Environment variable reference

Every environment variable Loombre's settings registry recognizes, in two groups:

1. Bootstrap & lockout-boundary variables — no settings-screen equivalent at all. Some are needed before the database (and therefore any UI-stored setting) is even reachable; the rest are configuration an admin could otherwise lock themselves out with if it were editable at runtime.
2. Environment pins for admin-editable settings — these DO have a settings-screen equivalent (see the Admin Guide's settings reference); setting the variable overrides and locks whatever's in the database or the screen.

Assumption: variable names and defaults below are Loombre's own environment-variable convention as read by the server/worker processes directly — for most install paths this is independent of how you set them (systemd Environment=, a shell export before running from source, etc.); see Install for the mechanism that applies to your install path.

Docker Compose is the one exception to "any mechanism works": the shipped docker-compose.prod.yml forwards only an explicit list of variables into the containers — loombre.env values are Compose interpolation input, never injected wholesale into the container environment — so a variable on this page that the compose file's environment: blocks don't forward has no effect there. For such settings under Docker, use the admin settings screen instead (the environment pin simply isn't available), or add the variable to the compose environment: blocks yourself. The built-in TLS/ACME variables are deliberately in the unforwarded group: the Docker distribution handles TLS with a reverse proxy in front, never in-process — see docs/install/docker.md.

Bootstrap & lockout-boundary variables

Database

DATABASE_URL

Database connection. Where Loombre's database lives. Leave it unset and Loombre provisions and manages its own embedded PostgreSQL automatically; set it and Loombre connects to that external PostgreSQL instead — the two modes are selected purely by whether this variable is set. The server can't start without resolving this first — every other setting stored in the database depends on it.

• Technical details: PostgreSQL connection string. Read before any DB-backed configuration — including this registry's own database-stored half — can be resolved at all. When unset, the bundled embedded PostgreSQL is provisioned under the data directory and listens on loopback port 5433; see the Operator Guide's External PostgreSQL page for the external mode.

Network

PORT

HTTP port. Which network port Loombre listens on for plain (non-HTTPS) connections. Not used once HTTPS is turned on (the TLS settings) — that mode listens on its own port instead.

• Technical details: TCP port the plain-HTTP listener binds. Ignored whenever tls.mode is not 'off' — TLS mode binds its own HTTPS port.
• Default when unset: 3001

LOOMBRE_CORS_ORIGINS

Allowed browser origins (CORS). Which web addresses are allowed to load Loombre's web app in a browser and talk to this server — set this to the address(es) you use to reach Loombre. An empty list turns this check off entirely, for setups where the web app and server share the same address.

• Technical details: Strict CORS origin allowlist for the browser web client. An explicitly empty list disables CORS entirely (same-origin deployments). Unset falls back to the local dev pairing.
• Default when unset: http://localhost:3000, http://127.0.0.1:3000

Paths

LOOMBRE_DATA_DIR

Data directory. Where Loombre stores its data: your media cache, secrets, generated poster/thumbnail images, and TLS certificates. Leave unset and Loombre picks a sensible location based on your operating system.

• Technical details: Platform default when unset: XDG_DATA_HOME/loombre (Linux), ~/Library/Application Support/Loombre (macOS), %LOCALAPPDATA%/Loombre (Windows).

LOOMBRE_CONFIG_DIR

Config directory. Where Loombre stores its configuration files. Leave unset and Loombre picks a sensible location based on your operating system.

• Technical details: Platform default when unset: XDG_CONFIG_HOME/loombre (Linux), Application Support/Loombre/config (macOS), %APPDATA%/Loombre (Windows).

LOOMBRE_TRANSCODE_DIR

Conversion staging directory. The folder Loombre uses to hold video temporarily while it's being converted. Needs enough free space for whatever is converting right now — Loombre cleans these files up automatically once it's done.

• Technical details: Root directory transcode session staging directories are created under (docs/PLAYBACK.md §9 binding constraint 3). Default: <os.tmpdir()>/loombre-transcode — except the native Linux installs (rpm/deb/tarball), whose bin/ wrappers default it to <LOOMBRE_DATA_DIR>/transcode: their systemd units run with PrivateTmp=true, so a /tmp path is private to each service and the server could never serve what the worker wrote. Must be readable and writable by BOTH loombre-server and loombre-worker (a custom path on those installs also needs a ReadWritePaths= drop-in on both units).
• Default when unset: /tmp/loombre-transcode

ffmpeg / ffprobe

LOOMBRE_FFMPEG

ffmpeg binary path. Where to find the ffmpeg program Loombre uses to convert video. Leave blank and Loombre looks for it automatically, the same way your system finds any other installed program.

• Technical details: Explicit ffmpeg binary path. Empty means resolve via PATH.
• Default when unset: (empty — not set)

LOOMBRE_FFPROBE

ffprobe binary path. Where to find the ffprobe program Loombre uses to inspect video and audio files before converting them. Leave blank and Loombre looks for it automatically, the same way your system finds any other installed program.

• Technical details: Explicit ffprobe binary path. Empty means resolve via PATH.
• Default when unset: (empty — not set)

Environment pins for admin-editable settings

LOOMBRE_MAX_TRANSCODES

Pins Maximum simultaneous conversions (transcode.maxSimultaneousTranscodes) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

How many videos this server will convert at the same time. Lowering it never interrupts anything already playing — it only makes the next person wait for a free slot.

• Default when unset: 2 (Tier 0) / 2 (Tier 1) / 4 (Tier 2) (or whatever was last saved from the settings screen)
• Caution: Setting this too high can overload the server if several videos convert at once — raise it gradually and keep an eye on how the machine handles it.

LOOMBRE_SCAN_CONCURRENCY

Pins Library scan speed (scanner.concurrency) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

How many files Loombre examines at once while scanning. Higher is faster but works the machine harder; takes effect on the next scan. When you haven't changed it, Loombre uses half your processor cores (minimum 2).

LOOMBRE_JOBS_IMAGE_CONCURRENCY

Pins Image processing at once (jobs.imageConcurrency) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

How many poster, backdrop and portrait images Loombre processes at the same time. When you haven't changed it, the default is chosen for this machine from its performance tier and processor cores (a quarter of the cores on tier 0, half on tiers 1 and 2, never below 2 — or 4 on tier 2). Higher fills a new library faster but works the machine harder.

• Technical details: pg-boss local concurrency of the 'image' consumer; each job renders WebP (+ AVIF when enabled) at three sizes plus blurhash and dominant colour inside worker_threads. Default = max(floor, cores ÷ divisor) with floor/divisor 2/4 (tier 0), 2/2 (tier 1), 4/2 (tier 2). Fixed at consumer registration, hence the restart.

LOOMBRE_JOBS_PROBE_CONCURRENCY

Pins File inspections at once (jobs.probeConcurrency) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

How many newly found media files Loombre inspects (probes) at the same time after a scan. Defaults to a number chosen for this machine from its performance tier and processor cores, the same way as image processing.

• Technical details: pg-boss local concurrency of the 'probe' consumer (one bounded ffprobe run, plus the open-GOP trace scan for hevc/h264, per job). Default = max(floor, cores ÷ divisor) with floor/divisor 2/4 (tier 0), 2/2 (tier 1), 4/2 (tier 2). Fixed at consumer registration, hence the restart.

LOOMBRE_JOBS_SUBTITLE_EXTRACT_CONCURRENCY

Pins Subtitle extractions at once (jobs.subtitleExtractConcurrency) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

How many subtitle tracks Loombre extracts for playback at the same time. Defaults to a number chosen for this machine from its performance tier and processor cores, the same way as image processing.

• Technical details: pg-boss local concurrency of the 'subtitle-extract' consumer (short ffmpeg runs producing segmented WebVTT). Default = max(floor, cores ÷ divisor) with floor/divisor 2/4 (tier 0), 2/2 (tier 1), 4/2 (tier 2). Fixed at consumer registration, hence the restart.

LOOMBRE_TRANSCODE_WORKER_CONCURRENCY

Pins Conversion sessions per worker (jobs.transcodeConcurrency) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

How many video conversion sessions this worker process supervises at the same time. This is not the conversion limit — that is 'maximum simultaneous conversions' under Video conversion — it only bounds one worker process. Defaults to a number chosen for this machine from its performance tier and processor cores.

• Technical details: pg-boss local concurrency of the 'transcode' consumer; admission (transcode.maxSimultaneousTranscodes) is the real cap and this must not be below it. Default = max(floor, cores ÷ divisor) with floor/divisor 4/4 (tier 0), 8/2 (tier 1), 8/2 (tier 2). Fixed at consumer registration, hence the restart.

LOOMBRE_RESTRICTED_ENABLED

Pins Enable restricted content (restricted.enabled) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

Turns the restricted-content feature on for this server. Off by default. While off, no restricted libraries or restricted content can be created.

• Default when unset: Off (or whatever was last saved from the settings screen)

LOOMBRE_UPDATE_CHECK

Pins Check for updates (updateCheck.mode) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

Whether Loombre checks for a newer version. 'daily' checks at startup and once a day; 'manual' only when you ask; 'off' never. Nothing identifying is ever sent, in any mode. Loombre never installs an update by itself.

• Default when unset: daily (or whatever was last saved from the settings screen)

LOOMBRE_RATE_LOGIN

Pins Sign-in attempt limit (rateLimit.login) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

How many sign-in attempts may come from one network address per minute before Loombre starts turning them away. Guards against password guessing. Several devices sharing one connection (a household router) share this allowance.

• Technical details: Keyed per source IP, not per device — the per-account companion is rateLimit.loginByIdentifier.
• Default when unset: 10 (or whatever was last saved from the settings screen)

LOOMBRE_RATE_REFRESH

Pins Session refresh limit (rateLimit.refresh) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

How many session-refresh requests may come from one network address per minute. Guards against flooding the server with requests for new sign-in tokens. Several devices sharing one connection share this allowance.

• Technical details: Keyed per source IP, not per device — the per-device companion is rateLimit.refreshByDevice.
• Default when unset: 30 (or whatever was last saved from the settings screen)

LOOMBRE_RATE_UNLOCK

Pins Restricted-content PIN attempt limit (rateLimit.unlock) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

How many PIN attempts one person may make per minute when unlocking restricted content. Guards against someone guessing the PIN.

• Default when unset: 5 (or whatever was last saved from the settings screen)

LOOMBRE_RATE_CURRENT_PASSWORD

Pins Current-password re-authentication attempt limit (rateLimit.currentPassword) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

How many current-password re-authentication attempts one person may make per minute when changing their password, email, or restricted-content PIN. Guards against someone guessing the account password.

• Default when unset: 10 (or whatever was last saved from the settings screen)

LOOMBRE_RATE_SETUP

Pins Setup wizard request limit (rateLimit.setup) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

How many requests one device may make per minute to the first-time setup screen, before any account exists. Guards against abuse of that screen.

• Default when unset: 20 (or whatever was last saved from the settings screen)

LOOMBRE_RATE_CAPABILITIES

Pins Capability check request limit (rateLimit.capabilities) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

How many times one device may ask the server what it supports, per minute. This is checked often during normal use, so the limit is set high.

• Default when unset: 120 (or whatever was last saved from the settings screen)

LOOMBRE_RATE_EXPORT

Pins Data export request limit (rateLimit.export) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

How many full library exports one person may download per hour (not per minute — exports are heavy).

• Default when unset: 5 (or whatever was last saved from the settings screen)

LOOMBRE_RATE_MEDIA_TOKEN

Pins Media playback request limit (rateLimit.mediaToken) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

How many media requests one person may make per minute — posters, video, and subtitles combined. Set this high: normal viewing makes many small requests.

• Default when unset: 600 (or whatever was last saved from the settings screen)

LOOMBRE_RATE_CLAIM

Pins Claim (rateLimit.claim) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

How many invite-claim attempts one device may make per minute, before any account exists for it. Guards the claim link against brute-force guessing.

• Default when unset: 10 (or whatever was last saved from the settings screen)

LOOMBRE_RATE_PASSWORD_RESET

Pins Password Reset (rateLimit.passwordReset) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

How many password-recovery requests (forgot-password or reset-password) one device may make per minute. Guards against email-bombing an account and against guessing a reset token.

• Default when unset: 5 (or whatever was last saved from the settings screen)

LOOMBRE_RATE_PROBE

Pins Reachability-proof attempt limit (rateLimit.probe) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

How many reachability-check attempts one device may make per minute while proving it can reach this server from outside your network (part of Remote Access setup). Guards that check against brute-force guessing.

• Default when unset: 10 (or whatever was last saved from the settings screen)

LOOMBRE_RATE_LOGIN_BY_IDENTIFIER

Pins Login By Identifier (rateLimit.loginByIdentifier) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

How many sign-in attempts one ACCOUNT may receive per minute, combined across every source address — separate from the per-device limit above. Guards against a distributed attempt to guess one person's password.

• Default when unset: 20 (or whatever was last saved from the settings screen)

LOOMBRE_RATE_REFRESH_BY_DEVICE

Pins Refresh By Device (rateLimit.refreshByDevice) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

How many session-refresh requests one signed-in device may receive per minute, combined across every source address — separate from the per-device limit above. Guards against a distributed attempt to overwhelm one device's session renewal.

• Default when unset: 40 (or whatever was last saved from the settings screen)

LOOMBRE_RATE_SEARCH

Pins Search (rateLimit.search) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

How many search requests one person may make per minute — this covers both regular search and restricted-content search. Each search does some extra work behind the scenes, so this keeps that from being abused while staying generous enough for normal typing.

• Technical details: Shared by GET /search and GET /restricted/search, one bucket across both routes (the same sharing pattern rateLimit.mediaToken uses for its own route family). The generous ceiling exists because each request does an extra per-result detail lookup, so ordinary typeahead-style bursts must not trip it.
• Default when unset: 60 (or whatever was last saved from the settings screen)

LOOMBRE_PUBLIC_URL

Pins Public web address (network.publicUrl) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

The web address people use to reach this server from outside your own network (for example, https://myserver.example.com). Any link Loombre sends by email — invitations, password resets — is built only from this address, so it's never guessed from wherever a request happened to come from. Leave this blank and Loombre will not send mail that contains a link.

• Technical details: Must be empty, or an absolute http:// or https:// URL. This is the sole source for every security-sensitive link a piece of outgoing mail can ever contain — never derived from an incoming request's Host header.
• Default when unset: (empty — not set) (or whatever was last saved from the settings screen)

LOOMBRE_SMTP_HOST

Pins Mail server address (mail.smtpHost) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

The address of the outgoing mail server Loombre sends email through. Leave blank to leave mail sending turned off.

• Technical details: Your SMTP provider's hostname (e.g. smtp.mailprovider.com) — check your provider's setup page for the exact value. No username or password lives here: SMTP credentials, if the server requires them, are stored separately and encrypted; an unauthenticated relay on a private network is also a legal configuration with this field set and no credentials at all.
• Default when unset: (empty — not set) (or whatever was last saved from the settings screen)

LOOMBRE_SMTP_PORT

Pins Mail server port (mail.smtpPort) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

Which door on your mail provider's server Loombre connects to when sending email. Your provider's setup page lists it; 587 is the most common.

• Technical details: SMTP submission port. 587 = STARTTLS submission (recommended), 465 = implicit TLS, 25 = server-to-server relay, usually blocked for clients from outside their own network.
• Default when unset: 587 (or whatever was last saved from the settings screen)

LOOMBRE_SMTP_SECURITY

Pins Mail connection security (mail.smtpSecurity) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

How the connection to your mail server is protected. 'starttls' connects in the open and switches to an encrypted connection partway through (the most common choice); 'implicit-tls' is encrypted from the very first byte; 'none' is a plain, unencrypted connection with no protection at all.

• Technical details: 'starttls' pairs with port 587 (STARTTLS submission); 'implicit-tls' pairs with port 465 (TLS from connection open) — see mail.smtpPort's own technical notes.
• Default when unset: starttls (or whatever was last saved from the settings screen)
• Caution: Choosing 'none' sends your mail server password and every email in plain, readable text over the network — only use this for a private network relay you control, never for a mail server reached over the internet.

LOOMBRE_SMTP_FROM_ADDRESS

Pins From address (mail.fromAddress) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

The email address your outgoing mail appears to come from. Leave blank to leave mail sending turned off.

• Technical details: Must be empty or a syntactically valid email address — Loombre does not verify deliverability at save time; your first real send attempt is the only genuine test of whether the address actually works.
• Default when unset: (empty — not set) (or whatever was last saved from the settings screen)

LOOMBRE_SMTP_FROM_NAME

Pins From name (mail.fromName) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

The display name shown alongside the from-address on outgoing mail.

• Default when unset: Loombre (or whatever was last saved from the settings screen)

LOOMBRE_WG_PORT

Pins WireGuard listener port (remote.wireguardPort) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

Which network port Loombre Remote uses for its secure tunnel connections. A change only takes effect after a server restart (the port cannot be switched while the server is running), and the restart disconnects remote devices until they reconnect.

• Technical details: UDP port the in-process WireGuard listener binds to for its whole lifetime. Cannot be rebound to a different port while the server is running, hence the restart requirement.
• Default when unset: 51820 (or whatever was last saved from the settings screen)

LOOMBRE_WG_SUBNET

Pins Remote-access tunnel subnet (remote.subnet) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

The private range of addresses Loombre Remote assigns to your server and its enrolled devices for their secure tunnel connections — the server takes the first address, and each device gets the next free one. Changing this requires a server restart, and orphans any already-enrolled devices, since their addresses came from the old range.

• Technical details: An IPv4 CIDR block (e.g. 10.82.146.0/24), prefix length between /8 and /30. Server = the first usable address (.1 in a /24); devices are allocated the lowest-free address from the remaining usable range.
• Default when unset: 10.82.146.0/24 (or whatever was last saved from the settings screen)
• Caution: Avoid 100.64.0.0/10 (CGNAT space) — other VPN tools commonly use it, and a device running both could collide.

LOOMBRE_WG_ENDPOINT_HOST

Pins WireGuard public endpoint (remote.wireguardEndpointHost) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

The public address (hostname or IP) devices should connect to in order to reach this server through Loombre Remote — written into each device's configuration when it's enrolled. Leave this blank until you know this server's public address.

• Technical details: Combined with the WireGuard port setting above to form each newly enrolled device's endpoint address; already-enrolled devices are not updated retroactively when this changes.
• Default when unset: (empty — not set) (or whatever was last saved from the settings screen)

LOOMBRE_CLOUDFLARED_PATH

Pins Cloudflare tunnel binary path (remote.cloudflaredPath) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

Where to find the cloudflared program, if Loombre can't locate it automatically. Loombre does not install this program itself — install it yourself, then point this setting at it if auto-detect fails. Leave blank to let Loombre look for it automatically.

• Technical details: Explicit path to the cloudflared binary, used when it is not resolvable via the server's PATH.
• Default when unset: (empty — not set) (or whatever was last saved from the settings screen)

LOOMBRE_TUNNEL_HOSTNAME

Pins Tunnel public hostname (remote.tunnelHostname) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

The public web address the Tunnel connection method routes through. Loombre sets this automatically when you turn on the Tunnel option in the setup wizard; you can edit it here afterward.

• Default when unset: (empty — not set) (or whatever was last saved from the settings screen)

LOOMBRE_TLS_MODE

Pins TLS mode (tls.mode) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

How Loombre handles HTTPS: 'off' serves plain HTTP (the right choice when a reverse proxy in front of Loombre handles HTTPS itself), 'manual' uses a certificate and key file you provide yourself, and 'acme' has Loombre request and automatically renew its own certificate from Let's Encrypt (or another compatible certificate authority) using the domain and verification settings below.

• Technical details: ACME issuance uses the domain(s) in tls.acmeDomains, the challenge method in tls.acmeChallengeType, and requires tls.acmeTosAgreed to be true. Resolved once at server boot, not re-read from a live process — that's why a mode change needs a restart to take effect.
• Default when unset: off (or whatever was last saved from the settings screen)

LOOMBRE_ACME_DOMAINS

Pins Certificate domain name(s) (tls.acmeDomains) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

The domain name(s) this server requests an HTTPS certificate for when TLS mode is 'acme' — the address people use to reach it from outside your network (for example media.example.com). The first one becomes the certificate's primary name.

• Technical details: Must be real domain names, not IP addresses — a bare IP address or a value with no dot is rejected before it's ever saved. Real issuance validity is ultimately decided by the certificate authority's own request at the time TLS mode 'acme' takes effect.
• Default when unset: (none) (or whatever was last saved from the settings screen)

LOOMBRE_ACME_CHALLENGE_TYPE

Pins Certificate verification method (tls.acmeChallengeType) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

How Loombre proves it controls the domain above, to get a certificate for it: 'http-01' answers a request on port 80 (simplest, when that port is reachable from the internet), 'dns-01' creates a temporary DNS record instead (works even with no reachable inbound port, and is required for a wildcard certificate).

• Default when unset: http-01 (or whatever was last saved from the settings screen)

LOOMBRE_ACME_TOS_AGREED

Pins Accept certificate authority Terms of Service (tls.acmeTosAgreed) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

Confirms you accept the certificate authority's Terms of Service on this server's behalf — required before Loombre will request a certificate automatically. Loombre never agrees on your behalf silently; this must be turned on explicitly.

• Default when unset: Off (or whatever was last saved from the settings screen)

LOOMBRE_TRUST_PROXY

Pins Trust proxy (network.trustProxy) to a fixed value — set this and the admin settings screen shows the setting as controlled by the environment, read-only; any value stored from the settings screen is preserved but ignored until the variable is unset again.

Tells Loombre it's running behind a reverse proxy you control, so it can trust that proxy's information about which address a request really came from — used for rate-limiting and the sign-in log. Leave this blank unless you are running Loombre behind your own reverse proxy.

• Technical details: Accepts a hop count (e.g. "1"), a trusted IP address or CIDR range, or a comma-separated list of them.
• Default when unset: (empty — not set) (or whatever was last saved from the settings screen)
• Caution: Only enable behind a reverse proxy you control — enabling this trusts client-supplied forwarded-address information for rate-limit and sign-in-log keying.

Secrets and other bootstrap variables not in this list

This page covers only registry-backed settings. The operational variables below live outside the registry. The first group is derived mechanically at generation time from the Docker Compose distribution's own surface (installers/docker/loombre.env.example plus docker-compose.prod.yml's ${VAR} interpolations), minus everything the registry sections above already cover — so it always matches what that distribution actually reads:

• POSTGRES_PASSWORD — secret — the Compose Postgres container's superuser password (required; the compose file refuses to start without it).
• POSTGRES_DB — the Compose Postgres container's database name (default loombre).
• POSTGRES_USER — the Compose Postgres container's role name (default loombre).
• LOOMBRE_JWT_SECRET — secret — signs Loombre's auth tokens (required under Compose).
• LOOMBRE_PORT — Compose interpolation alias: sets the server container's PORT (default 3001) — PORT itself is a registry variable covered above.
• LOOMBRE_WEB_PORT — the web UI service's own port (default 3000 — read by the web process, not the server/worker; see systemd and each platform's Install page).
• LOOMBRE_SERVER_ORIGIN — where the web process reaches the server's API (Compose default: the server container's own address).
• LOOMBRE_WEB_URL — the web UI URL the server uses for links and its CORS default (Compose default: http://localhost:<LOOMBRE_WEB_PORT>).
• LOOMBRE_TIER — performance tier 0/1/2 (docs/PLAN.md §9.1); unset means Tier 0 — there is no autodetection — which refuses processor HDR tone-mapping at 1080p and above; set 2 on desktop/server-class hosts.
• LOOMBRE_ALLOW_TRANSCODE — transcode kill-switch.
• LOOMBRE_MAX_STREAM_BITRATE — per-stream bitrate ceiling.
• LOOMBRE_TRANSCODE_POLL_MS — worker transcode job-queue poll interval, in milliseconds.
• LOOMBRE_SCAN_POLL — forces the library watcher's polling backend on (1) or off (0) for every watched path, overriding both automatic rules: network mounts (macOS /Volumes/<non-boot disk>) poll, and on macOS so does any library under a privacy-protected folder (Desktop, Documents, Downloads, iCloud Drive, a Photos library) — polling watches with stat and never performs the FSEvents open that macOS holds on a consent prompt. It does not lift the protection: a folder that exists but is not yet granted is still listed once at start-up, which holds one libuv threadpool slot until the prompt is answered, so grant Full Disk Access to the runtime binary or keep media outside those folders (see the macOS install guide). 0 is the escape hatch for a Mac with that grant in place; 1 for a Linux NFS/CIFS library. See docs/install/docker.md's media-library notes.
• LOOMBRE_TMDB_API_KEY — metadata-provider key (TMDB).
• LOOMBRE_TVDB_API_KEY — metadata-provider key (TVDB).
• LOOMBRE_SMTP_USERNAME — half of the SMTP AUTH credential pair — keyring-class secret, not a registry setting like the LOOMBRE_SMTP_* pins above; set BOTH or NEITHER, and while set the admin Mail screen's credentials card is read-only — see the Admin Guide's Mail page.
• LOOMBRE_SMTP_PASSWORD — the other half of the SMTP AUTH credential pair — same rules as LOOMBRE_SMTP_USERNAME.
• COMPOSE_PROJECT_NAME — Compose stack plumbing (project name) — interpolation-only, never seen by Loombre processes.
• LOOMBRE_IMAGE — Compose stack plumbing (server/worker image override) — interpolation-only, never seen by Loombre processes.
• LOOMBRE_WEB_IMAGE — Compose stack plumbing (web image override) — interpolation-only, never seen by Loombre processes.

Beyond the Compose surface, the server/worker also read directly from the environment: worker transcode tuning read directly from the environment (LOOMBRE_TRANSCODE_MAX_SUSPEND_MS, LOOMBRE_TRANSCODE_RUNG_SWITCH_COOLDOWN_MS, LOOMBRE_TRANSCODE_COPY_READRATE and its burst-window companion LOOMBRE_TRANSCODE_COPY_READRATE_BURST_SEC); the update-check manifest mirror (LOOMBRE_UPDATE_MANIFEST_URL — see Updating Loombre; its companion LOOMBRE_UPDATE_CHECK IS covered above, as a registry pin); TLS/ACME companions not already covered by the registry pins above (LOOMBRE_TLS_CERT_PATH/KEY_PATH, LOOMBRE_HTTP_PORT/LOOMBRE_HTTPS_PORT, LOOMBRE_ACME_EMAIL, LOOMBRE_ACME_DIRECTORY_URL, LOOMBRE_ACME_STAGING, LOOMBRE_ACME_DNS_HOOK and its propagation-timeout companion, LOOMBRE_ACME_CA_BUNDLE, LOOMBRE_ACME_RENEW_WINDOW_DAYS/RENEW_CHECK_INTERVAL_MS — see docs/ops/remote-access/acme.md; LOOMBRE_ACME_DOMAINS/CHALLENGE_TYPE/TOS_AGREED ARE covered above, as registry pins); IPC and logging (LOOMBRE_IPC_*, LOOMBRE_LOG_FILE — every install shape (macOS pkg, Windows MSI, Docker, Linux packages/tarball) sets the log file automatically to a real, already-populated path so the admin Dashboard's log-tail card works out of the box; see each platform's own Install page for the exact path, or override it yourself); embedded-PG plumbing (LOOMBRE_EMBEDDED_PG_*). The full, accurate, hand-maintained list of every variable Loombre's Docker Compose distribution reads lives in installers/docker/loombre.env.example; docs/install/docker.md walks the two you cannot skip.