Environment variables

Set these in .env next to docker-compose.yml. Compose reads it automatically.

Required

Variable	What it does
`ENCRYPTION_KEY`	Encrypts source credentials, SMTP credentials, and the alert webhook URL at rest with AES-256-GCM. Must be base64 that decodes to exactly 32 bytes; generate one with `openssl rand -base64 32`. LatestArr won’t start without a valid key. Back it up.

Optional

Variable	Default	What it does
`WEB_ORIGIN`	`http://localhost:3000`	The address people use to reach LatestArr. Used as the redirect after an SSO sign-in. Set it to your `https://` URL when you’re behind a proxy.
`PORT`	`3000`	The host port Compose maps to the container. The container always listens on 3000. If you change this, update `WEB_ORIGIN` to match.
`LATESTARR_VERSION`	`latest`	The image tag to run: `latest`, a pinned release like `v0.11.2`, or `dev`. See Image tags.
`TRUST_PROXY`	off	Set to exactly `true` only when a reverse proxy in front terminates TLS and sends `X-Forwarded-For` and `X-Forwarded-Proto`. See Reverse proxy.
`LOG_LEVEL`	`info`	How much goes to the logs. New in 0.11 See below.

⚠️

Leave TRUST_PROXY unset if you reach LatestArr over plain http:// with no proxy. Setting it there lets clients spoof their IP and protocol, and can stop you from signing in.

`LOG_LEVEL`

Value	Records
`info`	Sends, sign-ins, and settings changes. The default.
`debug`	All of the above, plus item counts per source for each send.
`warn`	Only problems.

Any standard level works (trace, debug, info, warn, error, fatal, or silent), case-insensitive. An unknown value falls back to info with a warning.

SSO (OIDC)

Leave these blank to use local accounts only, which is the default. See SSO with OIDC for setup.

Variable	What it does
`OIDC_ISSUER`	Your provider’s issuer URL. Its discovery document must be at `<issuer>/.well-known/openid-configuration`.
`OIDC_CLIENT_ID`	The client ID you registered with your provider.
`OIDC_CLIENT_SECRET`	The client secret, for a confidential client.
`OIDC_REDIRECT_URI`	`<WEB_ORIGIN>/api/auth/oidc/callback`. Register this exact URL with your provider.
`OIDC_SCOPES`	Space-separated. Defaults to `openid profile email`.

OIDC_CLIENT_SECRET is read from the environment, so protect your .env file like any other secret.