Server Configuration

The server is configured entirely via environment variables. Use a .env file or your system’s environment management.

Required

Variable	Description
`COLDRUNE_MASTER_KEY`	Encryption master key (64 hex chars). Generate: `openssl rand -hex 32`
`SUPERADMIN_EMAIL_0`	First superadmin email. Add more with `_1`, `_2`, etc.
`SMTP_HOST`	SMTP server hostname. Set to `log` for dev mode.
`SMTP_USERNAME`	SMTP auth username (not required if `SMTP_HOST=log`)
`SMTP_PASSWORD`	SMTP auth password (not required if `SMTP_HOST=log`)
`SMTP_FROM`	Sender address, e.g. `Coldrune <noreply@example.com>`

Server

Variable	Description	Default
`COLDRUNE_DB_PATH`	SQLite database file path	`coldrune.db`
`COLDRUNE_HOST`	Bind address	`127.0.0.1`
`COLDRUNE_PORT`	Bind port	`7100`
`SMTP_PORT`	SMTP server port	`587`
`CORS_ALLOWED_ORIGINS`	Comma-separated allowed origins	(empty, CORS disabled)

Backup (optional)

All backup variables are optional. If BACKUP_S3_ENDPOINT is not set, backup features are disabled.

Variable	Description	Default
`BACKUP_S3_ENDPOINT`	S3-compatible endpoint URL	(disabled)
`BACKUP_S3_REGION`	S3 region	`us-east-1`
`BACKUP_S3_BUCKET`	Bucket name	(required if endpoint set)
`BACKUP_S3_ACCESS_KEY`	S3 access key	(required if endpoint set)
`BACKUP_S3_SECRET_KEY`	S3 secret key	(required if endpoint set)
`BACKUP_SCHEDULE_HOURS`	Auto-backup interval in hours (0 = disabled)	`0`
`BACKUP_RETAIN_DAILY_DAYS`	Keep daily backups for N days	`7`
`BACKUP_RETAIN_WEEKLY_WEEKS`	Keep weekly backups for N weeks	`4`

Key rotation

Variable	Description
`COLDRUNE_NEW_MASTER_KEY`	New master key for `coldrune server rotate-key` (optional, falls back to stdin)

Example .env

# Server
COLDRUNE_DB_PATH=/var/lib/coldrune/coldrune.db
COLDRUNE_HOST=127.0.0.1
COLDRUNE_PORT=7100

# Encryption
COLDRUNE_MASTER_KEY=a1b2c3d4e5f6...  # 64 hex chars

# Superadmins
SUPERADMIN_EMAIL_0=admin@example.com

# SMTP (Postmark example)
SMTP_HOST=smtp.postmarkapp.com
SMTP_PORT=587
SMTP_USERNAME=your-server-token
SMTP_PASSWORD=your-server-token
SMTP_FROM=Coldrune <noreply@example.com>

# Backup to Hetzner Object Storage
BACKUP_S3_ENDPOINT=https://fsn1.your-objectstorage.com
BACKUP_S3_BUCKET=coldrune-backups
BACKUP_S3_ACCESS_KEY=your-access-key
BACKUP_S3_SECRET_KEY=your-secret-key
BACKUP_SCHEDULE_HOURS=24

Superadmins

Superadmin emails are indexed: SUPERADMIN_EMAIL_0, SUPERADMIN_EMAIL_1, SUPERADMIN_EMAIL_2, etc. On startup, users matching these emails are promoted to superadmin. Users removed from the list are demoted.

Superadmins bypass all organization role checks and ACL rules.