Configuration Guide¶
This guide covers all configuration options available in Readur through environment variables and runtime settings.
📖 See Also: For a complete reference of all configuration options including S3 storage and advanced settings, see the Configuration Reference.
Table of Contents¶
- Environment Variables
- Core Configuration
- File Storage & Upload
- Watch Folder Configuration
- OCR & Processing Settings
- Search & Performance
- Data Management
- Port Configuration
- Example Configurations
- Configuration Priority
- Runtime Settings vs Environment Variables
- Database Tuning
Environment Variables¶
All application settings can be configured via environment variables:
Core Configuration¶
| Variable | Default | Description |
|---|---|---|
DATABASE_URL | postgresql://readur:readur@localhost/readur | PostgreSQL connection string |
JWT_SECRET | (generated, stored in the database) | Secret used to sign JWT tokens. Optional: when unset, a key is generated on first start and stored in the database (readur rotate-jwt-secret replaces it). When set to a value of at least 32 bytes that is not a published example, it takes precedence; a shorter or example value is ignored with a startup warning and the stored key is used. Generate with openssl rand -hex 32 |
SERVER_ADDRESS | 0.0.0.0:8000 | Server bind address and port |
Security and Access Control¶
| Variable | Default | Description |
|---|---|---|
READUR_INSECURE_DEV_MODE | false | Allows startup with a short or example JWT_SECRET. Throwaway local development and CI only; never in production |
JWT_TTL_HOURS | 12 | Lifetime of login tokens in hours (1-720) |
ADMIN_USERNAME | admin | Username of the initial admin account |
ADMIN_EMAIL | <username>@localhost | Email of the initial admin account |
ADMIN_PASSWORD | (none) | Initial admin password (min 8 chars). If unset, a random 24-character password is generated and written to a file instead of the logs |
ADMIN_PASSWORD_FILE | <UPLOAD_PATH>/.readur/initial-admin-password | Location of the generated admin password file (mode 0600); /app/uploads/.readur/initial-admin-password in the Docker image |
ALLOW_REGISTRATION | false | Enables self-registration. New self-registered accounts are disabled until an administrator approves them in user management |
LOCAL_SOURCE_ALLOWED_PATHS | (none) | Comma-separated directories local folder sources may use. When set, all local folder sources (including admins') must be inside one of them. When unset, only admins can create local folder sources |
TRUSTED_PROXIES | (loopback and private networks) | Comma-separated IPs/CIDRs of reverse proxies whose X-Forwarded-For header is trusted for the client IP (rate limiting). none trusts no proxy |
CORS_ALLOWED_ORIGINS | (none) | Comma-separated origins (scheme://host[:port]) allowed for cross-origin requests; invalid entries stop startup. The bundled frontend is same-origin and needs none |
METRICS_TOKEN | (none) | Bearer token (min 16 chars) for Prometheus scrapes of /metrics. Without it, /metrics requires an admin session or API key |
PUBLIC_URL | (none) | Public base URL (e.g. https://readur.example.com) used for the OIDC redirect and shared links. OIDC falls back to the origin of OIDC_REDIRECT_URI |
OIDC_LINK_EXISTING_BY_EMAIL | false | Link an OIDC login to an existing local account with the same email, only when the IdP reports email_verified |
See the Configuration Reference for details.
File Storage & Upload¶
| Variable | Default | Description |
|---|---|---|
UPLOAD_PATH | ./uploads | Document storage directory |
ALLOWED_FILE_TYPES | pdf,txt,doc,docx,png,jpg,jpeg | Comma-separated allowed file extensions |
Watch Folder Configuration¶
| Variable | Default | Description |
|---|---|---|
WATCH_FOLDER | ./watch | Directory to monitor for new files |
WATCH_INTERVAL_SECONDS | 30 | Minimum interval between re-processing the same file; also controls polling frequency for network filesystems |
FILE_STABILITY_CHECK_MS | 500 | Time to wait for file write completion (milliseconds) |
MAX_FILE_AGE_HOURS | (none) | Skip files older than this many hours |
FORCE_POLLING_WATCH | (none) | Force polling mode even for local filesystems |
OCR & Processing Settings¶
Note: These settings can also be configured per-user via the web interface
| Variable | Default | Description |
|---|---|---|
OCR_LANGUAGE | eng | OCR language code (eng, fra, deu, spa, etc.) |
CONCURRENT_OCR_JOBS | 4 | Maximum parallel OCR processes |
OCR_TIMEOUT_SECONDS | 300 | OCR processing timeout per file |
MAX_FILE_SIZE_MB | 50 | Maximum file size for upload |
MAX_PDF_SIZE_MB | 100 | Maximum PDF file size for OCR processing |
MAX_OFFICE_DOCUMENT_SIZE_MB | 100 | Maximum Office document size for text extraction |
AUTO_ROTATE_IMAGES | true | Automatically rotate images for better OCR |
ENABLE_IMAGE_PREPROCESSING | true | Apply image enhancement before OCR |
Search & Performance¶
| Variable | Default | Description |
|---|---|---|
SEARCH_RESULTS_PER_PAGE | 25 | Default number of search results per page |
SEARCH_SNIPPET_LENGTH | 200 | Length of text snippets in search results |
FUZZY_SEARCH_THRESHOLD | 0.8 | Similarity threshold for fuzzy search (0.0-1.0) |
MEMORY_LIMIT_MB | 512 | Memory limit for OCR processes |
CPU_PRIORITY | normal | CPU priority: low, normal, high |
Data Management¶
| Variable | Default | Description |
|---|---|---|
RETENTION_DAYS | (none) | Auto-delete documents after N days |
ENABLE_AUTO_CLEANUP | false | Enable automatic cleanup of old documents |
ENABLE_COMPRESSION | false | Compress stored documents to save space |
ENABLE_BACKGROUND_OCR | true | Process OCR in background queue |
Port Configuration¶
Readur supports flexible port configuration:
# Method 1: Specify full server address
SERVER_ADDRESS=0.0.0.0:8000
# Method 2: Use separate host and port (recommended)
SERVER_HOST=0.0.0.0
SERVER_PORT=8000
# For development: Configure frontend port
CLIENT_PORT=5173
BACKEND_PORT=8000
Example Configurations¶
Development Configuration¶
# Basic development setup
DATABASE_URL=postgresql://readur:readur@localhost/readur
JWT_SECRET=readur-local-development-only-jwt-secret-0123456789
READUR_INSECURE_DEV_MODE=true # the example secret above is only accepted in dev mode
SERVER_ADDRESS=0.0.0.0:8000
UPLOAD_PATH=./uploads
WATCH_FOLDER=./watch
OCR_LANGUAGE=eng
CONCURRENT_OCR_JOBS=2
Production Configuration¶
# Core settings
DATABASE_URL=postgresql://readur:secure_password@postgres:5432/readur
JWT_SECRET=<output of: openssl rand -hex 32>
SERVER_ADDRESS=0.0.0.0:8000
# File handling
UPLOAD_PATH=/app/uploads
ALLOWED_FILE_TYPES=pdf,png,jpg,jpeg,tiff,bmp,gif,txt,rtf,doc,docx
# Watch folder for NFS mount
WATCH_FOLDER=/mnt/nfs/documents
WATCH_INTERVAL_SECONDS=60
FILE_STABILITY_CHECK_MS=1000
MAX_FILE_AGE_HOURS=168
FORCE_POLLING_WATCH=1
# OCR optimization
OCR_LANGUAGE=eng
CONCURRENT_OCR_JOBS=8
OCR_TIMEOUT_SECONDS=600
MAX_FILE_SIZE_MB=200
AUTO_ROTATE_IMAGES=true
ENABLE_IMAGE_PREPROCESSING=true
# Performance tuning
MEMORY_LIMIT_MB=2048
CPU_PRIORITY=high
ENABLE_COMPRESSION=true
ENABLE_BACKGROUND_OCR=true
# Search optimization
SEARCH_RESULTS_PER_PAGE=50
SEARCH_SNIPPET_LENGTH=300
FUZZY_SEARCH_THRESHOLD=0.7
# Data management
RETENTION_DAYS=2555 # 7 years
ENABLE_AUTO_CLEANUP=true
Network Filesystem Configuration¶
# For NFS mounts
WATCH_FOLDER=/mnt/nfs/documents
WATCH_INTERVAL_SECONDS=60
FILE_STABILITY_CHECK_MS=1000
FORCE_POLLING_WATCH=1
# For SMB/CIFS mounts
WATCH_FOLDER=/mnt/smb/shared
WATCH_INTERVAL_SECONDS=30
FILE_STABILITY_CHECK_MS=2000
# For S3 mounts (using s3fs)
WATCH_FOLDER=/mnt/s3/bucket
WATCH_INTERVAL_SECONDS=120
FILE_STABILITY_CHECK_MS=5000
FORCE_POLLING_WATCH=1
Configuration Priority¶
Settings are applied in this order (later values override earlier ones):
- Application defaults (built into the code)
- Environment variables (system-wide configuration)
- User settings (per-user database settings via web interface)
This allows for flexible deployment where system administrators can set defaults while users can customize their experience.
Runtime Settings vs Environment Variables¶
Some settings can be configured in two ways:
- Environment Variables: Set at container startup, affects the entire application
- User Settings: Configured per-user via the web interface, stored in database
Environment variables take precedence and provide system-wide defaults. User settings override these defaults for individual users where applicable.
Settings configurable via web interface: - OCR language preferences - Search result limits - File type restrictions - OCR processing options - Data retention policies
Database Tuning¶
For better search performance with large document collections:
-- Increase shared_buffers for better caching
ALTER SYSTEM SET shared_buffers = '256MB';
-- Optimize for full-text search
ALTER SYSTEM SET default_text_search_config = 'pg_catalog.english';
-- Restart PostgreSQL after changes
Security Configuration¶
Generating Secure Secrets¶
# Generate secure JWT secret
JWT_SECRET=$(openssl rand -hex 32)
# Generate secure database password
DB_PASSWORD=$(openssl rand -base64 32)
# Save to .env file
cat > .env << EOF
JWT_SECRET=${JWT_SECRET}
DB_PASSWORD=${DB_PASSWORD}
EOF
Quick Reference - Essential Variables¶
For a minimal production deployment, configure these essential variables:
# Security (REQUIRED)
JWT_SECRET=<output of: openssl rand -hex 32> # optional; min 32 bytes when set
DATABASE_URL=postgresql://user:password@host:port/database
# File Storage
UPLOAD_PATH=/app/uploads
WATCH_FOLDER=/path/to/mounted/folder
# Watch Folder (for network mounts)
WATCH_INTERVAL_SECONDS=60
FORCE_POLLING_WATCH=1
# Performance
CONCURRENT_OCR_JOBS=4
MAX_FILE_SIZE_MB=100
Next Steps¶
- Review deployment options for production setup
- Learn about folder watching for automatic document ingestion
- Optimize OCR performance for your use case