Configuration

You can configure Scryer with environment variables for network binding, datastore selection, authentication, encryption, rate limiting, background workers, library paths, and container runtime behavior.

Use this page as the deployment-time reference. Prefer in-app settings for ordinary day-to-day operation; use environment variables when a setting must be known before startup, belongs to the host or container, or needs to be managed by your service manager.

This page lists the variables intended for operators to set. Scryer reads a number of additional variables for test harnesses, profiling, build tooling, and development-only behavior — those are deliberately not documented here, because setting them on a live instance either does nothing or causes problems.

When possible, pull sensitive values — passwords, encryption keys, and database credentials — from your deployment’s secret-management path.

Where to set these

• Docker — the environment: block in your compose file.
• Homebrew — $(brew --prefix)/etc/scryer/config.env, which the service wrapper sources on start. Any variable on this page can go there.
• Native or systemd — your service unit’s environment, or the shell that launches Scryer.

Showing all configuration variables.

Category	Name	Description	Default	Allowed values
Network & HTTP	SCRYER_BIND	Address and port the HTTP server listens on.	Native: 127.0.0.1:8080; Docker: 0.0.0.0:8080; Homebrew: 127.0.0.1:8686	Valid socket address. An unparsable value stops startup.
Network & HTTP	SCRYER_BASE_PATH	Path prefix Scryer itself serves for UI, GraphQL, health, OAuth, and WebSocket routes.	unset, serves at /	Any path prefix; normalized to /segment/…. Empty or whitespace serves at the root. A reverse proxy must preserve this prefix rather than strip it.
Network & HTTP	SCRYER_PUBLIC_URL	Canonical external origin advertised by OAuth metadata. Recommended behind a reverse proxy; it does not configure WebAuthn, routing, or the base path.	Derived from one exact X-Forwarded-Proto value (or http when absent) and Host	Absolute http or https URL with a host and no credentials. Only the origin is used; any path is discarded. An invalid value returns HTTP 400 on OAuth metadata requests.
Network & HTTP	SCRYER_TLS_CERT	PEM certificate chain path. Enables HTTPS. Must be set with SCRYER_TLS_KEY.	unset, plain HTTP	File path. A load failure stops startup.
Network & HTTP	SCRYER_TLS_KEY	PEM private key path. Must be set with SCRYER_TLS_CERT.	unset	File path. A load failure stops startup.
Network & HTTP	SCRYER_OPEN_BROWSER	Opt out of auto-opening a browser on native startup. No effect in Docker.	unset, opens on native installs	0, false, no, off disable. Other values do not.
Network & HTTP	SCRYER_OUTBOUND_HOST_RPS	Request-per-second ceiling for each public outbound host, such as indexers and metadata providers. Lower it if an indexer is throttling you.	20 requests/second, burst 20	Positive finite number. Private and local hosts stay pinned at 10/second and are unaffected; loopback is never throttled.
Datastore	SCRYER_DB_URL	Full datastore URL. Takes precedence over SCRYER_DB_PATH.	sqlite://<data-dir>/scryer.db	sqlite://, postgres://, postgresql://. PostgreSQL URLs must include a host, a database name, and an explicit sslmode of disable, prefer, require, verify-ca, or verify-full.
Datastore	SCRYER_DB_PATH	SQLite database path. Ignored when SCRYER_DB_URL is set.	Native: <data-dir>/scryer.db; Docker: /config/scryer.db	File path or SQLite URL.
Datastore	SCRYER_DB_USER	PostgreSQL username. Overrides any username in the URL.	unset, falls back to the URL username	Non-empty string. Startup fails if neither this nor a URL username is present.
Datastore	SCRYER_DB_PASSWORD	PostgreSQL password. Lower precedence than SCRYER_DB_PASSWORD_FILE.	unset, falls back to the URL password	Non-empty string. Whitespace is not trimmed, so trailing spaces in a compose file will break authentication.
Datastore	SCRYER_DB_PASSWORD_FILE	File containing the PostgreSQL password, for Docker secrets. Takes precedence over SCRYER_DB_PASSWORD.	unset	Path to a readable non-empty file. An unreadable or empty file stops startup.
Datastore	SCRYER_SQLITE_MAX_CONNECTIONS	SQLite connection pool size.	16	Positive integer, clamped to 1..64. Unparsable values use the default.
Datastore	SCRYER_POSTGRES_MAX_CONNECTIONS	PostgreSQL connection pool size.	16	Positive integer, clamped to 1..128. Unparsable values use the default.
Auth & Security	SCRYER_AUTH_ENABLED	Forces form login on or off, overriding the saved setting. Does not provision a password by itself.	unset, uses the saved database setting unless bootstrap forces authentication	Boolean tokens: 1/true/yes/y/on, 0/false/no/n/off. Unrecognized values are treated as unset outside bootstrap; active bootstrap rejects invalid values and explicit false.
Auth & Security	SCRYER_ADMIN_USERNAME	Selects the local full administrator to provision or explicitly reset.	admin	Trimmed, nonblank username; reserved identities such as anonymous and recovery-admin are rejected. Without a supplied password, must identify an existing usable local full administrator. Does not promote, reenable, or convert existing accounts.
Auth & Security	SCRYER_ADMIN_PASSWORD	Operator-supplied temporary password for a new or eligible passwordless administrator. First login requires a different password. Existing passwords are preserved unless reset is enabled.	unset	Nonempty, policy-valid password; whitespace is preserved. Set-but-empty stops startup. Lower precedence than SCRYER_ADMIN_PASSWORD_FILE.
Auth & Security	SCRYER_ADMIN_PASSWORD_FILE	Reads the temporary administrator password from a secret file. Takes precedence over the direct value.	unset	Readable file containing a nonempty password. Trailing CR/LF characters are stripped; other whitespace is preserved. Empty paths, unreadable files, and empty secrets stop startup.
Auth & Security	SCRYER_ADMIN_PASSWORD_RESET	Replaces the selected account’s password with the supplied temporary password on every startup, invalidates sessions, and requires replacement again. Preserves MFA. Remove after use.	false	Boolean tokens: 1/true/yes/y/on, 0/false/no/n/off. Blank or invalid values stop startup. True requires a password or secret file.
Auth & Security	SCRYER_DISABLE_DEFAULT_ADMIN	Disables built-in admin and prevents reenabling it while configured. Removing the flag does not automatically reenable it.	false	Same boolean tokens as reset; blank or invalid values stop startup. Requires another enabled local full administrator with a usable password on every boot. Cannot select admin for bootstrap/reset while disabling it.
Auth & Security	SCRYER_RECOVERY_ADMIN_PASSWORD	Emergency admin password to regain access after a lockout. Forces form login on.	unset	Non-empty password. Set-but-empty stops startup. Cannot be combined with SCRYER_ALLOW_UNAUTHENTICATED_PUBLIC_ACCESS=true.
Auth & Security	SCRYER_ALLOW_UNAUTHENTICATED_PUBLIC_ACCESS	Lets unauthenticated public clients act as admin when auth is disabled. Dangerous.	unset, disabled	Boolean tokens; only a true value enables. Logs a warning while active.
Auth & Security	SCRYER_UNAUTHENTICATED_PUBLIC_ACCESS_ALLOWLIST	Narrows unauthenticated public access to specific clients.	unset	Comma-separated IPs, CIDRs, or DNS hostnames. Setting it with no valid entries stops startup.
Auth & Security	SCRYER_ENCRYPTION_KEY	Master key encrypting stored secrets such as passwords and API keys.	Platform keystore, otherwise a generated persistent key	Base64 32-byte key from scryer —generate-key. Invalid base64 stops startup.
Auth & Security	SCRYER_JWT_ACCESS_TTL_SECONDS	Access-token lifetime, which controls how long a session lasts.	86400 (24 hours)	Positive integer seconds. Other values use the default.
Auth & Security	SCRYER_WEBAUTHN_RP_ID	WebAuthn relying-party ID, a bare hostname. Required for passkeys.	unset, passkeys disabled	Non-empty hostname. Must be set together with SCRYER_WEBAUTHN_RP_ORIGIN or passkeys stay disabled.
Auth & Security	SCRYER_WEBAUTHN_RP_ORIGIN	WebAuthn relying-party origin, including scheme, host, and port.	unset, passkeys disabled	Valid URL. An invalid value disables passkeys with a warning.
Auth & Security	SCRYER_WEBAUTHN_RP_NAME	Display name shown in the passkey prompt.	Scryer	Non-empty string.
Rate Limiting	SCRYER_RATE_LIMIT_TRUSTED_PROXY_IPS	Reverse-proxy addresses authorized to supply X-Forwarded-For for rate-limit client identity. This affects rate limiting only.	unset, no proxies trusted	Comma-separated exact IPv4/IPv6 addresses or CIDRs. Invalid entries are ignored with a warning. Configure every controlled proxy hop and prefer a dedicated, narrow Docker network CIDR; broad LAN or shared container ranges weaken the trust boundary.
Rate Limiting	SCRYER_RATE_LIMIT_BYPASS_IPS	Resolved clients exempt from all rate limiting.	unset, empty list	Comma-separated IPs or CIDRs. Behind a configured trusted proxy, this is checked against the securely resolved client, not the proxy. Invalid entries are silently dropped.
Rate Limiting	SCRYER_LOGIN_RATE_LIMIT_ATTEMPTS	Login attempts allowed per window.	5	Positive integer; minimum 1.
Rate Limiting	SCRYER_LOGIN_RATE_LIMIT_WINDOW_SECS	Login rate-limit window.	60	Positive integer seconds; minimum 1.
Rate Limiting	SCRYER_SEARCH_RATE_LIMIT_REQUESTS	Expensive search requests allowed per window.	30	Positive integer; minimum 1.
Rate Limiting	SCRYER_SEARCH_RATE_LIMIT_WINDOW_SECS	Search rate-limit window.	60	Positive integer seconds; minimum 1.
Rate Limiting	SCRYER_MUTATION_RATE_LIMIT_REQUESTS	GraphQL mutations allowed per window.	120	Positive integer; minimum 1.
Rate Limiting	SCRYER_MUTATION_RATE_LIMIT_WINDOW_SECS	Mutation rate-limit window.	60	Positive integer seconds; minimum 1.
Rate Limiting	SCRYER_API_RATE_LIMIT_REQUESTS	General API and GraphQL query requests allowed per window.	300	Positive integer; minimum 1.
Rate Limiting	SCRYER_API_RATE_LIMIT_WINDOW_SECS	API rate-limit window.	60	Positive integer seconds; minimum 1.
Rate Limiting	SCRYER_AUTHLESS_CLIENT_RATE_LIMIT_REQUESTS	Requests per window for unauthenticated web clients.	120	Positive integer; minimum 1.
Rate Limiting	SCRYER_AUTHLESS_CLIENT_RATE_LIMIT_WINDOW_SECS	Authless-client rate-limit window.	60	Positive integer seconds; minimum 1.
Rate Limiting	SCRYER_OAUTH_RATE_LIMIT_REQUESTS	OAuth endpoint requests allowed per window.	30	Positive integer; minimum 1.
Rate Limiting	SCRYER_OAUTH_RATE_LIMIT_WINDOW_SECS	OAuth rate-limit window.	60	Positive integer seconds; minimum 1.
Background Jobs	SCRYER_BACKGROUND_ACQUISITION	Kill switch for the background acquisition poller.	unset, enabled	false, 0, no, off disable. Every other value enables.
Background Jobs	SCRYER_BACKGROUND_LIBRARY_REFRESH	Kill switch for scheduled background library refresh jobs.	unset, enabled	false, 0, no, off disable. Every other value enables.
Library & Imports	SCRYER_MANUAL_IMPORT_ALLOWED_ROOTS	Extra filesystem roots that path-based manual import may read from.	unset, empty list	Comma-separated absolute paths. Entries that are inaccessible, not a directory, or a filesystem root are dropped with a warning.
Library & Imports	SCRYER_MOVIES_PATH	Seeds the movies library root on startup.	/data/movies	Non-empty path. Stops taking effect once the path is changed in the UI.
Library & Imports	SCRYER_SERIES_PATH	Seeds the series library root on startup.	/data/series	Non-empty path. Stops taking effect once the path is changed in the UI.
Library & Imports	SCRYER_ANIME_PATH	Seeds the anime library root on startup.	/data/anime	Non-empty path. Stops taking effect once the path is changed in the UI.
Logging & Metrics	RUST_LOG	Log verbosity and per-module filtering.	info	Rust tracing filter, e.g. info or info,scryer_application=debug. An invalid filter falls back to info.
Logging & Metrics	SCRYER_LOG_FILE	Writes logs to a file in addition to the console and the in-app log view.	Linux and macOS: unset, no file. Windows: %LOCALAPPDATA%\scryer\logs\scryer.log	File path; relative paths resolve under the data directory. If set explicitly and the file cannot be opened, startup fails.
Logging & Metrics	SCRYER_METRICS	Enables the Prometheus metrics endpoint at /metrics.	unset, disabled	Exactly 1 or true. Whitespace is not trimmed, and yes or on will not work here.
Container Runtime	PUID	User ID the container drops to. /config is chowned to it.	1000	Unsigned integer UID. Invalid values warn and fall back to 1000.
Container Runtime	PGID	Group ID the container drops to.	1000	Unsigned integer GID. Invalid values warn and fall back to 1000.
Container Runtime	UMASK	File-creation mask applied before dropping privileges. Docker only.	022 in the Docker image; no mask applied elsewhere	Octal mode, e.g. 022. Invalid values warn and are ignored.
Container Runtime	TZ	Container timezone, which affects log timestamps and schedule evaluation.	Etc/UTC	Any tzdata zone name, e.g. America/New_York.

Boolean Values Are Not Uniform

For first-time boot password configurations, active bootstrap settings force authentication and disable local-IP bypass. Conflicting authless or recovery-admin configuration stops startup. Ordinary restarts do not reset an existing password unless SCRYER_ADMIN_PASSWORD_RESET=true.

Scryer does not use one boolean syntax everywhere, so copy the accepted values from the row you’re setting rather than assuming.

• Most settings accept 1/true/yes/y/on and 0/false/no/n/off.
• The background job kill switches only recognize false, 0, no, and off as “off” — any other value, including a typo, leaves the job enabled.
• SCRYER_METRICS accepts only 1 or true, and does not tolerate surrounding whitespace.

Related Concepts

• Docker — common place to set container environment variables
• Homebrew — uses $(brew --prefix)/etc/scryer/config.env for service environment overrides
• Recover Locked Out Scryer — uses SCRYER_RECOVERY_ADMIN_PASSWORD
• Security — in-app controls for authentication once Scryer is running