Complete .env reference

This reference separates installation, security, database, demo, integration, and QA variables. It is based on .env.example, .env.demo.example, the project Compose files, and variables found in the code.

General rule:

• If a variable contains a token, password, secret, API key, or credential, treat it as a secret.
• Do not commit .env to Git.
• Do not paste the complete .env in tickets, public chats, or screenshots.

Main variables

Variable	Documented default	Required	Security	Use
COMPOSE_PROJECT_NAME	plexsub	No	No	Docker Compose project name.
PORT	5000	No	No	Port published to the host.
APP_IMAGE_REF	Image GHCR fijada by digest en .env.example	Yes in production	Medium	PlexSub image to run; pin it by digest.
PLEXSUB_POSTGRES_IMAGE_REF	postgres:18.4-alpine pinned by digest	Yes in production	Medium	PostgreSQL image; do not change major version without a controlled migration.
APP_BASE_URL	https://plexsub.example.com	Yes in production	High	Actual public PlexSub URL; affects links, cookies, and publishing.
APP_TIMEZONE	Europe/Madrid	No	No	Application timezone.
NODE_ENV	production in Compose	Yes in production	Medium	Runtime mode.
PLEXSUB_VERSION	Not set en .env.example	No	No	Informational runtime version when injected.

Database

Variable	Documented default	Required	Security	Use
POSTGRES_DB	plexsub	Yes	No	Database name.
POSTGRES_USER	plexsub_app_replace_me	Yes	Medium	PostgreSQL user; change the sample value.
POSTGRES_PASSWORD	Empty in .env.example	Yes	High	PostgreSQL password; keep it strong and private.
DATABASE_URL	Generada by docker-compose.example.yml	Yes for the app	High	Connection string used by PlexSub.
DB_CONNECT_RETRIES	15	No	No	Database connection retries.
DB_CONNECT_RETRY_DELAY_MS	4000	No	No	Delay between retries in milliseconds.
DRIZZLE_BASELINE_ADOPT	Not documented	No	Medium	Internal migration setting; do not enable without specific technical guidance.

Application security

Variable	Documented default	Required	Security	Use
APP_SETTINGS_ENCRYPTION_KEY	replace_with_generated_service_settings_key	Yes	High	Encrypts service credentials stored in the database; do not lose it.
SESSION_SIGNING_SECRET	Empty in .env.example	Yes	High	Signs sessions; use a strong secret.
PLEXSUB_SETUP_TOKEN	Empty in .env.example	Recommended	High	Startup/setup token, when used.
TRUST_PROXY_LEVEL	0	No	Medium	Number of trusted proxies; use 1 only behind a controlled proxy.
FORCE_SECURE_COOKIES	1	Yes for HTTPS	High	Forces secure cookies; keep enabled for HTTPS publishing.
PLEXSUB_ALLOW_PRIVATE_TARGETS	0	No	High	Allows private/local integration targets; keep 0 except for a controlled need.
SESSION_TIMEOUT_HOURS	24 in code	No	Medium	Session duration.
LOGIN_MAX_FAILED_ATTEMPTS	5 in code	No	Medium	Failed attempts before lockout.
LOGIN_LOCKOUT_MINUTES	15 in code	No	Medium	Lockout duration.
RATE_LIMIT_LOGIN_WINDOW_MS	300000 in code	No	Medium	Login rate-limit window.
RATE_LIMIT_LOGIN_MAX	10 in code	No	Medium	Maximum attempts per login window.
RATE_LIMIT_OWNER_BOOTSTRAP_WINDOW_MS	Not documented	No	Medium	Owner-bootstrap rate-limit window.
RATE_LIMIT_OWNER_BOOTSTRAP_MAX	Not documented	No	Medium	Owner-bootstrap maximum.
RATE_LIMIT_PASSWORD_RESET_WINDOW_MS	Not documented	No	Medium	Password-reset rate-limit window.
RATE_LIMIT_PASSWORD_RESET_MAX	Not documented	No	Medium	Maximum password resets per window.
API_LOG_MAX_CHARS	220 in code	No	Medium	Maximum API log-line length.

Public demo

Variable	Documented default	Required	Security	Use
DEMO_PORT	5001	No	No	Local demo port.
PLEXSUB_DEMO_MODE	1 in demo Compose	Yes for demo	Medium	Enables Demo Mode.
PLEXSUB_DEMO_PUBLIC	1 in demo Compose	Yes for public demo	High	Marks a public demo; use only with the full secure demo profile.
PLEXSUB_DEMO_FAKE_DATA	1 in demo Compose	Yes for public demo	Medium	Uses fake data.
PLEXSUB_DEMO_SIMULATED_SERVICES	1 in demo Compose	Yes for public demo	Medium	Simulates external services.
PLEXSUB_DEMO_RESET	1 in demo Compose	Yes for public demo	Medium	Allows demo-data reset.
PLEXSUB_DEMO_ALLOW_REMOTE	Not documented	No	High	Do not enable remote demo access without specific guidance.
ADMIN_EMAIL	[email protected] en demo	Demo only	Medium	Public demo user by design.
ADMIN_PASSWORD	demo123 en demo	Demo only	High	Public demo password; never use in production.

Media-server integrations

Variable	Documented default	Required	Security	Use
PLEX_SERVER_URL	Not set	Only if you use Plex	Medium	URL for Plex Server.
PLEX_TOKEN	Not set	Only if you use Plex	High	Token for Plex.
PLEX_ALLOWED_LIBRARIES	Not set	No	Medium	Configuration for Plex Allowed Libraries.
JELLYFIN_URL	Not set	Only if you use Jellyfin	Medium	URL for Jellyfin.
JELLYFIN_API_KEY	Not set	Only if you use Jellyfin	High	API key for Jellyfin.
JELLYFIN_TOKEN	Not set	Only if you use Jellyfin	High	Token for Jellyfin.
EMBY_URL	Not set	Only if you use Emby	Medium	URL for Emby.
EMBY_API_KEY	Not set	Only if you use Emby	High	API key for Emby.
EMBY_TOKEN	Not set	Only if you use Emby	High	Token for Emby.

Requests, metadata, and Arr services

Variable	Documented default	Required	Security	Use
OVERSEERR_URL	Not set	Only if you use Seerr	Medium	URL for Overseerr.
OVERSEERR_API_KEY	Not set	Only if you use Seerr	High	API key for Overseerr.
OVERSEERR_WEBHOOK_SECRET	Not set	No	High	Configuration for Overseerr Webhook Secret.
OVERSEERR_AUTO_CREATE_USERS	Not set	No	Medium	Configuration for Overseerr Auto Create Users.
OVERSEERR_DEFAULT_PERMISSIONS	Not set	No	Medium	Configuration for Overseerr Default Permissions.
RADARR_URL	Not set	Only if you use Radarr	Medium	URL for Radarr.
SONARR_URL	Not set	Only if you use Sonarr	Medium	URL for Sonarr.
LIDARR_URL	Not set	Only if you use Lidarr	Medium	URL for Lidarr.
READARR_URL	Not set	Only if you use Readarr	Medium	URL for Readarr.
PLEXSUB_TMDB_API_KEY	Not set	Provider-dependent	High	API key for Plexsub Tmdb.
TMDB_API_KEY	Not set	Provider-dependent	High	API key for Tmdb.
PLEXSUB_LASTFM_API_KEY	Not set	Provider-dependent	High	API key for Plexsub Lastfm.
LASTFM_API_KEY	Not set	Provider-dependent	High	API key for Lastfm.
PLEXSUB_REQUESTS_METADATA_PROVIDER	Not set	No	Medium	Configuration for Plexsub Requests Metadata Provider.
PLEXSUB_REQUESTS_TV_METADATA_PROVIDER	Not set	No	Medium	Configuration for Plexsub Requests Tv Metadata Provider.
PLEXSUB_REQUESTS_MUSIC_METADATA_PROVIDER	Not set	No	Medium	Configuration for Plexsub Requests Music Metadata Provider.
REQUEST_USAGE_RESET_TIMEZONE	Not set	No	No	Configuration for Request Usage Reset Timezone.

Downloads, subtitles, indexers, and analytics

Variable	Documented default	Required	Security	Use
QBITTORRENT_URL	Not set	Only if you use qBittorrent	Medium	URL for Qbittorrent.
QBITTORRENT_USERNAME	Not set	Only if you use qBittorrent	High	Username for Qbittorrent.
QBITTORRENT_PASSWORD	Not set	Only if you use qBittorrent	High	Password for Qbittorrent.
BAZARR_URL	Not set	Only if you use Bazarr	Medium	URL for Bazarr.
BAZARR_API_KEY	Not set	Only if you use Bazarr	High	API key for Bazarr.
TAUTULLI_URL	Not set	Only if you use Tautulli	Medium	URL for Tautulli.
TAUTULLI_API_KEY	Not set	Only if you use Tautulli	High	API key for Tautulli.
MAINTAINERR_URL	Not set	Only if you use Maintainerr	Medium	URL for Maintainerr.
TRACEARR_URL	Not set	Only if you use Tracearr	Medium	URL for Tracearr.
TRACEARR_API_KEY	Not set	Only if you use Tracearr	High	API key for Tracearr.
TRACEARR_SCAN_PAGE_SIZE	Not documented	No	No	Configuration for Tracearr Scan Page Size.
TRACEARR_SCAN_MAX_PAGES	Not documented	No	No	Configuration for Tracearr Scan Max Pages.
TRACEARR_HISTORY_SCAN_MAX_PAGES	Not documented	No	No	Configuration for Tracearr History Scan Max Pages.
JELLYSTAT_URL	Not set	Only if you use Jellystat	Medium	URL for Jellystat.
JELLYSTAT_API_KEY	Not set	Only if you use Jellystat	High	API key for Jellystat.
JELLYSTAT_TOKEN	Not set	Only if you use Jellystat	High	Token for Jellystat.
PROWLARR_URL	Not set	Only if you use Prowlarr	Medium	URL for Prowlarr.
PROWLARR_API_KEY	Not set	Only if you use Prowlarr	High	API key for Prowlarr.
JACKETT_URL	Not set	Only if you use Jackett	Medium	URL for Jackett.
JACKETT_API_KEY	Not set	Only if you use Jackett	High	API key for Jackett.
TRANSMISSION_URL	Not set	Only if you use Transmission	Medium	URL for Transmission.
TRANSMISSION_USERNAME	Not set	Only if you use Transmission	High	Username for Transmission.
TRANSMISSION_PASSWORD	Not set	Only if you use Transmission	High	Password for Transmission.
DELUGE_URL	Not set	Only if you use Deluge	Medium	URL for Deluge.
DELUGE_USERNAME	Not set	Only if you use Deluge	High	Username for Deluge.
DELUGE_PASSWORD	Not set	Only if you use Deluge	High	Password for Deluge.

Payments, email, and notifications

Variable	Documented default	Required	Security	Use
KOFI_WEBHOOK_VERIFICATION_TOKEN	Not set	Only if you use Ko-fi	High	Token for Kofi Webhook Verification.
SMTP_HOST	Not set	Only if you use correo	Medium	Configuration for Smtp Host.
SMTP_PORT	Not set	Only if you use correo	Medium	Configuration for Smtp Port.
SMTP_SECURE	Not set	No	Medium	Configuration for Smtp Secure.
SMTP_USER	Not set	Provider-dependent	High	Configuration for Smtp User.
SMTP_PASS	Not set	Provider-dependent	High	Password for Smtp.
SMTP_FROM	Not set	Recommended	Medium	Configuration for Smtp From.
SMTP_REPLY_TO	Not set	No	Medium	Configuration for Smtp Reply To.
WEB_PUSH_VAPID_PUBLIC_KEY	Not set	Web Push only	Medium	Configuration for Web Push Vapid Public Key.
WEB_PUSH_VAPID_PRIVATE_KEY	Not set	Web Push only	High	Configuration for Web Push Vapid Private Key.
WEB_PUSH_VAPID_SUBJECT	Not set	Web Push only	Medium	Configuration for Web Push Vapid Subject.

Paused modules

Variable	Documented default	Required	Security	Use
PLEXSUB_NATIVE_REQUESTS_MODULE_PAUSED	Not set	No	Medium	Pauses the Native Requests module.
PLEXSUB_NATIVE_INVITATIONS_MODULE_PAUSED	Not set	No	Medium	Pauses the Native Invitations module.
PLEXSUB_WIZARR_MODULE_PAUSED	Not set	No	Medium	Pauses the Wizarr module.
PLEXSUB_SMTP_MODULE_PAUSED	Not set	No	Medium	Pauses the Smtp module.
PLEXSUB_KNOWLEDGE_BASE_MODULE_PAUSED	Not set	No	Medium	Pauses the Knowledge Base module.

QA, development, or test variables

These variables appear in code or scripts, but are not part of normal user configuration:

QA_BASE_URL, QA_DEBUG, QA_JELLYFIN_CONFIGURED, QA_SERVICE, QA_STANDALONE, QA_VIEWPORT, ESLINT_MAX_WARNINGS, MOCK_JELLY_HOST, MOCK_JELLYFIN_PORT, MOCK_JELLYFIN_TOKEN, MOCK_JELLYSTAT_PORT, MOCK_JELLYSTAT_TOKEN, CONFIRM_DROP_TEMPORARY_PASSWORD, ALLOW_LEGACY_POSTGRES_PASSWORD_SETTINGS_KEY, CUSTOMER_INCIDENT_ATTACHMENT_MAX_TOTAL_BYTES, RATE_LIMIT_BRANDING_MEDIA_IMAGE_MAX, RATE_LIMIT_BRANDING_MEDIA_IMAGE_WINDOW_MS, PLEXSUB_MEDIA_IMAGE_CACHE_DIR, PLEXSUB_LOCALE.

Do not use them in production unless specific technical guidance says otherwise.