Configuration
Every variable of the self-hosted .env
The compose file works with no .env at all. Create one next to it with
only the lines you need, then docker compose up -d again. The complete
list with defaults is
.env.example
in the install repository.
Version
IFOREVENTS_VERSION=latest # pin a release for production, e.g. 1.2.0Both images of a release are tested together; upgrade them together.
URLs and ports
PUBLIC_URL=http://localhost:8010 # where people open the dashboard
API_PUBLIC_URL=http://localhost:8000 # where apps send events (SDK snippets)
BIND_ADDRESS=0.0.0.0 # 127.0.0.1 behind a reverse proxy
DASHBOARD_PORT=8010
API_PORT=8000
TRUSTED_PROXY_CIDRS= # CIDRs allowed to set X-Forwarded-ForFirst admin and signup
BOOTSTRAP_ADMIN_EMAIL= # both or neither; ignored once any account exists
BOOTSTRAP_ADMIN_PASSWORD=
BOOTSTRAP_ADMIN_NAME=Admin
BOOTSTRAP_ORGANIZATION_NAME=My organization
SIGNUP_MODE=bootstrap # bootstrap | closed | openbootstrap: the first signup creates the admin, then signup closes and members come from Settings → Team.closed: no self-service signup at all (useBOOTSTRAP_ADMIN_*).open: anyone who reaches the dashboard can create an organization. Only for installs on a trusted network.
Secrets
TOKEN_SECRET= # signs sessions; generated on first boot when empty (openssl rand -base64 48)
DB_PASSWORD=iforevents # ClickHouse; internal to the Docker networkThe generated TOKEN_SECRET lives in the api_data volume. Deleting that
volume signs every session out; nothing else is lost.
SMTP_HOST= # empty: accounts are verified on creation, reset links go to the api log
SMTP_PORT=587
SMTP_USERNAME=
SMTP_PASSWORD=
[email protected]Data
EVENTS_RETENTION_DAYS=0 # days of raw events to keep; 0 keeps everything
RATE_LIMIT_INGEST_RATE=500 # events per second per organization
RATE_LIMIT_INGEST_BURST=2000
MAX_EVENTS_PER_BATCH=500Reverse proxy with automatic TLS
Used by docker-compose.caddy.yml:
DOMAIN=analytics.example.com
[email protected]
PUBLIC_URL=https://analytics.example.com
API_PUBLIC_URL=https://analytics.example.com
BIND_ADDRESS=127.0.0.1
TRUSTED_PROXY_CIDRS=172.28.0.0/16 # the compose network (DOCKER_SUBNET)Advanced
Any variable the api understands can be added to the api service in a
compose override file; docker compose config shows the merged result. The
ones that matter for a single node: LOG_LEVEL, MCP_ALLOWED_ORIGINS,
INGEST_BUFFER_FLUSH_MS, MAX_BODY_BYTES. The api refuses wildcard CORS
regardless of the mode.
The images carry no secret and no hosted URL: the same iforevents-dashboard
image reads API_BASE_URL, PUBLIC_URL, API_PUBLIC_URL, AUTH_MODE and
COOKIE_SECURE at runtime, which is what the compose file sets.