Configuration

Everything you can tune on your server, in one place: where the settings live, how to change them and what the important ones do.

This page is for the person who runs the server. Everything Barynt needs to know about its surroundings is read from environment variables, and nothing else is hidden in config files.

Where the settings live

With the installer, they are in /opt/barynt/.env. The file is readable only by you.
With Docker Compose by hand, it is the .env next to your docker-compose.yml.
On Kubernetes, they are the chart’s values.yaml.

You do not have to edit the file by hand. barynt config changes values and restarts what has to restart:

barynt config                                  # asks about domain and email
barynt config SMTP_HOST=smtp.example.com UPDATE_CHECK=false

The ones that matter

Setting	What it does
`AUTH_SECRET`	Signs sessions. Generated by the installer. Keep it secret and do not change it casually: everyone is signed out when it changes.
`AUTH_URL`	The public address of Barynt, for example `https://issues.example.com`. Invitation links and sign-in callbacks are built from it.
`DOMAIN`	The domain the bundled web server (Caddy) gets a certificate for.
`POSTGRES_PASSWORD`	The password of the bundled database. Set once at the first start, it cannot be changed afterwards.
`UPDATE_CHECK`	`false` stops Barynt from asking GitHub whether a newer version exists. It is the only call Barynt makes on its own.

By default people sign in with passkeys. Everything else is added on top:

Setting	What it does
`AUTH_<PROVIDER>_ID`, `AUTH_<PROVIDER>_SECRET`	Turns on a company login (GitHub, Google, GitLab, Microsoft, Discord, Keycloak, Okta and many more). See Sign-in and SSO.
`AUTH_OIDC_ISSUER`, `AUTH_OIDC_CLIENT_ID`, `AUTH_OIDC_CLIENT_SECRET`, `AUTH_OIDC_NAME`	One generic single sign-on, with your own button label.
`AUTH_REGISTRATION_ENABLED=false`	Invite-only. Nobody can create a new account by themselves. People with an open invitation still get in.
`AUTH_PASSKEY_LOGIN_ENABLED=false`	Switches passkeys off completely. Make sure another sign-in method works first.
`AUTH_PASSKEY_REGISTRATION_ENABLED=false`	New accounts cannot be created with a passkey. Existing accounts keep theirs.

Email

Without SMTP_HOST, Barynt sends no email at all. Everything still works: invitation links can be copied and notifications appear in the inbox. See Email.

Setting	What it does
`SMTP_HOST`, `SMTP_PORT`, `SMTP_SECURE`, `SMTP_USER`, `SMTP_PASS`	Your mail server.
`SMTP_FROM`	The sender, for example `Barynt <barynt@example.com>`.
`MAIL_COMPANY_NAME`, `MAIL_COMPANY_ADDRESS`	Shown in the footer of every email.

Files

Avatars and attachments need S3-compatible storage. The installer brings one along (RustFS). See Object storage.

Setting	What it does
`S3_ENDPOINT`	Where the storage is. Empty means uploads are switched off.
`S3_ACCESS_KEY_ID`, `S3_SECRET_ACCESS_KEY`	Its credentials.
`S3_BUCKET_AVATARS`, `S3_BUCKET_ISSUES`	The two buckets. Avatars and attachments can be switched on independently.
`S3_REGION`	The region, `us-east-1` unless your provider says otherwise.

Databases and updates

Setting	What it does
`DATABASE_URL`	The PostgreSQL connection. With the installer this is set up for you.
`REDIS_URL`	Redis, used to count API requests per key. Optional.
`MIGRATE_ON_START=false`	Do not update the database layout at startup. Only for setups where a separate job does it.

After a change

Settings are read at startup. barynt config does this for you. Otherwise run barynt restart, or docker compose --profile app up -d.