Environment Variables Reference

Secret of at least 64 characters that signs and encrypts sessions. Unless you set DATA_ENCRYPTION_KEY (below), it also derives the key that encrypts integration credentials at rest, so rotating it would make stored credentials undecryptable. Generate one with the command in the example. On Cloudron it is generated automatically.

Default: none  ·  Example: openssl rand -base64 64 | tr -d '\n'

Dedicated key for encrypting integration credentials at rest, independent of SECRET_KEY_BASE. Setting it lets you rotate SECRET_KEY_BASE without breaking stored credentials. The value must be Base64 that decodes to at least 32 bytes, and must never change once set. On Cloudron it is generated automatically. See the Data-at-Rest Encryption guide for migration steps.

Default: derived from SECRET_KEY_BASE  ·  Example: openssl rand -base64 48 | tr -d '\n'

Your domain name without the protocol prefix. It sets the host of every generated link, including the ones in password reset and verification emails, and the origin allowed to open WebSocket connections. On Cloudron it defaults to the app's domain. A development server (mix phx.server) reads it too, falling back to localhost when it is unset.

Default: none  ·  Example: tymeslot.yourdomain.com

HTTP port the application server listens on. The Railway image sets it to 8080.

Default: 4000  ·  Example: 4000

Deployment variant: cloudron or docker. It selects where database settings are read from, the WebSocket origins, the URL scheme and mail auto-detection. Any value other than cloudron, including unset, means docker, which also covers Railway and bare releases. The official images set it for you.

Default: docker  ·  Example: docker

Set to false to stop new users signing up on this instance. Leave it unset to switch it from the admin UI instead, without a restart. While the variable holds a recognised value (here true or false) it takes precedence, and the admin UI shows the setting greyed out. Any other value, such as 1, does not take precedence: the admin UI can still change the setting, and Tymeslot logs a warning at startup naming the variable. The same applies to every variable on this page that the admin UI can manage. If registration is closed and no accounts are left, the admin setup guide's "No accounts left and registration closed" section shows how to get back in.

Default: true  ·  Example: false

Set to false to turn off email and password login. The login form, sign-up page and password reset flow are hidden, so users can only sign in with OAuth. Use it for SSO-only deployments where everyone authenticates through an identity provider. Leave it unset to switch it from the admin UI instead. Accepts true or false; while it holds one of those, it takes precedence.

Default: true  ·  Example: false

IP address the HTTP server binds to. The default, ::, listens on all interfaces over IPv4 and IPv6 on dual-stack hosts. Use 0.0.0.0 on an IPv4-only host.

Default: ::  ·  Example: 0.0.0.0

Scheme used in generated URLs. Keep https in production; with it, links carry no port suffix. Cloudron always uses https and ignores this variable. A development server defaults to http on the listen port instead; setting this to https there tells it the proxy terminates TLS on the standard port, so generated links carry no port suffix.

Default: https  ·  Example: https

Comma-separated list of origins allowed to open WebSocket connections, each with its scheme: a bare hostname is rejected. Unset, it allows PHX_HOST over http and https, plus localhost:4000. Setting it replaces that list. Cloudron ignores it.

Default: derived from PHX_HOST  ·  Example: https://tymeslot.yourdomain.com,https://app.example.com

Full PostgreSQL connection string. Its host, port, database, user and password take precedence over the discrete variables below. When it names a remote host the Docker container skips its bundled database; a URL pointing at localhost keeps using it.

Default: unset  ·  Example: postgres://user:pass@db.example.com:5432/tymeslot

TLS for the database connection. true (or verify-full) encrypts and verifies the server certificate and hostname; verify-none encrypts without verifying; false turns TLS off. Unset, an sslmode parameter in DATABASE_URL decides. Managed providers such as RDS, Neon and Supabase generally require TLS.

Default: unset  ·  Example: true

CA bundle used to verify the database certificate, for providers with a private CA. Read only when TLS verification is on; without it, the system trust store is used. Keep the file on the /app/data volume so it survives upgrades. Tymeslot refuses to start if the file does not exist.

Default: unset  ·  Example: /app/data/rds-ca-bundle.pem

PostgreSQL server hostname. In the Docker image, any value other than localhost or 127.0.0.1 switches to an external database.

Default: localhost  ·  Example: db.internal

PostgreSQL server port.

Default: 5432  ·  Example: 5432

Database name.

Default: tymeslot  ·  Example: tymeslot

Database user.

Default: tymeslot  ·  Example: tymeslot

Database password. The Docker image's bundled database falls back to tymeslot, which is safe because that database is reachable only inside the container. Set a strong one for an external database, and in docker-compose.with-postgres.yml, which refuses to start without it. Not needed when DATABASE_URL is set, since the URL carries the password. Outside the Docker image, Tymeslot refuses to start without one or the other.

Default: tymeslot (Docker image)  ·  Example: a_secure_password

Number of PostgreSQL connections Tymeslot keeps open. The Docker image defaults to 10; Cloudron, Railway and bare releases default to 60. Keep it below your server's max_connections.

Default: 10 (Docker), 60 (other)  ·  Example: 20

Set to true (or false) to show or hide the Google button on the login and sign-up pages. Leave it unset to switch it from the admin UI instead; while it is set to one of those, it takes precedence.

Default: false  ·  Example: true

Required for Google Login, Google Calendar and Google Meet. OAuth client ID from Google Cloud Console.

Default: none  ·  Example: 123456-abc.apps.googleusercontent.com

Required for every Google feature. OAuth client secret from Google Cloud Console.

Default: none  ·  Example: GOCSPX-your-secret

Required for Google Calendar and Google Meet. Random secret that signs the OAuth state parameter to block cross-site request forgery.

Default: none  ·  Example: openssl rand -hex 32

Required for Outlook Calendar and Microsoft Teams. The Azure app's Application (client) ID.

Default: none  ·  Example: your-azure-app-client-id

Required for Outlook Calendar and Microsoft Teams. The Azure app's client secret value.

Default: none  ·  Example: your-client-secret-value

Required for Outlook Calendar and Microsoft Teams. Random secret that signs the OAuth state parameter to block cross-site request forgery.

Default: none  ·  Example: openssl rand -hex 32

Required to use Zoom. Marketplace app Client ID.

Default: none  ·  Example: your-zoom-client-id

Required to use Zoom. Marketplace app Client Secret.

Default: none  ·  Example: your-zoom-client-secret

Required to use Zoom. Random secret that signs the OAuth state parameter to block cross-site request forgery.

Default: none  ·  Example: openssl rand -hex 32

Required to use Zoom. The Marketplace app's Secret Token, used to verify the HMAC-SHA256 signature on the deauthorisation webhook Zoom posts to /auth/zoom/deauthorize. Find it under Features → Deauthorization Notification in the Marketplace app.

Default: none  ·  Example: <marketplace secret token>

Requests the meeting:update:meeting scope so a rescheduled booking moves its Zoom meeting. Set to false only if your Zoom app lacks that scope; users are then not asked to reconnect for it, and the Zoom meeting keeps its original time.

Default: true  ·  Example: false

Days after a meeting ends before Tymeslot deletes its video room, for providers whose rooms otherwise stay on the organiser's server (Nextcloud Talk). A cancelled booking's room is deleted straight away. It must be a whole number of 1 or more, or Tymeslot refuses to start. The daily clean-up looks back 30 days past this period, so lowering it by more than 30 at once leaves the rooms of meetings that ended before the new window in place.

Default: 7  ·  Example: 14

Public HTTPS base URL that Google and Microsoft call back to for real-time calendar change notifications (Google push channels and Outlook Graph subscriptions). Usually the same as your PHX_HOST with an https:// prefix: scheme and host only, with no trailing slash or path.

When unset, calendar sync falls back to polling every 15 minutes, which works but is not instant. Set it only when the host is reachable from the public internet over HTTPS: providers run a validation handshake against the URL when a subscription is registered, so leave it unset on localhost, private-network and NAT deployments. Existing calendar connections adopt push when their owner reconnects; new connections register automatically.

Default: none (polling fallback)  ·  Example: https://tymeslot.yourdomain.com

Turns on meeting payments: the payments dashboard and the per-meeting-type payment toggle. Your instance must be registered as a Stripe Connect platform; see the Stripe Payments Setup guide . Accepts true, 1, yes, false, 0 or no, in any case. Leave it unset to switch it from the admin UI instead; while it is set to one of those, it takes precedence.

Default: false  ·  Example: true

Your platform's Stripe secret key. Required when MEETING_PAYMENTS_ENABLED=true; the webhook secret below is read only when this is set.

Default: unset  ·  Example: sk_live_51...

Signing secret of the Connect webhook endpoint (/webhooks/stripe/connect) that receives connected-account events. Required to verify checkout, refund and dispute events for meeting payments.

Default: unset  ·  Example: whsec_...

Optional platform fee in basis points (100 = 1%), taken from each charge. The default of 0 takes no cut. Accepts 0 to 10000; any other value stops the app at startup.

Default: 0  ·  Example: 100

Set to true (or false) to show or hide the GitHub button on the login and sign-up pages. Leave it unset to switch it from the admin UI instead; while it is set to one of those, it takes precedence.

Default: false  ·  Example: true

Required for GitHub Login. OAuth app client ID from GitHub's Developer settings.

Default: none  ·  Example: your_client_id

Required for GitHub Login. OAuth app client secret.

Default: none  ·  Example: your_client_secret

Set to true to show an SSO button on the login page. When it is on, Tymeslot refuses to start unless the client ID, client secret and the three endpoint URLs below are set. Accepts only true or false; any other value stops Tymeslot from starting. Leave it unset to switch it from the admin UI instead; while it is set, it takes precedence.

Default: false  ·  Example: true

OAuth 2.0 client ID registered with your identity provider.

Default: none  ·  Example: tymeslot

OAuth 2.0 client secret from your identity provider.

Default: none  ·  Example: your-client-secret

Base URL of your identity provider. Needed only when an endpoint below is given as a relative path (such as /token), which is resolved against it.

Default: none  ·  Example: https://idp.example.com

Authorisation endpoint. Must use HTTPS, or be a path relative to OAUTH_PROVIDER_URL.

Default: none  ·  Example: https://idp.example.com/authorize

Token endpoint. Must use HTTPS, or be a relative path.

Default: none  ·  Example: https://idp.example.com/token

Userinfo endpoint. Must use HTTPS, or be a relative path. It must return a JSON object with a sub claim (or id/user_id if OAUTH_ALLOW_ID_FALLBACK is enabled).

Default: none  ·  Example: https://idp.example.com/userinfo

Space-separated list of OAuth scopes to request.

Default: openid email profile  ·  Example: openid email profile groups

Set to true to accept id or user_id claims when the IdP does not return a standard sub claim. Enable it only for non-OIDC providers.

Default: false  ·  Example: true

How far to trust the IdP's email_verified claim. trust_absent trusts an email sent without the claim (many IdPs omit it) but not one marked false. require trusts only emails marked true; other users confirm theirs by email. ignore trusts every email the IdP returns, for IdPs that mark addresses they manage themselves as unverified.

Default: trust_absent  ·  Example: require