Environment Variables

All environment variables are optional. TREK works out of the box with sensible defaults.

Core

Variable	Default	Description
PORT	3000	Server port
NODE_ENV	development	Set to production for deployment
JWT_SECRET	Auto-generated	Secret for JWT tokens. Auto-generated and persisted to ./data/.jwt_secret if not set
ALLOWED_ORIGINS	—	Comma-separated CORS origins (e.g. https://trek.example.com). Not needed if serving from same origin
FORCE_HTTPS	false	Set to true to redirect HTTP to HTTPS. Only use if TREK handles TLS directly, not behind a reverse proxy
TRUST_PROXY	1	Trust proxy setting for Express (e.g. 1 or loopback). Set this when behind a reverse proxy for correct IP detection
TZ	UTC	Timezone for the container (e.g. Europe/Berlin). Affects backup scheduling, cron jobs, and log timestamps
DEMO_MODE	false	Enable demo mode with auto-reset functionality
LOG_LEVEL	info	Logging verbosity — info for user actions, debug for verbose details
COOKIE_SECURE	true (production)	Require HTTPS for session cookies. Set false only for plain HTTP (not recommended)
ALLOW_INTERNAL_NETWORK	false	Allow outbound requests to RFC-1918 private IPs. Set true if Immich or other services are on your local network. Loopback (127.x) and link-local (169.254.x) are always blocked
MCP_RATE_LIMIT	60	Maximum MCP API requests per user per minute

Encryption

Variable	Default	Description
ENCRYPTION_KEY	Auto-generated	256-bit hex key for at-rest encryption of API keys, MFA secrets, OIDC client secret, and SMTP password. Generate with openssl rand -hex 32. Fallback chain: env var → data/.encryption_key file → auto-generate

OIDC / Single Sign-On

These are optional. OIDC can also be configured via the Admin Panel UI. Environment variables take priority over UI settings.

Variable	Default	Description
OIDC_ISSUER	—	OpenID Connect Issuer URL (e.g. https://auth.example.com/realms/main)
OIDC_CLIENT_ID	—	OIDC Client ID
OIDC_CLIENT_SECRET	—	OIDC Client Secret
OIDC_DISPLAY_NAME	SSO	Display name for the SSO button (e.g. Login with Keycloak)
OIDC_ONLY	false	Disable password authentication — users must log in via OIDC
OIDC_ADMIN_CLAIM	groups	OIDC claim to check for admin role assignment (e.g. groups, roles)
OIDC_ADMIN_VALUE	—	Value within the claim that grants admin role (e.g. trek-admins). When set, users with this value get admin on login; users without it lose admin
OIDC_SCOPE	openid email profile groups	Space-separated OIDC scopes to request. Must include the scope that exposes the claim used by OIDC_ADMIN_CLAIM
OIDC_DISCOVERY_URL	—	Override the OIDC discovery endpoint for non-standard providers (e.g. Authentik: https://auth.example.com/application/o/trek/.well-known/openid-configuration)

SMTP / Email Notifications

These can also be configured via the Admin Panel UI. Environment variables take priority.

Variable	Default	Description
SMTP_HOST	—	SMTP server hostname (e.g. smtp.gmail.com)
SMTP_PORT	—	SMTP port (e.g. 587 for STARTTLS, 465 for SSL)
SMTP_USER	—	SMTP username
SMTP_PASS	—	SMTP password or app-specific password
SMTP_FROM	—	Sender address (e.g. trek@yourdomain.com)
SMTP_SKIP_TLS_VERIFY	false	Skip TLS certificate verification — use for self-signed certificates on local mail servers
APP_URL	—	Base URL of your TREK instance (e.g. https://trek.example.com). Required for OIDC redirect URIs and used in email notification links
NOTIFICATION_WEBHOOK_URL	—	Webhook URL for notifications (Discord, Slack, or custom endpoint)

JWT Secret

If you don't set JWT_SECRET, TREK generates a random secret on first start and saves it to ./data/.jwt_secret. This means:

• Sessions survive container restarts (as long as ./data is mounted)
• If you delete the data volume, all users will be logged out

For multi-instance setups, set JWT_SECRET explicitly so all instances share the same secret.

OIDC Admin Role Mapping

The OIDC_ADMIN_CLAIM and OIDC_ADMIN_VALUE variables enable automatic admin role assignment based on OIDC claims. Example:

environment:
  OIDC_ADMIN_CLAIM: groups
  OIDC_ADMIN_VALUE: trek-admins

On every OIDC login, TREK checks the user's token claims. If the groups claim contains trek-admins, the user is promoted to admin. If it doesn't, admin is revoked. This allows centralized role management through your identity provider.

Full Docker Compose Example

services:
  app:
    image: mauriceboe/trek:latest
    container_name: trek
    ports:
      - "3000:3000"
    environment:
      - NODE_ENV=production
      - PORT=3000
      - TZ=Europe/Berlin
      - APP_URL=https://trek.example.com
      # OIDC (optional)
      - OIDC_ISSUER=https://auth.example.com/realms/main
      - OIDC_CLIENT_ID=trek
      - OIDC_CLIENT_SECRET=your-client-secret
      - OIDC_DISPLAY_NAME=Authelia
      # - OIDC_ONLY=true
      # - OIDC_ADMIN_CLAIM=groups
      # - OIDC_ADMIN_VALUE=trek-admins
      # SMTP (optional)
      - SMTP_HOST=smtp.gmail.com
      - SMTP_PORT=587
      - SMTP_USER=trek@gmail.com
      - SMTP_PASS=app-specific-password
      - SMTP_FROM=trek@gmail.com
      # - SMTP_SKIP_TLS_VERIFY=true
      # Webhooks (optional)
      # - NOTIFICATION_WEBHOOK_URL=https://discord.com/api/webhooks/...
    volumes:
      - ./data:/app/data
      - ./uploads:/app/uploads
    restart: unless-stopped