Complete Environment Variables Overview (.env reference)
Below is an overview of the environment variables you can configure in LockMyCal. Optional variables have sensible defaults – set only what you need.
Important
Since version 1.15.7 the values in .env are read literally: ${VAR} and $(command) are not expanded, and a # character that is not preceded by a space is part of the value.
1. Basic Application Settings
| Variable | Default value | Description |
|---|---|---|
SECRET_KEY_BASE |
(required) | The secret key for signing sessions and cookies (openssl rand -base64 64). |
DATA_ENCRYPTION_KEY |
(recommended) | The key for encrypting access credentials in the database (openssl rand -base64 48). |
PHX_HOST |
(required) | The public domain of the instance (e.g. booking.yourdomain.com). |
PORT |
4000 |
The port the application listens on. |
URL_SCHEME |
https |
http only for local or internal deployments without TLS. |
WS_ALLOWED_ORIGINS |
(from PHX_HOST) |
Allowed origins for WebSocket when the application runs on several hostnames. |
REGISTRATION_ENABLED |
true |
Allows registration of new users (applies to SSO too). |
PASSWORD_AUTH_ENABLED |
true |
Sign-in with email and password; false leaves only SSO. |
WEB_HOST |
(optional) | The public address of the website with the documentation (e.g. https://lockmycal.com; scheme and host only, no trailing slash or path) – different from PHX_HOST. It is the source of the links to the documentation, the website icon in the top bars of the dashboard and the booking pages, and the Report a bug link in the footer (<WEB_HOST>/forum/bugs). Without it, neither the icon nor the link is shown. |
SOURCE_CODE_URL |
https://github.com/lockmycal/lockmycal |
The public repository with the source code of the running version (the AGPL requires offering it to everyone who uses the instance over the network). The dashboard sidebar and admin alert emails link to it (the /issues page). If you run a modified version, point it to your own repository. |
2. PostgreSQL Database
| Variable | Default value | Description |
|---|---|---|
POSTGRES_PASSWORD |
(required) | The database password. |
POSTGRES_USER / POSTGRES_DB |
– | The database user and name. |
DATABASE_URL |
– | The complete connection string (an alternative to the individual variables). |
DATABASE_HOST / DATABASE_PORT |
– / 5432 |
The address and port of the database server. |
DATABASE_SSL |
– | An encrypted connection to the database (true); also respects sslmode in DATABASE_URL. |
DATABASE_POOL_SIZE |
10 |
The size of the database connection pool. |
3. Email
| Variable | Description |
|---|---|
EMAIL_ADAPTER |
smtp / postmark / sendgrid / mailgun / ahasend |
EMAIL_FROM_ADDRESS / EMAIL_FROM_NAME |
The sending address and the sender's name. |
EMAIL_SUPPORT_ADDRESS |
The support contact address in emails (default EMAIL_FROM_ADDRESS). |
SMTP_HOST / SMTP_PORT / SMTP_USERNAME / SMTP_PASSWORD |
Connection to the SMTP server (encryption is derived from the port). |
SMTP_SSL |
Forces implicit TLS on a port other than 465 too. |
SMTP_TLS_VERIFY |
Server certificate verification: peer (default) / none. |
SMTP_TLS_MIDDLEBOX_COMPAT |
true only for a relay behind a device that blocks TLS 1.3. |
POSTMARK_API_KEY |
The Postmark server API token. |
SENDGRID_API_KEY |
The SendGrid API key. |
MAILGUN_API_KEY / MAILGUN_DOMAIN / MAILGUN_BASE_URL |
Mailgun settings. |
AHASEND_API_KEY / AHASEND_ACCOUNT_ID |
AhaSend settings. |
4. Calendars, Video and OAuth
| Variable | Description |
|---|---|
GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET / GOOGLE_STATE_SECRET |
Google Calendar, Google Meet and sign-in with a Google account. |
OUTLOOK_CLIENT_ID / OUTLOOK_CLIENT_SECRET / OUTLOOK_STATE_SECRET |
Outlook, Microsoft Teams and sign-in with a Microsoft account. |
ZOOM_CLIENT_ID / ZOOM_CLIENT_SECRET / ZOOM_STATE_SECRET / ZOOM_DEAUTH_SECRET |
The Zoom app. |
ZOOM_UPDATE_SCOPE_ENABLED |
false if the Zoom app doesn't have the meeting:update:meeting permission. |
WEBHOOK_BASE_URL |
The public HTTPS address for Google/Outlook push notifications (without it, sync runs periodically, not in real time). |
ALLOW_PRIVATE_IPS_FOR_CALENDAR / ALLOW_PRIVATE_IPS_FOR_VIDEO |
Allows calendar and video servers on internal addresses. |
VIDEO_ROOM_RETENTION_DAYS |
After how many days from the end of a meeting video rooms are deleted (default 7). |
5. Sign-in (SSO)
| Variable | Description |
|---|---|
ENABLE_GOOGLE_AUTH / ENABLE_GITHUB_AUTH / ENABLE_MICROSOFT_AUTH |
Sign-in with a Google, GitHub and Microsoft account (can also be switched on in the administration). |
GITHUB_CLIENT_ID / GITHUB_CLIENT_SECRET |
The GitHub OAuth app. |
ENABLE_OAUTH_AUTH |
Generic OAuth 2.0 / OIDC sign-in. |
OAUTH_CLIENT_ID / OAUTH_CLIENT_SECRET |
The client in your identity provider. |
OAUTH_AUTHORIZE_URL / OAUTH_TOKEN_URL / OAUTH_USERINFO_URL |
The provider's endpoints (HTTPS). |
OAUTH_PROVIDER_URL / OAUTH_SCOPE / OAUTH_EMAIL_VERIFIED_CLAIM / OAUTH_ALLOW_ID_FALLBACK |
Further options – see Generic SSO. |
6. Bot Protection
| Variable | Default value | Description |
|---|---|---|
RECAPTCHA_SIGNUP_PROVIDER / RECAPTCHA_BOOKING_PROVIDER |
off |
The provider for sign-up and for bookings: off / google / cloudflare. |
RECAPTCHA_SITE_KEY / RECAPTCHA_SECRET_KEY |
– | Google reCAPTCHA v3 keys. |
RECAPTCHA_SIGNUP_MIN_SCORE / RECAPTCHA_BOOKING_MIN_SCORE |
0.3 |
The reCAPTCHA threshold score (0.0 to 1.0). |
TURNSTILE_SITE_KEY / TURNSTILE_SECRET_KEY |
– | Cloudflare Turnstile keys. |
RECAPTCHA_SIGNUP_ENABLED / RECAPTCHA_BOOKING_ENABLED |
false |
The older variant (corresponds to the google provider). |
7. Network and Proxy
| Variable | Description |
|---|---|
HTTP_PROXY / HTTPS_PROXY / NO_PROXY |
An outgoing proxy for corporate networks. |
TRUST_PRIVATE_CLIENT_IPS |
true only for an instance reachable exclusively from the internal network, where visitors have private addresses. |
ALLOW_PRIVATE_IPS_FOR_WEBHOOKS |
Allows sending webhooks to internal addresses. |
8. Notifications and Alerts
| Variable | Description |
|---|---|
TELEGRAM_ENABLED |
The mode of users' own bots. |
TELEGRAM_BOT_TOKEN / TELEGRAM_BOT_USERNAME / TELEGRAM_WEBHOOK_SECRET |
The mode of a single shared instance bot. |
SLACK_ENABLED |
Slack through an Incoming Webhook. |
SLACK_CLIENT_ID / SLACK_CLIENT_SECRET |
Slack through OAuth (the Add to Slack button). |
ADMIN_ALERTS_ENABLED / ADMIN_ALERT_EMAIL |
Email alerts to the administrator about errors and integration problems (including new errors from error tracking). |
9. Payments
| Variable | Description |
|---|---|
MEETING_PAYMENTS_ENABLED |
Switches on payments for meetings. |
STRIPE_SECRET_KEY / STRIPE_WEBHOOK_SECRET / STRIPE_CONNECT_WEBHOOK_SECRET |
The Stripe API and webhooks. |
MEETING_PAYMENTS_DEFAULT_COUNTRY |
The default country of new organizer Stripe accounts. |
MEETING_PAYMENTS_APPLICATION_FEE_BP |
The platform fee in basis points (100 = 1 %), default 0. |
10. Analytics, Audit and Logs
| Variable | Description |
|---|---|
UMAMI_SCRIPT_URL / UMAMI_WEBSITE_ID |
Traffic measurement through Umami. |
ANALYTICS_SALT_SECRET |
The secret key for anonymizing visitors in analytics – generate it once and don't change it. |
ERROR_TRACKING_ENABLED |
Storing errors, crashes and failed jobs in the application's database (default true; values true/false, 1/0, yes/no, on/off). Nothing is sent to third parties. Details in the Admin Console. |
AUDIT_LOG_RETENTION_DAYS |
How long to keep the security audit log (default 90 days). |
LOG_FILE_PATH / LOG_FILE_MAX_BYTES / LOG_FILE_MAX_FILES |
Writing the log to a rotated file. |