Configuration options

You can either use a config.yml file in the root directory of Vikunja or set almost all config option with environment variables. If you have both, the value set in the config file is used. Right now it is not possible to configure openid authentication via environment variables.

Variables are nested in the config.yml, these nested variables become VIKUNJA_FIRST_CHILD when configuring via environment variables. So setting

export VIKUNJA_FIRST_CHILD=true

is the same as defining it in a config.yml like so:

first:
    child: true

Formats #

Vikunja supports using toml, yaml, hcl, ini, json, envfile, env variables and Java Properties files. We recommend yaml or toml, but you're free to use whatever you want.

Vikunja provides a default config.yml file which you can use as a starting point.

Config file locations #

Vikunja will search on various places for a config file:

  • Next to the location of the binary
  • In the service.rootpath location set in a config (remember you can set config arguments via environment variables)
  • In /etc/vikunja
  • In ~/.config/vikunja

The service.rootpath setting is used only while finding the first config file. You can therefore set VIKUNJA_SERVICE_ROOTPATH to point Vikunja to that initial config file, but any new service.rootpath defined inside it will not be considered for further config lookup.

export VIKUNJA_SERVICE_ROOTPATH=/etc/vikunja
vikunja

Assuming /etc/vikunja/config.yml contains:

service:
  rootpath: /opt/vikunja

Vikunja reads /etc/vikunja/config.yml but does not check /opt/vikunja/config.yml afterward.

Using a config file with Docker Compose #

In case you are using Docker Compose you need to edit the docker-compose.yml to load config.yml. Mount the config.yml file into the Vikunja container, by adding this line to the volumes of the Vikunja container and replacing the ./path/to/config.yml with the relative path from the docker-compose.yml to your config.yml:

volumes:
  - ./path/to/config.yml:/etc/vikunja/config.yml

After all the setup is done, start Vikunja as shown in the Docker Compose setup.

Reading config values from files #

This feature has not been released yet. It is only available for testing in unstable builds.

Vikunja can read any config value from a file saved on disk when the path to that file is specified in the config with the target config path as child file. This works with environment variables as well, note that there you'll need to add a _FILE suffix.

Files are evaluated after any previously set values. That means if you set both, the value from the file will override any previously set value.

If the specified file is not accessible, Vikunja will fail to start.

For example, setting this in your config.yml:

database:
  password:
    file: /path/to/password

will load the content from the file at /path/to/password and set it as the config value of database.password.

With an environment variable for the same config variable, you'd need to set the VIKUNJA_DATABASE_PASSWORD_FILE environment variable to /path/to/password.

Default configuration with explanations #

The following explains all possible config variables and their defaults. You can find a full example configuration file in here.

If you don't provide a value in your config file, their default will be used.

Nesting #

Most config variables are nested under some "higher-level" key. For example, the interface config variable is a child of the service key.

The docs below aim to reflect that leveling, but please also have a look at the default config file to better grasp how the nesting looks like.

service #

JWTSecret #

This token is used to verify issued JWT tokens. Default is a random token which will be generated at each startup of Vikunja. (This means all already issued tokens will be invalid once you restart Vikunja)

Default: <jwt-secret>

Full path: service.JWTSecret

Environment path: VIKUNJA_SERVICE_JWTSECRET

jwtttl #

The duration of the issued JWT tokens in seconds. The default is 259200 seconds (3 Days).

Default: 259200

Full path: service.jwtttl

Environment path: VIKUNJA_SERVICE_JWTTTL

jwtttllong #

The duration of the "remember me" time in seconds. When the login request is made with the long param set, the token returned will be valid for this period. The default is 2592000 seconds (30 Days).

Default: 2592000

Full path: service.jwtttllong

Environment path: VIKUNJA_SERVICE_JWTTTLLONG

interface #

The interface on which to run the webserver

Default: :3456

Full path: service.interface

Environment path: VIKUNJA_SERVICE_INTERFACE

unixsocket #

Path to Unix socket. If set, it will be created and used instead of tcp

Default: <empty>

Full path: service.unixsocket

Environment path: VIKUNJA_SERVICE_UNIXSOCKET

unixsocketmode #

Permission bits for the Unix socket. Note that octal values must be prefixed by "0o", e.g. 0o660

Default: <empty>

Full path: service.unixsocketmode

Environment path: VIKUNJA_SERVICE_UNIXSOCKETMODE

publicurl #

The public facing URL where your users can reach Vikunja. Used in emails and for the communication between api and frontend.

Default: <empty>

Full path: service.publicurl

Environment path: VIKUNJA_SERVICE_PUBLICURL

rootpath #

The base path on the file system where the binary and assets are. Vikunja will also look in this path for a config file, so you could provide only this variable to point to a folder with a config file which will then be used.

Default: <rootpath>

Full path: service.rootpath

Environment path: VIKUNJA_SERVICE_ROOTPATH

maxitemsperpage #

The max number of items which can be returned per page

Default: 50

Full path: service.maxitemsperpage

Environment path: VIKUNJA_SERVICE_MAXITEMSPERPAGE

enablecaldav #

Enable the caldav endpoint, see the docs for more details

Default: true

Full path: service.enablecaldav

Environment path: VIKUNJA_SERVICE_ENABLECALDAV

motd #

Set the motd message, available from the /info endpoint

Default: <empty>

Full path: service.motd

Environment path: VIKUNJA_SERVICE_MOTD

enablelinksharing #

Enable sharing of project via a link

Default: true

Full path: service.enablelinksharing

Environment path: VIKUNJA_SERVICE_ENABLELINKSHARING

enableregistration #

Whether to let new users registering themselves or not

Default: true

Full path: service.enableregistration

Environment path: VIKUNJA_SERVICE_ENABLEREGISTRATION

enabletaskattachments #

Whether to enable task attachments or not

Default: true

Full path: service.enabletaskattachments

Environment path: VIKUNJA_SERVICE_ENABLETASKATTACHMENTS

timezone #

The time zone all timestamps are in. Please note that time zones have to use the official tz database names. UTC or GMT offsets won't work.

Default: GMT

Full path: service.timezone

Environment path: VIKUNJA_SERVICE_TIMEZONE

enabletaskcomments #

Whether task comments should be enabled or not

Default: true

Full path: service.enabletaskcomments

Environment path: VIKUNJA_SERVICE_ENABLETASKCOMMENTS

enabletotp #

Whether totp is enabled. In most cases you want to leave that enabled.

Default: true

Full path: service.enabletotp

Environment path: VIKUNJA_SERVICE_ENABLETOTP

testingtoken #

If not empty, this will enable /test/{table} endpoints which allow to put any content in the database. Used to reset the db before frontend tests. Because this is quite a dangerous feature allowing for lots of harm, each request made to this endpoint needs to provide an Authorization: <token> header with the token from below.
You should never use this unless you know exactly what you're doing

Default: <empty>

Full path: service.testingtoken

Environment path: VIKUNJA_SERVICE_TESTINGTOKEN

enableemailreminders #

If enabled, Vikunja will send an email to everyone who is either assigned to a task or created it when a task reminder is due.

Default: true

Full path: service.enableemailreminders

Environment path: VIKUNJA_SERVICE_ENABLEEMAILREMINDERS

enableuserdeletion #

If true, will allow users to request the complete deletion of their account. When using external authentication methods it may be required to coordinate with them in order to delete the account. This setting will not affect the cli commands for user deletion.

Default: true

Full path: service.enableuserdeletion

Environment path: VIKUNJA_SERVICE_ENABLEUSERDELETION

maxavatarsize #

The maximum size clients will be able to request for user avatars. If clients request a size bigger than this, it will be changed on the fly.

Default: 1024

Full path: service.maxavatarsize

Environment path: VIKUNJA_SERVICE_MAXAVATARSIZE

demomode #

If set to true, the frontend will show a big red warning not to use this instance for real data as it will be cleared out. You probably don't need to set this value, it was created specifically for usage on try.

Default: false

Full path: service.demomode

Environment path: VIKUNJA_SERVICE_DEMOMODE

allowiconchanges #

Allow changing the logo and other icons based on various occasions throughout the year.

Default: true

Full path: service.allowiconchanges

Environment path: VIKUNJA_SERVICE_ALLOWICONCHANGES

customlogourl #

Allow using a custom logo via external URL.

Default: <empty>

Full path: service.customlogourl

Environment path: VIKUNJA_SERVICE_CUSTOMLOGOURL

enablepublicteams #

Enables the public team feature. If enabled, it is possible to configure teams to be public, which makes them discoverable when sharing a project, therefore not only showing teams the user is member of.

Default: false

Full path: service.enablepublicteams

Environment path: VIKUNJA_SERVICE_ENABLEPUBLICTEAMS

bcryptrounds #

The number of bcrypt rounds to use during registration. Each increment of this number doubles the computational cost. You probably don't need to change this value.

Default: 11

Full path: service.bcryptrounds

Environment path: VIKUNJA_SERVICE_BCRYPTROUNDS

enableopenidteamusersearch #

If enabled, users will only find other users who are part of an existing team when they are searching for a user by their partial name. The other existing team may be created from openid. It is still possible to add users to teams with their exact email address even when this is enabled.

Default: false

Full path: service.enableopenidteamusersearch

Environment path: VIKUNJA_SERVICE_ENABLEOPENIDTEAMUSERSEARCH

sentry #

enabled #

If set to true, enables anonymous error tracking of api errors via Sentry. This allows us to gather more information about errors in order to debug and fix it.

Default: false

Full path: sentry.enabled

Environment path: VIKUNJA_SENTRY_ENABLED

dsn #

Configure the Sentry dsn used for api error tracking. Only used when Sentry is enabled for the api.

Default: https://[email protected]/4504254983634944

Full path: sentry.dsn

Environment path: VIKUNJA_SENTRY_DSN

frontendenabled #

If set to true, enables anonymous error tracking of frontend errors via Sentry. This allows us to gather more information about errors in order to debug and fix it.

Default: false

Full path: sentry.frontendenabled

Environment path: VIKUNJA_SENTRY_FRONTENDENABLED

frontenddsn #

Configure the Sentry dsn used for frontend error tracking. Only used when Sentry is enabled for the frontend.

Default: https://[email protected]/6024480

Full path: sentry.frontenddsn

Environment path: VIKUNJA_SENTRY_FRONTENDDSN

database #

type #

Database type to use. Supported values are mysql, postgres and sqlite. Vikunja is able to run with MySQL 8.0+, Mariadb 10.2+, PostgreSQL 12+, and sqlite.

Default: sqlite

Full path: database.type

Environment path: VIKUNJA_DATABASE_TYPE

user #

Database user which is used to connect to the database.

Default: vikunja

Full path: database.user

Environment path: VIKUNJA_DATABASE_USER

password #

Database password

Default: <empty>

Full path: database.password

Environment path: VIKUNJA_DATABASE_PASSWORD

host #

Database host

Default: localhost

Full path: database.host

Environment path: VIKUNJA_DATABASE_HOST

database #

Database to use

Default: vikunja

Full path: database.database

Environment path: VIKUNJA_DATABASE_DATABASE

path #

When using sqlite, this is the path where to store the data

Default: ./vikunja.db

Full path: database.path

Environment path: VIKUNJA_DATABASE_PATH

maxopenconnections #

Sets the max open connections to the database. Only used when using mysql and postgres.

Default: 100

Full path: database.maxopenconnections

Environment path: VIKUNJA_DATABASE_MAXOPENCONNECTIONS

maxidleconnections #

Sets the maximum number of idle connections to the db.

Default: 50

Full path: database.maxidleconnections

Environment path: VIKUNJA_DATABASE_MAXIDLECONNECTIONS

maxconnectionlifetime #

The maximum lifetime of a single db connection in milliseconds.

Default: 10000

Full path: database.maxconnectionlifetime

Environment path: VIKUNJA_DATABASE_MAXCONNECTIONLIFETIME

sslmode #

Secure connection mode. Only used with postgres. (see https://pkg.go.dev/github.com/lib/pq?tab=doc#hdr-Connection_String_Parameters)

Default: disable

Full path: database.sslmode

Environment path: VIKUNJA_DATABASE_SSLMODE

sslcert #

The path to the client cert. Only used with postgres.

Default: <empty>

Full path: database.sslcert

Environment path: VIKUNJA_DATABASE_SSLCERT

sslkey #

The path to the client key. Only used with postgres.

Default: <empty>

Full path: database.sslkey

Environment path: VIKUNJA_DATABASE_SSLKEY

sslrootcert #

The path to the ca cert. Only used with postgres.

Default: <empty>

Full path: database.sslrootcert

Environment path: VIKUNJA_DATABASE_SSLROOTCERT

tls #

Enable SSL/TLS for mysql connections. Options: false, true, skip-verify, preferred

Default: false

Full path: database.tls

Environment path: VIKUNJA_DATABASE_TLS

typesense #

enabled #

Whether to enable the Typesense integration. If true, all tasks will be synced to the configured Typesense instance and all search and filtering will run through Typesense instead of only through the database. Typesense allows fast fulltext search including fuzzy matching support. It may return different results than what you'd get with a database-only search.

Default: false

Full path: typesense.enabled

Environment path: VIKUNJA_TYPESENSE_ENABLED

url #

The url to the Typesense instance you want to use. Can be hosted locally or in Typesense Cloud as long as Vikunja is able to reach it. Must be a http(s) url.

Default: <empty>

Full path: typesense.url

Environment path: VIKUNJA_TYPESENSE_URL

apikey #

The Typesense API key you want to use.

Default: <empty>

Full path: typesense.apikey

Environment path: VIKUNJA_TYPESENSE_APIKEY

redis #

enabled #

Whether to enable redis or not

Default: false

Full path: redis.enabled

Environment path: VIKUNJA_REDIS_ENABLED

host #

The host of the redis server including its port.

Default: localhost:6379

Full path: redis.host

Environment path: VIKUNJA_REDIS_HOST

password #

The password used to authenticate against the redis server

Default: <empty>

Full path: redis.password

Environment path: VIKUNJA_REDIS_PASSWORD

db #

0 means default database

Default: 0

Full path: redis.db

Environment path: VIKUNJA_REDIS_DB

cors #

enable #

Whether to enable or disable cors headers. By default, this is enabled only for requests from the desktop application running on localhost. Note: If you want to put the frontend and the api on separate domains or ports, you will need to adjust this setting accordingly.

Default: true

Full path: cors.enable

Environment path: VIKUNJA_CORS_ENABLE

origins #

A list of origins which may access the api. These need to include the protocol (http:// or https://) and port, if any.

Full path: cors.origins

Environment path: VIKUNJA_CORS_ORIGINS

Default: http://127.0.0.1:*

Default: http://localhost:*

maxage #

How long (in seconds) the results of a preflight request can be cached.

Default: 0

Full path: cors.maxage

Environment path: VIKUNJA_CORS_MAXAGE

mailer #

enabled #

Whether to enable the mailer or not. If it is disabled, all users are enabled right away and password reset is not possible.

Default: false

Full path: mailer.enabled

Environment path: VIKUNJA_MAILER_ENABLED

host #

SMTP Host

Default: <empty>

Full path: mailer.host

Environment path: VIKUNJA_MAILER_HOST

port #

SMTP Host port. NOTE: If you're unable to send mail and the only error you see in the logs is an EOF, try setting the port to 25.

Default: 587

Full path: mailer.port

Environment path: VIKUNJA_MAILER_PORT

authtype #

SMTP Auth Type. Can be either plain, login or cram-md5.

Default: plain

Full path: mailer.authtype

Environment path: VIKUNJA_MAILER_AUTHTYPE

username #

SMTP username

Default: user

Full path: mailer.username

Environment path: VIKUNJA_MAILER_USERNAME

password #

SMTP password

Default: <empty>

Full path: mailer.password

Environment path: VIKUNJA_MAILER_PASSWORD

skiptlsverify #

Whether to skip verification of the tls certificate on the server

Default: false

Full path: mailer.skiptlsverify

Environment path: VIKUNJA_MAILER_SKIPTLSVERIFY

fromemail #

The default from address when sending emails

Default: mail@vikunja

Full path: mailer.fromemail

Environment path: VIKUNJA_MAILER_FROMEMAIL

queuelength #

The length of the mail queue.

Default: 100

Full path: mailer.queuelength

Environment path: VIKUNJA_MAILER_QUEUELENGTH

queuetimeout #

The timeout in seconds after which the current open connection to the mailserver will be closed.

Default: 30

Full path: mailer.queuetimeout

Environment path: VIKUNJA_MAILER_QUEUETIMEOUT

forcessl #

By default, Vikunja will try to connect with starttls, use this option to force it to use ssl.

Default: false

Full path: mailer.forcessl

Environment path: VIKUNJA_MAILER_FORCESSL

log #

path #

A folder where all the logfiles should go.

Default: <rootpath>logs

Full path: log.path

Environment path: VIKUNJA_LOG_PATH

enabled #

Whether to show any logging at all or none

Default: true

Full path: log.enabled

Environment path: VIKUNJA_LOG_ENABLED

standard #

Where the normal log should go. Possible values are stdout, stderr, file or off to disable standard logging.

Default: stdout

Full path: log.standard

Environment path: VIKUNJA_LOG_STANDARD

level #

Change the log level. Possible values (case-insensitive) are CRITICAL, ERROR, WARNING, NOTICE, INFO, DEBUG.

Default: INFO

Full path: log.level

Environment path: VIKUNJA_LOG_LEVEL

database #

Whether or not to log database queries. Useful for debugging. Possible values are stdout, stderr, file or off to disable database logging.

Default: off

Full path: log.database

Environment path: VIKUNJA_LOG_DATABASE

databaselevel #

The log level for database log messages. Possible values (case-insensitive) are CRITICAL, ERROR, WARNING, NOTICE, INFO, DEBUG.

Default: WARNING

Full path: log.databaselevel

Environment path: VIKUNJA_LOG_DATABASELEVEL

http #

Whether to log http requests or not. Possible values are stdout, stderr, file or off to disable http logging.

Default: stdout

Full path: log.http

Environment path: VIKUNJA_LOG_HTTP

echo #

Echo has its own logging which usually is unnecessary, which is why it is disabled by default. Possible values are stdout, stderr, file or off to disable standard logging.

Default: off

Full path: log.echo

Environment path: VIKUNJA_LOG_ECHO

events #

Whether or not to log events. Useful for debugging. Possible values are stdout, stderr, file or off to disable events logging.

Default: off

Full path: log.events

Environment path: VIKUNJA_LOG_EVENTS

eventslevel #

The log level for event log messages. Possible values (case-insensitive) are ERROR, INFO, DEBUG.

Default: info

Full path: log.eventslevel

Environment path: VIKUNJA_LOG_EVENTSLEVEL

mail #

Whether or not to log mail log messages. This will not log mail contents. Possible values are stdout, stderr, file or off to disable mail-related logging.

Default: off

Full path: log.mail

Environment path: VIKUNJA_LOG_MAIL

maillevel #

The log level for mail log messages. Possible values (case-insensitive) are ERROR, WARNING, INFO, DEBUG.

Default: info

Full path: log.maillevel

Environment path: VIKUNJA_LOG_MAILLEVEL

ratelimit #

enabled #

whether or not to enable the rate limit

Default: false

Full path: ratelimit.enabled

Environment path: VIKUNJA_RATELIMIT_ENABLED

kind #

The kind on which rates are based. Can be either "user" for a rate limit per user or "ip" for an ip-based rate limit.

Default: user

Full path: ratelimit.kind

Environment path: VIKUNJA_RATELIMIT_KIND

period #

The time period in seconds for the limit

Default: 60

Full path: ratelimit.period

Environment path: VIKUNJA_RATELIMIT_PERIOD

limit #

The max number of requests a user is allowed to do in the configured time period

Default: 100

Full path: ratelimit.limit

Environment path: VIKUNJA_RATELIMIT_LIMIT

store #

The store where the limit counter for each user is stored. Possible values are "keyvalue", "memory" or "redis". When choosing "keyvalue" this setting follows the one configured in the "keyvalue" section.

Default: keyvalue

Full path: ratelimit.store

Environment path: VIKUNJA_RATELIMIT_STORE

noauthlimit #

The number of requests a user can make from the same IP to all unauthenticated routes (login, register, password confirmation, email verification, password reset request) per minute. This limit cannot be disabled. You should only change this if you know what you're doing.

Default: 10

Full path: ratelimit.noauthlimit

Environment path: VIKUNJA_RATELIMIT_NOAUTHLIMIT

files #

basepath #

The path where files are stored

Default: ./files

Full path: files.basepath

Environment path: VIKUNJA_FILES_BASEPATH

maxsize #

The maximum size of a file, as a human-readable string. Warning: The max size is limited 2^64-1 bytes due to the underlying datatype

Default: 20MB

Full path: files.maxsize

Environment path: VIKUNJA_FILES_MAXSIZE

migration #

To use any of the available migrators, you usually need to configure credentials for the appropriate service and enable it. Find instructions below on how to do this for the provided migrators.

todoist #

Full path: migration.todoist

Environment path: VIKUNJA_MIGRATION_TODOIST

enable #

Whether to enable the Todoist migrator.

Default: false

Full path: migration.todoist.enable

Environment path: VIKUNJA_MIGRATION_TODOIST_ENABLE

clientid #

The client id, required for making requests to the Todoist api You need to register your Vikunja instance at https://developer.todoist.com/appconsole.html to get this.

Default: <empty>

Full path: migration.todoist.clientid

Environment path: VIKUNJA_MIGRATION_TODOIST_CLIENTID

clientsecret #

The client secret, also required for making requests to the Todoist api. Obtain it at https://developer.todoist.com/appconsole.html after registering your Vikunja instance.

Default: <empty>

Full path: migration.todoist.clientsecret

Environment path: VIKUNJA_MIGRATION_TODOIST_CLIENTSECRET

redirecturl #

The url where clients are redirected after they authorized Vikunja to access their Todoist items. In Todoist, this is called OAuth redirect URL and it needs to match the url you entered when registering your Vikunja instance at the Todoist developer console. When using the official Vikunja frontend, set this to <service.publicurl>/migrate/todoist (the default value). Otherwise, set this to an url which then makes a request to /api/v1/migration/todoist/migrate with the code obtained from the Todoist api.

Default: <service.publicurl>/migrate/todoist

Full path: migration.todoist.redirecturl

Environment path: VIKUNJA_MIGRATION_TODOIST_REDIRECTURL

trello #

Full path: migration.trello

Environment path: VIKUNJA_MIGRATION_TRELLO

enable #

Whether to enable the Trello migrator.

Default: false

Full path: migration.trello.enable

Environment path: VIKUNJA_MIGRATION_TRELLO_ENABLE

key #

The client id, required for making requests to the trello api. You need to register your Vikunja instance at https://trello.com/app-key (log in before you visit that link) to get one. Copy the Personal Key and set it as the client id. Add your Vikunja domain to the Allowed Origins list.

Default: <empty>

Full path: migration.trello.key

Environment path: VIKUNJA_MIGRATION_TRELLO_KEY

redirecturl #

The url where clients are redirected after they authorized Vikunja to access their trello cards. This needs to match the url you entered when registering your Vikunja instance at trello. When using the official Vikunja frontend, set this to <service.publicurl>/migrate/trello (the default value). Otherwise, set this to an url which then makes a request to /api/v1/migration/trello/migrate with the code obtained from the Trello api.

Default: <frontend url>/migrate/trello

Full path: migration.trello.redirecturl

Environment path: VIKUNJA_MIGRATION_TRELLO_REDIRECTURL

microsofttodo #

Full path: migration.microsofttodo

Environment path: VIKUNJA_MIGRATION_MICROSOFTTODO

enable #

Whether to enable the Microsoft Todo migrator.

Default: false

Full path: migration.microsofttodo.enable

Environment path: VIKUNJA_MIGRATION_MICROSOFTTODO_ENABLE

clientid #

The client id, required for making requests to the Microsoft graph api. See https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app#register-an-application for information about how to register your Vikunja instance.

Default: <empty>

Full path: migration.microsofttodo.clientid

Environment path: VIKUNJA_MIGRATION_MICROSOFTTODO_CLIENTID

clientsecret #

The client secret, also required for making requests to the Microsoft graph api

Default: <empty>

Full path: migration.microsofttodo.clientsecret

Environment path: VIKUNJA_MIGRATION_MICROSOFTTODO_CLIENTSECRET

redirecturl #

The url where clients are redirected after they authorized Vikunja to access their Microsoft todo tasks. This needs to match the url you entered when registering your Vikunja instance at Microsoft. When using the official Vikunja frontend, set this to <service.publicurl>/migrate/microsoft-todo (the default value). Otherwise, set this to an url which then makes a request to /api/v1/migration/microsoft-todo/migrate with the code obtained from the Microsoft Todo api.

Default: <frontend url>/migrate/microsoft-todo

Full path: migration.microsofttodo.redirecturl

Environment path: VIKUNJA_MIGRATION_MICROSOFTTODO_REDIRECTURL

avatar #

gravatarexpiration #

When using gravatar, this is the duration in seconds until a cached gravatar user avatar expires

Default: 3600

Full path: avatar.gravatarexpiration

Environment path: VIKUNJA_AVATAR_GRAVATAREXPIRATION

backgrounds #

enabled #

Whether to enable backgrounds for projects at all.

Default: true

Full path: backgrounds.enabled

Environment path: VIKUNJA_BACKGROUNDS_ENABLED

providers #

Full path: backgrounds.providers

Environment path: VIKUNJA_BACKGROUNDS_PROVIDERS

upload #

Full path: backgrounds.providers.upload

Environment path: VIKUNJA_BACKGROUNDS_PROVIDERS_UPLOAD

enabled #

Whether to enable uploaded project backgrounds

Default: true

Full path: backgrounds.providers.upload.enabled

Environment path: VIKUNJA_BACKGROUNDS_PROVIDERS_UPLOAD_ENABLED

unsplash #

Full path: backgrounds.providers.unsplash

Environment path: VIKUNJA_BACKGROUNDS_PROVIDERS_UNSPLASH

enabled #

Whether to enable setting backgrounds from unsplash as project backgrounds

Default: false

Full path: backgrounds.providers.unsplash.enabled

Environment path: VIKUNJA_BACKGROUNDS_PROVIDERS_UNSPLASH_ENABLED

accesstoken #

You need to create an application for your installation at https://unsplash.com/oauth/applications/new and set the access token below.

Default: <empty>

Full path: backgrounds.providers.unsplash.accesstoken

Environment path: VIKUNJA_BACKGROUNDS_PROVIDERS_UNSPLASH_ACCESSTOKEN

applicationid #

The unsplash application id is only used for pingback and required as per their api guidelines. You can find the Application ID in the dashboard for your API application. It should be a numeric ID. It will only show in the UI if your application has been approved for Enterprise usage, therefore if you’re in Demo mode, you can also find the ID in the URL at the end: https://unsplash.com/oauth/applications/:application_id

Default: <empty>

Full path: backgrounds.providers.unsplash.applicationid

Environment path: VIKUNJA_BACKGROUNDS_PROVIDERS_UNSPLASH_APPLICATIONID

legal #

Legal urls Will be shown in the frontend if configured here

Default: <empty>

Full path: legal.imprinturl

Environment path: VIKUNJA_LEGAL_IMPRINTURL

Default: <empty>

Full path: legal.privacyurl

Environment path: VIKUNJA_LEGAL_PRIVACYURL

keyvalue #

Key Value Storage settings The Key Value Storage is used for different kinds of things like metrics and a few cache systems.

type #

The type of the storage backend. Can be either "memory" or "redis". If "redis" is chosen it needs to be configured separately.

Default: memory

Full path: keyvalue.type

Environment path: VIKUNJA_KEYVALUE_TYPE

auth #

local #

Local authentication will let users log in and register (if enabled) through the db. This is the default auth mechanism and does not require any additional configuration.

Full path: auth.local

Environment path: VIKUNJA_AUTH_LOCAL

enabled #

Enable or disable local authentication

Default: true

Full path: auth.local.enabled

Environment path: VIKUNJA_AUTH_LOCAL_ENABLED

openid #

OpenID configuration will allow users to authenticate through a third-party OpenID Connect compatible provider.
The provider needs to support the openid, profile and email scopes.
Note: Some openid providers (like Gitlab) only make the email of the user available through OpenID if they have set it to be publicly visible. If the email is not public in those cases, authenticating will fail.
Note 2: The frontend expects the third party to redirect the user /auth/openid/ after authentication. Please make sure to configure the redirect url in your third party auth service accordingly if you're using the default Vikunja frontend. The frontend will automatically provide the API with the redirect url, composed from the current url where it's hosted. If you want to use the desktop client with OpenID, make sure to allow redirects to 127.0.0.1.

Full path: auth.openid

Environment path: VIKUNJA_AUTH_OPENID

enabled #

Enable or disable OpenID Connect authentication

Default: false

Full path: auth.openid.enabled

Environment path: VIKUNJA_AUTH_OPENID_ENABLED

providers #

A list of enabled providers. You can freely choose the <provider key>. Note that you must add at least one key to a config file if you want to read values from an environment variable as the provider won't be known to Vikunja otherwise.

Full path: auth.openid.providers

Environment path: VIKUNJA_AUTH_OPENID_PROVIDERS

<provider key> #

Full path: auth.openid.providers.<provider key>

Environment path: VIKUNJA_AUTH_OPENID_PROVIDERS_<PROVIDER KEY>

name #

The name of the provider as it will appear in the frontend.

Default: <empty>

Full path: auth.openid.providers.<provider key>.name

Environment path: VIKUNJA_AUTH_OPENID_PROVIDERS_<PROVIDER KEY>_NAME

authurl #

The auth url to send users to if they want to authenticate using OpenID Connect.

Default: <empty>

Full path: auth.openid.providers.<provider key>.authurl

Environment path: VIKUNJA_AUTH_OPENID_PROVIDERS_<PROVIDER KEY>_AUTHURL

logouturl #

The oidc logouturl that users will be redirected to on logout. Leave empty or delete key, if you do not want to be redirected.

Default: <empty>

Full path: auth.openid.providers.<provider key>.logouturl

Environment path: VIKUNJA_AUTH_OPENID_PROVIDERS_<PROVIDER KEY>_LOGOUTURL

clientid #

The client ID used to authenticate Vikunja at the OpenID Connect provider.

Default: <empty>

Full path: auth.openid.providers.<provider key>.clientid

Environment path: VIKUNJA_AUTH_OPENID_PROVIDERS_<PROVIDER KEY>_CLIENTID

clientsecret #

The client secret used to authenticate Vikunja at the OpenID Connect provider.

Default: <empty>

Full path: auth.openid.providers.<provider key>.clientsecret

Environment path: VIKUNJA_AUTH_OPENID_PROVIDERS_<PROVIDER KEY>_CLIENTSECRET

scope #

The scope necessary to use oidc. If you want to use the Feature to create and assign to Vikunja teams via oidc, you have to add the custom "vikunja_scope" and check openid.md. e.g. scope: openid email profile vikunja_scope

Default: openid email profile

Full path: auth.openid.providers.<provider key>.scope

Environment path: VIKUNJA_AUTH_OPENID_PROVIDERS_<PROVIDER KEY>_SCOPE

usernamefallback #

This option allows to look for a local account where the OIDC Issuer match the Vikunja local username. Allowed value is either true or false. That option can be combined with emailfallback. Use with caution, this can allow the 3rd party provider to connect to any local account and therefore potential account hijaking.

Default: false

Full path: auth.openid.providers.<provider key>.usernamefallback

Environment path: VIKUNJA_AUTH_OPENID_PROVIDERS_<PROVIDER KEY>_USERNAMEFALLBACK

emailfallback #

This option allows to look for a local account where the OIDC user's email match the Vikunja local email. Allowed value is either true or false. That option can be combined with usernamefallback. Use with caution, this can allow the 3rd party provider to connect to any local account and therefore potential account hijaking.

Default: false

Full path: auth.openid.providers.<provider key>.emailfallback

Environment path: VIKUNJA_AUTH_OPENID_PROVIDERS_<PROVIDER KEY>_EMAILFALLBACK

forceuserinfo #

This option forces the use of the OpenID Connect UserInfo endpoint to retrieve user information instead of relying on claims from the ID token. When set to true, user data (email, name, username) will always be obtained from the UserInfo endpoint even if the information is available in the token claims. This is useful for providers that don't include complete user information in their tokens or when you need the most up-to-date user data. Allowed value is either true or false.

Default: false

Full path: auth.openid.providers.<provider key>.forceuserinfo

Environment path: VIKUNJA_AUTH_OPENID_PROVIDERS_<PROVIDER KEY>_FORCEUSERINFO

ldap #

Authentication via an external LDAP server.

Full path: auth.ldap

Environment path: VIKUNJA_AUTH_LDAP

enabled #

Enable or disable LDAP authentication.

Default: false

Full path: auth.ldap.enabled

Environment path: VIKUNJA_AUTH_LDAP_ENABLED

host #

The hostname of the LDAP server.

Default: localhost

Full path: auth.ldap.host

Environment path: VIKUNJA_AUTH_LDAP_HOST

port #

The port of the LDAP server.

Default: 389

Full path: auth.ldap.port

Environment path: VIKUNJA_AUTH_LDAP_PORT

basedn #

The Base DN used for LDAP search requests.

Default: <empty>

Full path: auth.ldap.basedn

Environment path: VIKUNJA_AUTH_LDAP_BASEDN

userfilter #

The string that will be used to filter users in the directory. %[1]s will be substituted with the username entered in the login form.

Default: <empty>

Full path: auth.ldap.userfilter

Environment path: VIKUNJA_AUTH_LDAP_USERFILTER

usetls #

Whether to try and connect via a TLS-encrypted channel to the LDAP server.

Default: true

Full path: auth.ldap.usetls

Environment path: VIKUNJA_AUTH_LDAP_USETLS

verifytls #

Whether to verify the TLS certificate offered by the LDAP server.

Default: true

Full path: auth.ldap.verifytls

Environment path: VIKUNJA_AUTH_LDAP_VERIFYTLS

binddn #

The DN of the account used to search the LDAP directory for users when they want to log in.

Default: <empty>

Full path: auth.ldap.binddn

Environment path: VIKUNJA_AUTH_LDAP_BINDDN

bindpassword #

The password of the account used to search the LDAP directory.

Default: <empty>

Full path: auth.ldap.bindpassword

Environment path: VIKUNJA_AUTH_LDAP_BINDPASSWORD

groupsyncenabled #

If enabled, Vikunja will automagically add users to teams in Vikunja matching groupsyncfilter. The teams will be automatically created and kept in sync by Vikunja.

Default: false

Full path: auth.ldap.groupsyncenabled

Environment path: VIKUNJA_AUTH_LDAP_GROUPSYNCENABLED

groupsyncfilter #

The filter to search for group objects in the ldap directory. Only used when groupsyncenabled is set to true.

Default: (&(objectclass=*)(|(objectclass=group)(objectclass=groupOfNames)))

Full path: auth.ldap.groupsyncfilter

Environment path: VIKUNJA_AUTH_LDAP_GROUPSYNCFILTER

avatarsyncattribute #

The LDAP attribute where an image, decoded as raw bytes, can be found. If provided, Vikunja will use the value as avatar.

Default: <empty>

Full path: auth.ldap.avatarsyncattribute

Environment path: VIKUNJA_AUTH_LDAP_AVATARSYNCATTRIBUTE

attribute #

The directory attributes that are used to create accounts in Vikunja.

Default: <empty>

Full path: auth.ldap.attribute

Environment path: VIKUNJA_AUTH_LDAP_ATTRIBUTE

username #

The LDAP attribute used to set the username in Vikunja.

Default: uid

Full path: auth.ldap.attribute.username

Environment path: VIKUNJA_AUTH_LDAP_ATTRIBUTE_USERNAME

email #

The LDAP attribute used to set the email in Vikunja.

Default: mail

Full path: auth.ldap.attribute.email

Environment path: VIKUNJA_AUTH_LDAP_ATTRIBUTE_EMAIL

displayname #

The LDAP attribute used to set the displayed name in Vikunja.

Default: displayName

Full path: auth.ldap.attribute.displayname

Environment path: VIKUNJA_AUTH_LDAP_ATTRIBUTE_DISPLAYNAME

memberid #

The LDAP attribute used to check group membership of a team in Vikunja. Only used when groups are synced to Vikunja.

Default: member

Full path: auth.ldap.attribute.memberid

Environment path: VIKUNJA_AUTH_LDAP_ATTRIBUTE_MEMBERID

metrics #

Prometheus metrics endpoint

enabled #

If set to true, enables a /metrics endpoint for prometheus to collect metrics about Vikunja. You can query it from /api/v1/metrics.

Default: false

Full path: metrics.enabled

Environment path: VIKUNJA_METRICS_ENABLED

username #

If set to a non-empty value the /metrics endpoint will require this as a username via basic auth in combination with the password below.

Default: <empty>

Full path: metrics.username

Environment path: VIKUNJA_METRICS_USERNAME

password #

If set to a non-empty value the /metrics endpoint will require this as a password via basic auth in combination with the username below.

Default: <empty>

Full path: metrics.password

Environment path: VIKUNJA_METRICS_PASSWORD

defaultsettings #

Provide default settings for new users. When a new user is created, these settings will automatically be set for the user. If you change them in the config file afterwards they will not be changed back for existing users.

avatar_provider #

The avatar source for the user. Can be gravatar, initials, upload or marble. If you set this to upload you'll also need to specify defaultsettings.avatar_file_id.

Default: initials

Full path: defaultsettings.avatar_provider

Environment path: VIKUNJA_DEFAULTSETTINGS_AVATAR_PROVIDER

avatar_file_id #

The id of the file used as avatar.

Default: 0

Full path: defaultsettings.avatar_file_id

Environment path: VIKUNJA_DEFAULTSETTINGS_AVATAR_FILE_ID

email_reminders_enabled #

If set to true users will get task reminders via email.

Default: false

Full path: defaultsettings.email_reminders_enabled

Environment path: VIKUNJA_DEFAULTSETTINGS_EMAIL_REMINDERS_ENABLED

discoverable_by_name #

If set to true will allow other users to find this user when searching for parts of their name.

Default: false

Full path: defaultsettings.discoverable_by_name

Environment path: VIKUNJA_DEFAULTSETTINGS_DISCOVERABLE_BY_NAME

discoverable_by_email #

If set to true will allow other users to find this user when searching for their exact email.

Default: false

Full path: defaultsettings.discoverable_by_email

Environment path: VIKUNJA_DEFAULTSETTINGS_DISCOVERABLE_BY_EMAIL

overdue_tasks_reminders_enabled #

If set to true will send an email every day with all overdue tasks at a configured time.

Default: true

Full path: defaultsettings.overdue_tasks_reminders_enabled

Environment path: VIKUNJA_DEFAULTSETTINGS_OVERDUE_TASKS_REMINDERS_ENABLED

overdue_tasks_reminders_time #

When to send the overdue task reminder email.

Default: 9:00

Full path: defaultsettings.overdue_tasks_reminders_time

Environment path: VIKUNJA_DEFAULTSETTINGS_OVERDUE_TASKS_REMINDERS_TIME

default_project_id #

The id of the default project. Make sure users actually have access to this project when setting this value.

Default: 0

Full path: defaultsettings.default_project_id

Environment path: VIKUNJA_DEFAULTSETTINGS_DEFAULT_PROJECT_ID

week_start #

Start of the week for the user. 0 is sunday, 1 is monday and so on.

Default: 0

Full path: defaultsettings.week_start

Environment path: VIKUNJA_DEFAULTSETTINGS_WEEK_START

language #

The language of the user interface. Must be an ISO 639-1 language code followed by an ISO 3166-1 alpha-2 country code. Check https://kolaente.dev/vikunja/vikunja/frontend/src/branch/main/src/i18n/lang for a list of possible languages. Will default to the browser language the user uses when signing up.

Default: <unset>

Full path: defaultsettings.language

Environment path: VIKUNJA_DEFAULTSETTINGS_LANGUAGE

timezone #

The time zone of each individual user. This will affect when users get reminders and overdue task emails.

Default: <time zone set at service.timezone>

Full path: defaultsettings.timezone

Environment path: VIKUNJA_DEFAULTSETTINGS_TIMEZONE

webhooks #

enabled #

Whether to enable support for webhooks

Default: true

Full path: webhooks.enabled

Environment path: VIKUNJA_WEBHOOKS_ENABLED

timeoutseconds #

The timeout in seconds until a webhook request fails when no response has been received.

Default: 30

Full path: webhooks.timeoutseconds

Environment path: VIKUNJA_WEBHOOKS_TIMEOUTSECONDS

proxyurl #

The URL of a mole instance to use to proxy outgoing webhook requests. You should use this and configure appropriately if you're not the only one using your Vikunja instance. More info about why: https://webhooks.fyi/best-practices/webhook-providers#implement-security-on-egress-communication. Must be used in combination with webhooks.password (see below).

Default: <empty>

Full path: webhooks.proxyurl

Environment path: VIKUNJA_WEBHOOKS_PROXYURL

proxypassword #

The proxy password to use when authenticating against the proxy.

Default: <empty>

Full path: webhooks.proxypassword

Environment path: VIKUNJA_WEBHOOKS_PROXYPASSWORD

autotls #

enabled #

If set to true, Vikunja will automatically request a TLS certificate from Let's Encrypt and use it to serve Vikunja over TLS. By enabling this option, you agree to Let's Encrypt's TOS. You must configure a service.publicurl with a valid TLD where Vikunja is reachable to make this work. Furthermore, it is reccomened to set service.interface to :443 if you're using this.

Default: false

Full path: autotls.enabled

Environment path: VIKUNJA_AUTOTLS_ENABLED

email #

A valid email address which will be used to register certificates with Let's Encrypt. You must provide this value in order to use autotls.

Default: <empty>

Full path: autotls.email

Environment path: VIKUNJA_AUTOTLS_EMAIL

renewbefore #

A duration when certificates should be renewed before they expire. Valid time units are ns, us (or µs), ms, s, m, h.

Default: 30d

Full path: autotls.renewbefore

Environment path: VIKUNJA_AUTOTLS_RENEWBEFORE

On this page