config.toml reference

هذا المحتوى غير متوفر بلغتك بعد.

{/* Generated by website/scripts/gen-config-reference.mjs. Do not edit by hand. */}

Copy backend/config.toml.example to config.toml next to the server binary (or mount it into the container). Keys not listed there use built-in defaults. Restart the server after editing the file unless the admin panel says the key applies live.

`[server]`

`server.domain`

Default: "localhost"

The public domain name of this node. Used for inter-node federation.

`server.http_port`

Default: 4000

HTTP API and WebSocket port.

`server.udp_port`

Default: 9090

Raw UDP port for voice routing (Wails desktop client only).

`server.frontend_origin`

Default: "http://localhost:5173"

The origin(s) allowed to access the API via CORS. Comma-separated. Use “*” to allow all origins (not recommended for production). Note: Wails desktop app origins are allowed by default.

`server.max_file_size_mb`

Default: 100

Maximum allowed file upload size in MB.

`server.max_video_size_mb`

Default: 50

Maximum allowed video message size in MB.

`server.max_video_duration_sec`

Default: 60

Maximum video message duration in seconds.

`server.ffmpeg_path`

Default: "ffmpeg"

Path to ffmpeg binary (for video transcoding).

`server.dev`

Default: false

Enable development mode (extra logging, Swagger UI at /api/docs/).

`[security]`

`security.master_password`

Default: ""

Master password for encrypting the database DEK via Argon2id (KEK derivation). If left empty, the server will generate a secure 32-char random string on first launch, print it to the terminal, and write it here automatically. IMPORTANT: Back this up. Losing it makes the database unrecoverable.

`security.token_expire_hours`

Default: 24

Number of hours before the authentication token and session expire.

`[database]`

`database.path`

Default: "./data/db"

Path where BadgerDB stores its data files.

`[rate_limit]`

`rate_limit.global_rps`

Default: 100

Global rate limit: max requests per second per IP address.

`rate_limit.auth_rps`

Default: 5

Strict rate limit for auth endpoints (/api/login, /api/register).

`[voice]`

`voice.mode`

Default: "webrtc"

Group audio/video calling + screen share engine. “webrtc” - production, internet-capable: a self-hosted SFU (see internal/rtc) with encrypted media (DTLS-SRTP) and NAT traversal via ICE/STUN/TURN. Supports video + screen share. “raw_udp” - the original unencrypted, audio-only UDP packet router (internal/voice), for isolated/LAN deployments where every client can already reach the server directly and the DTLS/ICE overhead isn’t wanted. No video/screen-share.

`voice.max_participants_per_call`

Default: 10

Maximum participants in a single call (resource cap; enforced at join).

`voice.webrtc_port_min`

Default: 50000

WebRTC media (ICE/DTLS/SRTP) ephemeral UDP port range. Firewall this range on the host; each active track negotiation uses one port.

`voice.webrtc_port_max`

Default: 50100

`voice.public_ip`

Default: "auto"

Required whenever this process is behind NAT/a cloud load balancer/a Docker port mapping — the IP clients should use to reach it. “webrtc” mode is the internet-capable engine, so it’s fine (and the default) for this to assume internet access is available. Deployments with NO internet egress at all should use mode = “raw_udp” above instead of “webrtc” with this left empty. “auto” - (default) auto-detect via a one-time STUN query at startup. Falls back to “” behavior if unreachable. “” - direct/LAN-only “webrtc” deployments; never calls out. “1.2.3.4” - explicit manual value.

`voice.public_ip_discovery_stun_servers`

Default: ["stun:stun.l.google.com:19302"] (commented out in the example; optional)

Only used when public_ip = “auto”; overrides the default STUN servers.

`voice.embedded_turn_enabled`

Default: true

Runs our own STUN+TURN relay in-process (github.com/pion/turn) so NAT traversal works without any external TURN provider. Requires public_ip to be set to be useful. Disable for LAN-only deployments that don’t need NAT traversal at all.

`voice.embedded_turn_port`

Default: 3478

`voice.turn_realm`

Default: "cove"

`voice.turn_shared_secret`

Default: ""

Drives short-lived, per-call HMAC-derived TURN credentials (TURN REST API convention) — never a static shared secret handed to clients directly. Generated automatically on first run and persisted here, like master_password above.

`[registration]`

`registration.mode`

Default: "open"

"open"        anyone can sign up
"invite_only" a valid invitation code is required
"closed"      nobody can sign up

`[admin]`

`admin.owner_username`

Default: "" (commented out in the example; optional)

Recovery for a lost owner login: set this to an existing username and restart to make that account the owner (the previous owner becomes an admin).

`[demo]`

`demo.enabled`

Default: false (commented out in the example; optional)

`demo.max_users`

Default: 200 # total accounts allowed; 0 = no cap (commented out in the example; optional)

`demo.signups_per_ip_per_day`

Default: 3 # new accounts per client IP per rolling 24h; 0 = no cap (commented out in the example; optional)

`[captcha]`

`captcha.enabled`

Default: false (commented out in the example; optional)

`captcha.difficulty`

Default: "medium" # low \| medium \| high (about 12k, 50k and 200k hashes on average) (commented out in the example; optional)