |
| `FLOWPLAN_AI_API_KEY` | *empty* | The provider's key. | [Configuration: AI, voice notes and push › AI](/configuration-ai-push#ai) |
| `FLOWPLAN_AI_API_KEY_FILE` | *empty* | The provider's key. | [Configuration: AI, voice notes and push › AI](/configuration-ai-push#ai) |
| `FLOWPLAN_AI_BASE_URL` | *per provider* | Address of the provider, e.g. `https://api.mistral.ai/v1` for an OpenAI-compatible service. | [Configuration: AI, voice notes and push › AI](/configuration-ai-push#ai) |
| `FLOWPLAN_AI_DEVICE` | *on* | `off`: no [on-device AI](/ai#on-device-ai-apple) in the apps for iPhone, iPad and Mac. | [Configuration: AI, voice notes and push › AI](/configuration-ai-push#ai) |
| `FLOWPLAN_AI_EMBED_PER_HOUR` | `5000` | Maximum chunks embedded per hour for semantic search. | [Configuration: AI, voice notes and push › AI](/configuration-ai-push#ai) |
| `FLOWPLAN_AI_EMBEDDING_MODEL` | *empty* | Model for semantic search, e.g. `nomic-embed-text` (Ollama). | [Configuration: AI, voice notes and push › AI](/configuration-ai-push#ai) |
| `FLOWPLAN_AI_FEATURES` | *all* | Allowed features, comma-separated: `write`, `summarize`, `ask`, `database`, `actions`, `whiteboard`. | [Configuration: AI, voice notes and push › AI](/configuration-ai-push#ai) |
| `FLOWPLAN_AI_GUESTS` | *off* | `on`: guests may use AI too. | [Configuration: AI, voice notes and push › AI](/configuration-ai-push#ai) |
| `FLOWPLAN_AI_MODEL` | *empty* | Model, e.g. `llama3.1` or `gpt-4o-mini`. | [Configuration: AI, voice notes and push › AI](/configuration-ai-push#ai) |
| `FLOWPLAN_AI_PROVIDER` | *empty* | `ollama`, `openai` (OpenAI-compatible), `anthropic` or `gemini`. | [Configuration: AI, voice notes and push › AI](/configuration-ai-push#ai) |
| `FLOWPLAN_AI_REQUESTS_PER_HOUR` | `300` | Maximum AI requests per person and hour (plus 30 per minute, 3 at once). | [Configuration: AI, voice notes and push › AI](/configuration-ai-push#ai) |
| `FLOWPLAN_AI_SEMANTIC_SEARCH` | *off* | `on`: [semantic search](/ask-ai#semantic-search-optional) with the embedding model. | [Configuration: AI, voice notes and push › AI](/configuration-ai-push#ai) |
| `FLOWPLAN_AI_TOKENS` | – | Environment: `FLOWPLAN_AI_TOKENS=off` switches the token permission off by default (until an administrator saves the AI settings). | [Meetings › API and MCP](/meetings#api-and-mcp) |
| `FLOWPLAN_AI_USER_PROVIDERS` | *off* | `on`: people may add their own provider and key. | [Configuration: AI, voice notes and push › AI](/configuration-ai-push#ai) |
| `FLOWPLAN_ANONYMOUS_UPLOAD_MB` | `1024` | How many MB visitors without an account may upload per day on the whole instance – through anonymous forms and editing links (`0` = unlimited). | [Configuration › Operations](/configuration#operations) |
| `FLOWPLAN_BACKUP_FORMAT` | `pg_dump` | `sqlite`: scheduled backups on PostgreSQL in the portable SQLite format. | [Configuration: storage, database and security › Database and cluster](/configuration-storage#database-and-cluster) |
| `FLOWPLAN_CLUSTER` | *empty* | `1`: several instances; requires `DATABASE_URL`, `REDIS_URL`, `S3_BUCKET`, `FLOWPLAN_ENCRYPTION_KEY` (or `FLOWPLAN_SECRETS_KEY`) and `WEB_PUSH_PUBLIC_KEY`/`WEB_PUSH_PRIVATE_KEY`. | [Configuration: storage, database and security › Database and cluster](/configuration-storage#database-and-cluster) |
| `FLOWPLAN_COUNTRY_HEADER` | *empty* | The proxy's header with the country of the request (e.g. `CF-IPCountry`); turns on the rule "two countries in a short time". | [Configuration › Operations](/configuration#operations) |
| `FLOWPLAN_DATA_DIR` | `/app/data` in the image, `./data` otherwise | Data directory for SQLite, uploads, push keys and text recognition data. | [Configuration › Operations](/configuration#operations) |
| `FLOWPLAN_DIST_DIR` | – | `FLOWPLAN_DIST_DIR` is only meant for parallel development servers, `OIDC_ALLOW_LOCAL_HTTP` only for tests with a provider on `http://localhost`, `FLOWPLAN_GIT_ALLOW_HTTP` only for tests of the Git export with an `http://` server (no effect in production). | [Configuration › Do not set](/configuration#do-not-set) |
| `FLOWPLAN_DROP_ROOT` | – | The image sets `NODE_ENV`, `PORT`, `HOSTNAME` and `NEXT_TELEMETRY_DISABLED` itself, and `FLOWPLAN_DROP_ROOT=1` (Flowplan's tools in the container give up root and run as `PUID:PGID`). | [Configuration › Do not set](/configuration#do-not-set) |
| `FLOWPLAN_ENCRYPTION_KEY` | *empty* | 32 bytes, base64 (`openssl rand -base64 32`). | [Configuration: storage, database and security › Encryption](/configuration-storage#encryption) |
| `FLOWPLAN_ENCRYPTION_KEY_FILE` | *empty* | Instead of the variable: path to a file holding the key (Docker secret). | [Configuration: storage, database and security › Encryption](/configuration-storage#encryption) |
| `FLOWPLAN_ENCRYPTION_KEY_PREVIOUS` | *empty* | Earlier keys, comma-separated – only for reading after a key change. | [Configuration: storage, database and security › Encryption](/configuration-storage#encryption) |
| `FLOWPLAN_GIT_ALLOW_HTTP` | – | `FLOWPLAN_DIST_DIR` is only meant for parallel development servers, `OIDC_ALLOW_LOCAL_HTTP` only for tests with a provider on `http://localhost`, `FLOWPLAN_GIT_ALLOW_HTTP` only for tests of the Git export with an `http://` server (no effect in production). | [Configuration › Do not set](/configuration#do-not-set) |
| `FLOWPLAN_HIDE_SPONSOR` | `false` | `true` hides only the **Support Flowplan ♥** part (link to GitHub Sponsors) under **Settings → About Flowplan**. | [Configuration: storage, database and security › Legal and interface](/configuration-storage#legal-and-interface) |
| `FLOWPLAN_IMPORT_MAX_DOCS` | `10000` | Largest number of pages per [import](/migrate) from AFFiNE, Confluence, Evernote, Google Docs, Obsidian and Notion/Markdown: documents, folders, databases, whiteboards and collections; when importing as a new database, the number of records. | [Configuration › Operations](/configuration#operations) |
| `FLOWPLAN_IMPORT_MAX_FILES` | `20000` | Largest number of files (images, attachments) per import from an AFFiNE workspace or snapshot; further ones are left out, the preview names their number and the variable. | [Configuration › Operations](/configuration#operations) |
| `FLOWPLAN_IMPORT_MAX_MB` | *empty* | Largest file for [imports from AFFiNE](/migrate-affine) and other tools in MB, for everyone. | [Configuration › Operations](/configuration#operations) |
| `FLOWPLAN_INSTANCE_ID` | host name + random | Name of the instance in the overview and in the `application_name` of its database connections. | [Cluster mode › More variables](/cluster#more-variables) |
| `FLOWPLAN_LEADER_INTERVAL` | `5000` | How often (ms) instances check the lead; decides how fast a failed leader is replaced. | [Cluster mode › More variables](/cluster#more-variables) |
| `FLOWPLAN_LITESTREAM` | on | `off`: only mirror files, do not back up the database. | [Configuration: storage, database and security › S3 and database backup](/configuration-storage#s3-and-database-backup) |
| `FLOWPLAN_LITESTREAM_SSE_C` | – | The container's start sets `FLOWPLAN_LITESTREAM_SSE_C` when `LITESTREAM_SSE_C_KEY` is set; the administration uses it to show whether the Litestream copy is encrypted. | [Configuration › Do not set](/configuration#do-not-set) |
| `FLOWPLAN_LOCAL_LOGIN` | on | `false` turns off e-mail, password and passkeys; then only single sign-on remains. | [Configuration › Sign-in](/configuration#sign-in) |
| `FLOWPLAN_MARKETPLACE_URL` | `https://marketplace.flowplan.org` | Address of the Flowplan Marketplace (default `https://marketplace.flowplan.org`); `off` switches it off. | [Configuration › Operations](/configuration#operations) |
| `FLOWPLAN_MAX_DOCUMENT_MB` | `16` | Largest size of a collaboratively edited document (page or record document) in MB. | [Configuration › Operations](/configuration#operations) |
| `FLOWPLAN_MESSENGER_ALLOW_PRIVATE` | as `FLOWPLAN_WEBHOOK_ALLOW_PRIVATE` | `true`: people may name servers in the own network (internal addresses, `http://`) – e.g. Gotify or ntfy at home. | [Configuration: e-mail, integrations and workflows › Chat apps](/configuration-integrations#chat-apps) |
| `FLOWPLAN_MESSENGERS` | *all* | Services people may connect, comma-separated: `telegram`, `gotify`, `ntfy`, `matrix`; `off` for none. | [Configuration: e-mail, integrations and workflows › Chat apps](/configuration-integrations#chat-apps) |
| `FLOWPLAN_METRICS` | on | `off` switches off the usage statistics of the [monitoring](/monitoring#statistics): requests, errors and response times per minute, active people per hour, storage history and AI tokens. | [Configuration › Operations](/configuration#operations) |
| `FLOWPLAN_METRICS_LOOP` | – | > **For load tests:** `FLOWPLAN_METRICS_LOOP=1` also measures the delay and utilisation of the Node event loop and the time spent in SQLite, and adds them to `/api/metrics`. | [Monitoring and maintenance › Prometheus](/monitoring#prometheus) |
| `FLOWPLAN_METRICS_TOKEN` | *empty* | At least 16 characters; enables `/api/metrics` in Prometheus format. | [Configuration › Operations](/configuration#operations) |
| `FLOWPLAN_MODE` | – | Equivalent: `FLOWPLAN_MODE=cluster`. | [Cluster mode › More variables](/cluster#more-variables) |
| `FLOWPLAN_MOVE_ALLOW_PRIVATE` | *empty* | On the **new** instance: `true` allows taking over an instance at an internal address (LAN, VPN, `localhost`) and over `http://` – a home server, say. | [Configuration: storage, database and security › Instance move](/configuration-storage#instance-move) |
| `FLOWPLAN_OCR` | on | `0` turns off text recognition for scanned PDFs and images. | [Configuration › Operations](/configuration#operations) |
| `FLOWPLAN_OCR_LANGS` | `deu,eng` | Languages of the text recognition, e.g. `fra,eng`; the first is the main language. | [Configuration › Operations](/configuration#operations) |
| `FLOWPLAN_PG_BIN` | *empty* | Folder with `pg_dump`, `pg_restore` and `psql` if they are not on the `PATH`. | [PostgreSQL › Variables](/postgresql#variables) |
| `FLOWPLAN_PG_CONNECT_TIMEOUT` | `30000` | Longest a request waits for a free connection from the pool (ms). | [PostgreSQL › Variables](/postgresql#variables) |
| `FLOWPLAN_PG_IDLE_TX_TIMEOUT` | `60000` | A transaction idle this long is ended (ms). | [PostgreSQL › Variables](/postgresql#variables) |
| `FLOWPLAN_PG_LOCK_TIMEOUT` | `10000` | Longest a query waits for a lock (ms). | [PostgreSQL › Variables](/postgresql#variables) |
| `FLOWPLAN_PG_POOL` | `public`, `10`, … | Schema, connections per instance and time limits. | [Configuration: storage, database and security › Database and cluster](/configuration-storage#database-and-cluster) |
| `FLOWPLAN_PG_PREPARE` | on | `off`: unnamed queries instead of named prepared statements – for PgBouncer in `transaction` mode without `max_prepared_statements`. | [Configuration: storage, database and security › Database and cluster](/configuration-storage#database-and-cluster) |
| `FLOWPLAN_PG_SCHEMA` | `public`, `10`, … | Schema, connections per instance and time limits. | [Configuration: storage, database and security › Database and cluster](/configuration-storage#database-and-cluster) |
| `FLOWPLAN_PG_SCHEMA_AUTO` | on | `off`: the instance does not create or update the schema itself – a separate step does (`node /app/scripts/db-schema.mjs`, see [cluster mode](/en/cluster#schema-before-the-start)). | [PostgreSQL › Variables](/postgresql#variables) |
| `FLOWPLAN_PG_STATEMENT_TIMEOUT` | `120000` | Longest a query may run, in milliseconds; `0` = no limit. | [PostgreSQL › Variables](/postgresql#variables) |
| `FLOWPLAN_PGVECTOR` | on | `off` ignores `pgvector` even when it is installed. | [PostgreSQL › Variables](/postgresql#variables) |
| `FLOWPLAN_PUBLIC_API_DOCS` | `false` | `true` makes `/api/openapi.json` and `/api/docs` readable without signing in; visitors only see the major version (`0.x`) there. | [Configuration › Operations](/configuration#operations) |
| `FLOWPLAN_READY_REQUIRE` | all | Which checks decide `/api/health/ready`. | [Configuration: storage, database and security › Database and cluster](/configuration-storage#database-and-cluster) |
| `FLOWPLAN_REDIS_PREFIX` | `flowplan:` | Prefix for keys and channels when several installations share one Redis. | [Cluster mode › More variables](/cluster#more-variables) |
| `FLOWPLAN_SECRETS_KEY` | – | A key just for this: 32 bytes, base64 or hex (`openssl rand -base64 32`), or the path to a file (Docker secret). | [Configuration: storage, database and security › Stored secrets](/configuration-storage#stored-secrets) |
| `FLOWPLAN_SECRETS_KEY_FILE` | – | A key just for this: 32 bytes, base64 or hex (`openssl rand -base64 32`), or the path to a file (Docker secret). | [Configuration: storage, database and security › Stored secrets](/configuration-storage#stored-secrets) |
| `FLOWPLAN_SECURITY_LOG` | `on` | Security events as a JSON line on stdout: `on` (with address, for fail2ban/CrowdSec), `anonymous`, `off` ([Security](/en/security-monitoring#security)). | [Configuration › Operations](/configuration#operations) |
| `FLOWPLAN_SECURITY_RETENTION_DAYS` | `90` | How long security events stay in the database (at least 7). | [Configuration › Operations](/configuration#operations) |
| `FLOWPLAN_SETUP_TOKEN` | *empty* (Helm: generated) | Recommended for instances reachable from the internet: the first account and the restore on the setup screen only work via `/register?setup=<token>`. | [Configuration › Sign-in](/configuration#sign-in) |
| `FLOWPLAN_SKIP_TYPECHECK` | – | `FLOWPLAN_SKIP_TYPECHECK=1` is meant for development only: it skips the TypeScript check during the build when it already ran, as in our CI. | [Installation with Docker › Build the image yourself](/installation#build-the-image-yourself) |
| `FLOWPLAN_SNAPSHOT_RETENTION_DAYS` | `180` | How long automatic versions are kept, in days (`0` = forever). | [Configuration › Operations](/configuration#operations) |
| `FLOWPLAN_SOURCE_URL` | Flowplan’s GitHub repository | Address of the source of the code running on this instance (http or https). | [Configuration: storage, database and security › Legal and interface](/configuration-storage#legal-and-interface) |
| `FLOWPLAN_TELEGRAM_API_URL` | `https://api.telegram.org` | Address of the Bot API for the instance's bot – a self-hosted [Telegram Bot API server](https://github.com/tdlib/telegram-bot-api) or a relay/proxy. | [Configuration: e-mail, integrations and workflows › Chat apps](/configuration-integrations#chat-apps) |
| `FLOWPLAN_TELEGRAM_BOT_TOKEN` | *empty* | Token of the instance's Telegram bot (from @BotFather). | [Configuration: e-mail, integrations and workflows › Chat apps](/configuration-integrations#chat-apps) |
| `FLOWPLAN_TRUSTED_PROXIES` | `1` | Number of proxies in front of Flowplan (Traefik alone: `1`, Pangolin in front of Traefik: `2`, `0` = trust no header). | [Configuration › Operations](/configuration#operations) |
| `FLOWPLAN_UPDATE_CHECK` | on | `false` turns off the check for new versions (for instances without internet). | [Configuration › Operations](/configuration#operations) |
| `FLOWPLAN_UPDATE_URL` | GitHub API | Another address for the latest release (same format as `api.github.com/repos/yannicschuller/flowplan/releases/latest`), such as an internal mirror. | [Configuration › Operations](/configuration#operations) |
| `FLOWPLAN_VERSION` | – | Choose a fixed version with `FLOWPLAN_VERSION=0.7.0` in `.env`. | [Installation with Docker › With Docker Compose](/installation#with-docker-compose) |
| `FLOWPLAN_WEBHOOK_ALLOW_PRIVATE` | *empty* | `true` allows webhooks to internal addresses and `http://` – such as Home Assistant or n8n in the same network. | [Configuration: e-mail, integrations and workflows › Integrations](/configuration-integrations#integrations) |
| `FLOWPLAN_WORKFLOW_ACTIVE_PER_WORKSPACE` | 100 | Active workflows per workspace | [Configuration: e-mail, integrations and workflows › Workflows](/configuration-integrations#workflows) |
| `FLOWPLAN_WORKFLOW_AI_TOKENS_PER_DAY` | 100000 | AI tokens per workflow and day (0 = AI nodes off) | [Configuration: e-mail, integrations and workflows › Workflows](/configuration-integrations#workflows) |
| `FLOWPLAN_WORKFLOW_CASCADE_DEPTH` | 5 | Depth of workflows triggering each other | [Configuration: e-mail, integrations and workflows › Workflows](/configuration-integrations#workflows) |
| `FLOWPLAN_WORKFLOW_EXTERNAL_MAIL` | `on` | E-mails to addresses outside the members | [Configuration: e-mail, integrations and workflows › Workflows](/configuration-integrations#workflows) |
| `FLOWPLAN_WORKFLOW_FOREACH_MAX` | 100 | Items per “For each” | [Configuration: e-mail, integrations and workflows › Workflows](/configuration-integrations#workflows) |
| `FLOWPLAN_WORKFLOW_HTTP` | `on` | HTTP node allowed | [Configuration: e-mail, integrations and workflows › Workflows](/configuration-integrations#workflows) |
| `FLOWPLAN_WORKFLOW_HTTP_ALLOW_PRIVATE` | `false` | Allow internal addresses (home network, n8n) | [Configuration: e-mail, integrations and workflows › Workflows](/configuration-integrations#workflows) |
| `FLOWPLAN_WORKFLOW_HTTP_HOSTS` | empty | Only these hosts (comma-separated) | [Configuration: e-mail, integrations and workflows › Workflows](/configuration-integrations#workflows) |
| `FLOWPLAN_WORKFLOW_LEASE_MS` | – | > **Development and tests only:** `FLOWPLAN_WORKFLOW_LEASE_MS` (default 120000, a step's [lease](/cluster#workflows-in-a-cluster)), `FLOWPLAN_WORKFLOW_POLL_MS` (5000, how often each instance looks for due steps) and `FLOWPLAN_WORKFLOW_SWEEP_MS` (60000, how often expired leases go back to the queue) … | [Configuration: e-mail, integrations and workflows › Workflows](/configuration-integrations#workflows) |
| `FLOWPLAN_WORKFLOW_MAILS_PER_DAY` | 100 | E-mails per workflow and day | [Configuration: e-mail, integrations and workflows › Workflows](/configuration-integrations#workflows) |
| `FLOWPLAN_WORKFLOW_MAX_WAIT_DAYS` | 365 | Longest wait or approval deadline | [Configuration: e-mail, integrations and workflows › Workflows](/configuration-integrations#workflows) |
| `FLOWPLAN_WORKFLOW_PARALLEL_RUNS` | 10 | Runs of one workflow running at the same time (1–100); further ones wait in the queue | [Configuration: e-mail, integrations and workflows › Workflows](/configuration-integrations#workflows) |
| `FLOWPLAN_WORKFLOW_POLL_MS` | – | > **Development and tests only:** `FLOWPLAN_WORKFLOW_LEASE_MS` (default 120000, a step's [lease](/cluster#workflows-in-a-cluster)), `FLOWPLAN_WORKFLOW_POLL_MS` (5000, how often each instance looks for due steps) and `FLOWPLAN_WORKFLOW_SWEEP_MS` (60000, how often expired leases go back to the queue) … | [Configuration: e-mail, integrations and workflows › Workflows](/configuration-integrations#workflows) |
| `FLOWPLAN_WORKFLOW_RUN_DAYS` | 30 | Days runs are kept | [Configuration: e-mail, integrations and workflows › Workflows](/configuration-integrations#workflows) |
| `FLOWPLAN_WORKFLOW_RUNS_KEPT` | 10000 | Keep at most this many runs per workflow (100–1,000,000); older finished ones are deleted daily, open ones never | [Configuration: e-mail, integrations and workflows › Workflows](/configuration-integrations#workflows) |
| `FLOWPLAN_WORKFLOW_RUNS_PER_MINUTE` | 60 | Runs per minute and workflow | [Configuration: e-mail, integrations and workflows › Workflows](/configuration-integrations#workflows) |
| `FLOWPLAN_WORKFLOW_STEPS_PER_RUN` | 200 | Steps per run | [Configuration: e-mail, integrations and workflows › Workflows](/configuration-integrations#workflows) |
| `FLOWPLAN_WORKFLOW_SWEEP_MS` | – | > **Development and tests only:** `FLOWPLAN_WORKFLOW_LEASE_MS` (default 120000, a step's [lease](/cluster#workflows-in-a-cluster)), `FLOWPLAN_WORKFLOW_POLL_MS` (5000, how often each instance looks for due steps) and `FLOWPLAN_WORKFLOW_SWEEP_MS` (60000, how often expired leases go back to the queue) … | [Configuration: e-mail, integrations and workflows › Workflows](/configuration-integrations#workflows) |
| `FLOWPLAN_WORKFLOW_TEST_RUNS_PER_MINUTE` | 10 | Test and dry runs per person and minute | [Configuration: e-mail, integrations and workflows › Workflows](/configuration-integrations#workflows) |
| `FLOWPLAN_WORKFLOW_WORKERS` | 4 | Steps at once per instance | [Configuration: e-mail, integrations and workflows › Workflows](/configuration-integrations#workflows) |
| `FLOWPLAN_WORKFLOW_WORKSPACE_RUNS_PER_MINUTE` | 600 | Runs per minute and workspace | [Configuration: e-mail, integrations and workflows › Workflows](/configuration-integrations#workflows) |
| `FLOWPLAN_WORKFLOWS` | `on` | Main switch; `off`: no new workflow pages, all paused | [Configuration: e-mail, integrations and workflows › Workflows](/configuration-integrations#workflows) |
| `FLOWPLAN_WORKSPACE_QUOTA_MB` | unlimited | Default storage quota per workspace in MB (`0` = unlimited). | [Configuration › Operations](/configuration#operations) |
| `GIPHY_API_KEY` | *empty* | Key for the [GIF search on whiteboards](/whiteboards#images-icons-and-records) at GIPHY or Tenor (if both are set, GIPHY wins). | [Configuration: e-mail, integrations and workflows › Integrations](/configuration-integrations#integrations) |
| `GIT_COMMIT` | – | Version and commit (`FLOWPLAN_VERSION`, `GIT_COMMIT`, `SOURCE_COMMIT`) come from the build; `FLOWPLAN_VERSION` in `.env` only picks the image tag in `compose.yaml`. | [Configuration › Do not set](/configuration#do-not-set) |
| `GOOGLE_CALENDAR_CLIENT_ID` | *empty* | OAuth client (type “Web application”) from the Google Cloud Console, with the Google Calendar API enabled and the scope `…/auth/calendar`. | [Configuration: e-mail, integrations and workflows › Calendar sync](/configuration-integrations#calendar-sync) |
| `GOOGLE_CALENDAR_CLIENT_SECRET` | *empty* | OAuth client (type “Web application”) from the Google Cloud Console, with the Google Calendar API enabled and the scope `…/auth/calendar`. | [Configuration: e-mail, integrations and workflows › Calendar sync](/configuration-integrations#calendar-sync) |
| `IMPRINT_URL` | *empty* | Link to the legal notice, e.g. `https://example.com/imprint`. | [Configuration: storage, database and security › Legal and interface](/configuration-storage#legal-and-interface) |
| `INBOUND_IMAP_FOLDER` | `INBOX` | Folder that is polled. | [Configuration: e-mail, integrations and workflows › Inbound e-mail (IMAP)](/configuration-integrations#inbound-e-mail-imap) |
| `INBOUND_IMAP_HOST` | *empty* | Turns on IMAP polling (together with `INBOUND_IMAP_USER`). | [Configuration: e-mail, integrations and workflows › Inbound e-mail (IMAP)](/configuration-integrations#inbound-e-mail-imap) |
| `INBOUND_IMAP_PASSWORD` | *empty* | Sign-in at the mailbox. | [Configuration: e-mail, integrations and workflows › Inbound e-mail (IMAP)](/configuration-integrations#inbound-e-mail-imap) |
| `INBOUND_IMAP_PORT` | `993` | Port (`143` when `INBOUND_IMAP_TLS=false`). | [Configuration: e-mail, integrations and workflows › Inbound e-mail (IMAP)](/configuration-integrations#inbound-e-mail-imap) |
| `INBOUND_IMAP_TLS` | `true` | `false` only for a mail server on the same host or network (unencrypted). | [Configuration: e-mail, integrations and workflows › Inbound e-mail (IMAP)](/configuration-integrations#inbound-e-mail-imap) |
| `INBOUND_IMAP_USER` | *empty* | Sign-in at the mailbox. | [Configuration: e-mail, integrations and workflows › Inbound e-mail (IMAP)](/configuration-integrations#inbound-e-mail-imap) |
| `INBOUND_MAIL_AUTHSERV_ID` | *empty* | The id (authserv-id) your own receiving mail server or provider starts its `Authentication-Results` header with, e.g. `mx.example.com`. | [Configuration: e-mail, integrations and workflows › Inbound e-mail (IMAP)](/configuration-integrations#inbound-e-mail-imap) |
| `INBOUND_MAIL_DOMAIN` | *empty* | Domain of the inbound addresses, e.g. `mail.example.com`. | [Configuration: e-mail, integrations and workflows › Inbound e-mail (IMAP)](/configuration-integrations#inbound-e-mail-imap) |
| `ISSUE_SYNC_ALLOW_PRIVATE` | *empty* | `true` also allows internal addresses for the servers listed in `ISSUE_SYNC_ALLOWED_HOSTS` – for example a GitLab in the same network. | [Configuration: e-mail, integrations and workflows › Integrations](/configuration-integrations#integrations) |
| `ISSUE_SYNC_ALLOWED_HOSTS` | *empty* | Own servers for the [GitHub, GitLab and Forgejo issue sync](/git-and-issues#sync-github-gitlab-and-forgejo-issues), comma-separated (e.g. `gitlab.example.org`). github.com, gitlab.com and codeberg.org are always allowed; other servers only when listed here. | [Configuration: e-mail, integrations and workflows › Integrations](/configuration-integrations#integrations) |
| `LDAP_BASE_DN` | – | Where people are searched, e.g. `ou=people,dc=example,dc=org`. | [Users from a directory: SCIM and LDAP › Sign-in with LDAP](/scim-and-ldap#sign-in-with-ldap) |
| `LDAP_BIND_DN` | *empty* | Search account. | [Users from a directory: SCIM and LDAP › Sign-in with LDAP](/scim-and-ldap#sign-in-with-ldap) |
| `LDAP_BIND_PASSWORD` | *empty* | Search account. | [Users from a directory: SCIM and LDAP › Sign-in with LDAP](/scim-and-ldap#sign-in-with-ldap) |
| `LDAP_CONTACTS` | on | `off` turns contacts from the directory off. | [Users from a directory: SCIM and LDAP › Contacts from LDAP](/scim-and-ldap#contacts-from-ldap) |
| `LDAP_CONTACTS_ATTRIBUTES` | – | More attributes mappings may use (separated by commas or spaces). | [Users from a directory: SCIM and LDAP › Contacts from LDAP](/scim-and-ldap#contacts-from-ldap) |
| `LDAP_CONTACTS_BASE_DN` | `LDAP_BASE_DN` | Where contacts are searched; the OU tree of the import dialog starts here. | [Users from a directory: SCIM and LDAP › Contacts from LDAP](/scim-and-ldap#contacts-from-ldap) |
| `LDAP_CONTACTS_FILTER` | `(&(\|(objectClass=inetOrgPerson)(objectClass=user)(objectClass=contact))(!(objectClass=computer)))` | Which entries are people. | [Users from a directory: SCIM and LDAP › Contacts from LDAP](/scim-and-ldap#contacts-from-ldap) |
| `LDAP_CONTACTS_SYNC_MINUTES` | `60` | Interval of the sync (15–1440). | [Users from a directory: SCIM and LDAP › Contacts from LDAP](/scim-and-ldap#contacts-from-ldap) |
| `LDAP_GROUP_ATTRIBUTE` | `memberOf` | Attribute with the person's groups. | [Users from a directory: SCIM and LDAP › Sign-in with LDAP](/scim-and-ldap#sign-in-with-ldap) |
| `LDAP_STARTTLS` | `false` | `true`: encrypt `ldap://` with StartTLS. | [Users from a directory: SCIM and LDAP › Sign-in with LDAP](/scim-and-ldap#sign-in-with-ldap) |
| `LDAP_TIMEOUT_MS` | `8000` | Time limit per LDAP operation. | [Users from a directory: SCIM and LDAP › Sign-in with LDAP](/scim-and-ldap#sign-in-with-ldap) |
| `LDAP_TLS_CA` | *empty* | CA certificate for `ldaps://` or StartTLS (file path or PEM text). | [Users from a directory: SCIM and LDAP › Sign-in with LDAP](/scim-and-ldap#sign-in-with-ldap) |
| `LDAP_URL` | *empty* | `ldap://host:389` or `ldaps://host:636`. | [Users from a directory: SCIM and LDAP › Sign-in with LDAP](/scim-and-ldap#sign-in-with-ldap) |
| `LDAP_USER_FILTER` | `(\|(uid={user})(mail={user}))` | `{user}` is replaced by the escaped name. | [Users from a directory: SCIM and LDAP › Sign-in with LDAP](/scim-and-ldap#sign-in-with-ldap) |
| `LITESTREAM_SSE_C_KEY` | *empty* | Optional: the storage provider encrypts the Litestream replica (SSE-C, 32 bytes base64, only over https and with providers that support SSE-C). | [Configuration: storage, database and security › S3 and database backup](/configuration-storage#s3-and-database-backup) |
| `MEETING_LIVE_TRANSCRIPTION` | `on` | `off`: transcribe meetings only after they stop instead of while recording. | [Configuration: AI, voice notes and push › Voice notes (Whisper)](/configuration-ai-push#voice-notes-whisper) |
| `MOBILE_PUSH` | – | Notifications to the apps for iPhone, iPad and Android. | [Configuration: AI, voice notes and push › Push notifications](/configuration-ai-push#push-notifications) |
| `MOBILE_PUSH_CONTENT` | – | Whether the notification's text comes along – and with it the buttons **Done** and **Tomorrow** on due tasks and **Reply** on comments ([Buttons on notifications](/mobile-widgets#buttons-on-notifications)); **Mark as read** is always there. | [Configuration: AI, voice notes and push › Push notifications](/configuration-ai-push#push-notifications) |
| `MS_CALENDAR_CLIENT_ID` | *empty* | App registration in Microsoft Entra ID (web platform) with the delegated permissions `Calendars.ReadWrite` and `offline_access`. | [Configuration: e-mail, integrations and workflows › Calendar sync](/configuration-integrations#calendar-sync) |
| `MS_CALENDAR_CLIENT_SECRET` | *empty* | App registration in Microsoft Entra ID (web platform) with the delegated permissions `Calendars.ReadWrite` and `offline_access`. | [Configuration: e-mail, integrations and workflows › Calendar sync](/configuration-integrations#calendar-sync) |
| `MS_CALENDAR_TENANT` | `common` | `common` (work and personal accounts), `organizations` or a tenant ID. | [Configuration: e-mail, integrations and workflows › Calendar sync](/configuration-integrations#calendar-sync) |
| `NETBOX_ALLOW_PRIVATE` | *empty* | `true` also allows internal addresses and `http://` for the [NetBox import on whiteboards](/en/whiteboard-racks#import-and-export) – for example a NetBox in the same network. | [Configuration: e-mail, integrations and workflows › Integrations](/configuration-integrations#integrations) |
| `NEXT_TELEMETRY_DISABLED` | – | The image sets `NODE_ENV`, `PORT`, `HOSTNAME` and `NEXT_TELEMETRY_DISABLED` itself, and `FLOWPLAN_DROP_ROOT=1` (Flowplan's tools in the container give up root and run as `PUID:PGID`). | [Configuration › Do not set](/configuration#do-not-set) |
| `OIDC_ADMIN_GROUP` | – | Members of this group see the **Administration**. | [Single sign-on with OIDC › Variables](/sso-oidc#variables) |
| `OIDC_ALLOW_LOCAL_HTTP` | – | `FLOWPLAN_DIST_DIR` is only meant for parallel development servers, `OIDC_ALLOW_LOCAL_HTTP` only for tests with a provider on `http://localhost`, `FLOWPLAN_GIT_ALLOW_HTTP` only for tests of the Git export with an `http://` server (no effect in production). | [Configuration › Do not set](/configuration#do-not-set) |
| `OIDC_ALLOWED_GROUP` | – | If set, only members of this group may sign in. | [Single sign-on with OIDC › Variables](/sso-oidc#variables) |
| `OIDC_CLIENT_ID` | – | Client ID. | [Configuration › Sign-in](/configuration#sign-in) |
| `OIDC_CLIENT_SECRET` | – | Client secret. | [Configuration › Sign-in](/configuration#sign-in) |
| `OIDC_GROUPS_CLAIM` | – | The claim with the groups, also as a path such as `realm_access.roles`. | [Single sign-on with OIDC › Variables](/sso-oidc#variables) |
| `OIDC_ISSUER` | – | The issuer URL; Flowplan reads the discovery from it (`/.well-known/openid-configuration`). | [Single sign-on with OIDC › Variables](/sso-oidc#variables) |
| `OIDC_LINKED_SSO_ONLY` | – | `true`: accounts connected to SSO sign in through SSO only (off by default). | [Single sign-on with OIDC › Variables](/sso-oidc#variables) |
| `OIDC_NEW_ACCOUNTS` | – | `false`: SSO sign-in creates no new accounts (on by default) – only existing, connected or SCIM-provisioned accounts sign in. | [Single sign-on with OIDC › Variables](/sso-oidc#variables) |
| `OIDC_PICTURE` | – | Take the profile picture from the `picture` claim (on by default, `off` turns it off). | [Single sign-on with OIDC › Variables](/sso-oidc#variables) |
| `OIDC_PROMPT_CREATE` | – | `true`: **Sign up** opens the provider's registration directly (`prompt=create`). | [Single sign-on with OIDC › Variables](/sso-oidc#variables) |
| `OIDC_SCOPES` | – | With SSO the group is missing in the token: check `OIDC_SCOPES`, `OIDC_GROUPS_CLAIM`, `OIDC_ADMIN_GROUP` and sign in again. | [Operations and troubleshooting › Troubleshooting](/operations#troubleshooting) |
| `OLLAMA_URL` | *empty* | Address of Ollama, e.g. `http://ollama:11434` with the Compose service. | [Configuration: AI, voice notes and push › AI](/configuration-ai-push#ai) |
| `OTEL_EXPORTER_OTLP_ENDPOINT` | *empty* | OTLP collector (HTTP); security events go there as OpenTelemetry logs. | [Configuration › Operations](/configuration#operations) |
| `OTEL_EXPORTER_OTLP_HEADERS` | – | With `OTEL_EXPORTER_OTLP_HEADERS` and `OTEL_SERVICE_NAME`. | [Configuration › Operations](/configuration#operations) |
| `OTEL_EXPORTER_OTLP_LOGS_ENDPOINT` | – | With `OTEL_EXPORTER_OTLP_ENDPOINT` (or `OTEL_EXPORTER_OTLP_LOGS_ENDPOINT`) Flowplan sends the events as OTLP logs (HTTP/JSON, `/v1/logs`) to your collector, e.g. Grafana Alloy, the OpenTelemetry Collector, Grafana Cloud, Honeycomb or Datadog. | [Security and attack detection › OpenTelemetry](/security-monitoring#opentelemetry) |
| `OTEL_EXPORTER_OTLP_LOGS_HEADERS` | `OTEL_EXPORTER_OTLP_HEADERS` | Headers for the collector, for the logs only: `api-key=abc,x-scope=flowplan` (comma-separated, values URL-encoded). | [Security and attack detection › More variables](/security-monitoring#more-variables) |
| `OTEL_SERVICE_NAME` | – | With `OTEL_EXPORTER_OTLP_HEADERS` and `OTEL_SERVICE_NAME`. | [Configuration › Operations](/configuration#operations) |
| `PG_CLIENT_MAJOR` | – | Build arguments: `PG_CLIENT_MAJOR` (default `18`) chooses the version of `pg_dump`, `pg_restore` and `psql` in the image – at least your PostgreSQL server's major version ([PostgreSQL](/postgresql)). | [Installation with Docker › Build the image yourself](/installation#build-the-image-yourself) |
| `PGCONNECT_TIMEOUT` | `15` | How many seconds `pg_dump`, `pg_restore` and `psql` wait at most for the connection to the server (libpq's variable). | [PostgreSQL › Variables](/postgresql#variables) |
| `PGID` | `1000` / same as `PUID` | Only in the image, without `user:` (as with linuxserver.io): at start Flowplan gives the data folder to this user and group and runs as them, never as root; `0` is refused. | [Configuration › Operations](/configuration#operations) |
| `PLUGIN_ALLOWED_ORIGINS` | *empty* | HTTPS origins owners may register [block extensions](/plugins) from, comma-separated (e.g. `https://plugins.example.org`). | [Configuration: e-mail, integrations and workflows › Integrations](/configuration-integrations#integrations) |
| `PRIVACY_URL` | *empty* | Link to the privacy policy, in the same places and also only when set. | [Configuration: storage, database and security › Legal and interface](/configuration-storage#legal-and-interface) |
| `PUID` | `1000` / same as `PUID` | Only in the image, without `user:` (as with linuxserver.io): at start Flowplan gives the data folder to this user and group and runs as them, never as root; `0` is refused. | [Configuration › Operations](/configuration#operations) |
| `PUSH_RELAY` | – | `off`: no relay. | [Configuration: AI, voice notes and push › Push notifications](/configuration-ai-push#push-notifications) |
| `PUSH_RELAY_URL` | – | The [push relay](/configuration-ai-push#push-relay-and-end-to-end-encryption) notifications to the apps go through. | [Configuration: AI, voice notes and push › Push notifications](/configuration-ai-push#push-notifications) |
| `REDIS_URL` | *empty* | Redis for cluster mode, `redis://…` or `rediss://…`. | [Configuration: storage, database and security › Database and cluster](/configuration-storage#database-and-cluster) |
| `RENDER_EXTERNAL_HOSTNAME` | – | **Address:** without `APP_URL`, Flowplan uses Render's own address (`RENDER_EXTERNAL_URL`, or else `https://` with `RENDER_EXTERNAL_HOSTNAME`). | [Deploy in one click › Render](/one-click-deploy#render) |
| `RENDER_EXTERNAL_URL` | – | **Address:** without `APP_URL`, Flowplan uses Render's own address (`RENDER_EXTERNAL_URL`, or else `https://` with `RENDER_EXTERNAL_HOSTNAME`). | [Deploy in one click › Render](/one-click-deploy#render) |
| `S3_ACCESS_KEY_ID` | – | Access keys with read and write access to the bucket. | [Configuration: storage, database and security › S3 and database backup](/configuration-storage#s3-and-database-backup) |
| `S3_BUCKET` | *empty* | Turns S3 on. | [Configuration: storage, database and security › S3 and database backup](/configuration-storage#s3-and-database-backup) |
| `S3_ENDPOINT` | AWS | API address of the storage, e.g. `http://minio:9000`. | [Configuration: storage, database and security › S3 and database backup](/configuration-storage#s3-and-database-backup) |
| `S3_PREFIX` | `flowplan` | Folder in the bucket; files under `<prefix>/uploads/`, the database under `<prefix>/db/`. | [Configuration: storage, database and security › S3 and database backup](/configuration-storage#s3-and-database-backup) |
| `S3_REGION` | `us-east-1` | Region. | [Configuration: storage, database and security › S3 and database backup](/configuration-storage#s3-and-database-backup) |
| `S3_SECRET_ACCESS_KEY` | – | Access keys with read and write access to the bucket. | [Configuration: storage, database and security › S3 and database backup](/configuration-storage#s3-and-database-backup) |
| `SESSION_APP_DAYS` | `90` | An app's session ends after this many days without use (1–365). | [Configuration › Sign-in](/configuration#sign-in) |
| `SESSION_APP_REMEMBER` | on | The desktop and mobile apps stay signed in while they (or their widgets) are used – for sign-ins the app proves (hand-off through the browser, or password with the app's device key; see [Sign-in](/sessions)). | [Configuration › Sign-in](/configuration#sign-in) |
| `SESSION_GROUPS_HOURS` | *empty* | Only when set: SSO sessions with "stay signed in" end after this many hours already, so group changes at the provider take effect with the new sign-in. | [Configuration › Sign-in](/configuration#sign-in) |
| `SESSION_HOURS` | – | How long a browser session is valid in hours, as long as "Stay signed in" is not used; the apps stay signed in (see [Stay signed in](/sessions)). | [Single sign-on with OIDC › Variables](/sso-oidc#variables) |
| `SESSION_IDLE_HOURS` | `168` | With "stay signed in" in the browser: the session ends this many hours after it was last used (1–8760). | [Configuration › Sign-in](/configuration#sign-in) |
| `SESSION_MAX_DAYS` | `30` / `365` | Sessions that stay signed in end at the latest this many days after signing in (1–365; default 30 in the browser, 365 in the apps; never shorter than the time without use) – with SSO just as with password and passkey. | [Configuration › Sign-in](/configuration#sign-in) |
| `SESSION_REMEMBER` | off | `true` offers **Stay signed in** in the browser when signing in – see [Sign-in](/sessions). | [Configuration › Sign-in](/configuration#sign-in) |
| `SMTP_FROM` | `Flowplan <SMTP_USER>` | Sender, e.g. `Flowplan <flowplan@example.com>`. | [Configuration: e-mail, integrations and workflows › E-mail (SMTP)](/configuration-integrations#e-mail-smtp) |
| `SMTP_HOST` | *empty* | Turns on sending e-mail: invitations, address confirmations, password resets and digests of unread notifications. | [Configuration: e-mail, integrations and workflows › E-mail (SMTP)](/configuration-integrations#e-mail-smtp) |
| `SMTP_PASSWORD` | *empty* | Sign-in at the mail server. | [Configuration: e-mail, integrations and workflows › E-mail (SMTP)](/configuration-integrations#e-mail-smtp) |
| `SMTP_PORT` | `587` | Port. | [Configuration: e-mail, integrations and workflows › E-mail (SMTP)](/configuration-integrations#e-mail-smtp) |
| `SMTP_SECURE` | by port | `true`/`false` forces TLS from the start of the connection. | [Configuration: e-mail, integrations and workflows › E-mail (SMTP)](/configuration-integrations#e-mail-smtp) |
| `SMTP_USER` | *empty* | Sign-in at the mail server. | [Configuration: e-mail, integrations and workflows › E-mail (SMTP)](/configuration-integrations#e-mail-smtp) |
| `SOURCE_COMMIT` | – | Docker images from our workflow know their commit; with Coolify it comes from `SOURCE_COMMIT`. | [Administering the instance › Instance](/administration#instance) |
| `SPACE_GIT_ALLOW_PRIVATE` | *empty* | `true` also allows internal addresses for the servers listed in `SPACE_GIT_ALLOWED_HOSTS` – for example a Forgejo on the same host that the container reaches via `--add-host git.example.org:host-gateway`. | [Configuration: e-mail, integrations and workflows › Integrations](/configuration-integrations#integrations) |
| `SPACE_GIT_ALLOWED_HOSTS` | *empty* | Allowed Git servers for it, comma-separated (e.g. `git.example.org`). | [Configuration: e-mail, integrations and workflows › Integrations](/configuration-integrations#integrations) |
| `SPACE_GIT_EXPORT` | *empty* | `true` turns on the [Git export of spaces](/markdown-git-export#git-export-of-a-space): space owners push their space into a repository of their own, daily or weekly. | [Configuration: e-mail, integrations and workflows › Integrations](/configuration-integrations#integrations) |
| `TENOR_API_KEY` | *empty* | Key for the [GIF search on whiteboards](/whiteboards#images-icons-and-records) at GIPHY or Tenor (if both are set, GIPHY wins). | [Configuration: e-mail, integrations and workflows › Integrations](/configuration-integrations#integrations) |
| `WEB_PUSH_PRIVATE_KEY` | – | VAPID key pair. | [Configuration: AI, voice notes and push › Push notifications](/configuration-ai-push#push-notifications) |
| `WEB_PUSH_PUBLIC_KEY` | – | VAPID key pair. | [Configuration: AI, voice notes and push › Push notifications](/configuration-ai-push#push-notifications) |
| `WEB_PUSH_SUBJECT` | – | Contact for the push services, e.g. `mailto:admin@example.com`. | [Configuration: AI, voice notes and push › Push notifications](/configuration-ai-push#push-notifications) |
| `WHISPER_API_KEY` | *empty* | Only if the service requires a key. | [Configuration: AI, voice notes and push › Voice notes (Whisper)](/configuration-ai-push#voice-notes-whisper) |
| `WHISPER_DIARIZE` | *empty* | `on`: ask for speaker separation (`diarize=true`), only for services that support it. | [Configuration: AI, voice notes and push › Voice notes (Whisper)](/configuration-ai-push#voice-notes-whisper) |
| `WHISPER_LANGUAGE` | `de` | Language of the recordings (e.g. `en`). | [Configuration: AI, voice notes and push › Voice notes (Whisper)](/configuration-ai-push#voice-notes-whisper) |
| `WHISPER_MAX_MB` | `200` | Largest recording in MB. | [Configuration: AI, voice notes and push › Voice notes (Whisper)](/configuration-ai-push#voice-notes-whisper) |
| `WHISPER_MODEL` | `Systran/faster-whisper-small` | The model name as the service expects it. | [Configuration: AI, voice notes and push › Voice notes (Whisper)](/configuration-ai-push#voice-notes-whisper) |
| `WHISPER_PROMPT` | *empty* | Vocabulary for all workspaces (names, acronyms, separated by commas), sent to Whisper as `prompt` – before the workspace's glossary, together at most about 550 characters. | [Configuration: AI, voice notes and push › Voice notes (Whisper)](/configuration-ai-push#voice-notes-whisper) |
| `WHISPER_RESPONSE_FORMAT` | `verbose_json` | Response format of speech recognition; falls back to `json` once. | [Configuration: AI, voice notes and push › Voice notes (Whisper)](/configuration-ai-push#voice-notes-whisper) |
| `WHISPER_TIMEOUT_SECONDS` | *empty* | How long one transcription may take, in seconds. | [Configuration: AI, voice notes and push › Voice notes (Whisper)](/configuration-ai-push#voice-notes-whisper) |
| `WHISPER_URL` | *empty* | Address of an OpenAI-compatible Whisper server (`POST /v1/audio/transcriptions`), e.g. `http://whisper:8000`. | [Configuration: AI, voice notes and push › Voice notes (Whisper)](/configuration-ai-push#voice-notes-whisper) |
| `WHISPER_VAD` | *empty* | `on`: skip silence first (`vad_filter=true`, faster-whisper/speaches) – fewer made-up lines. | [Configuration: AI, voice notes and push › Voice notes (Whisper)](/configuration-ai-push#voice-notes-whisper) |