Environment Variables

Use GODOXY_ names for GoDoxy settings. Older names still work. GoDoxy uses the first non-empty value:

GODOXY_ names (recommended)
GOPROXY_ names (legacy)
Names without a prefix (deprecated)

Rename old settings to GODOXY_ names. HTTPS_ADDR is different: the first variable that is set wins, even if empty. An empty value turns off shared HTTPS.

Compose inputs use the exact names shown below; they do not need renaming.

Copy .env.example to .env, set your credentials, and uncomment settings only to change their defaults. Missing Compose inputs tell you which variables to add.

The Compose example connects to Docker through socket-proxy:

Keep GODOXY_DOCKER_HOST=tcp://${LISTEN_ADDR} for this setup.
Change GODOXY_DOCKER_HOST if you use a different Docker endpoint.
Keep LISTEN_ADDR consistent with the socket-proxy address.

Compose reads the endpoint from .env without replacing it.

If you keep an older .env when upgrading Compose, add GODOXY_DOCKER_HOST=tcp://${LISTEN_ADDR} unless you already configured another endpoint. Without an endpoint setting, GoDoxy uses unix:///var/run/docker.sock, which this Compose example does not mount.

At startup, GoDoxy warns on unrecognized GODOXY_* names and selected unprefixed aliases, without printing their values. Custom names referenced by configuration interpolation still work, but are not recognized built-in settings. An info-level report shows effective server environment settings and their selected source; derived booleans may differ from the source value. Secrets, identity fields, and potentially credential-bearing URLs are redacted. These are environment settings, not per-route overrides or a report of active listeners.

Defaults below describe normal execution. TEST is also enabled in Go test executables; DEBUG defaults to effective TEST, but an explicit false overrides it. TRACE requires effective DEBUG. Server and websocket debug also honor explicit DEBUG=true, not test-derived debug. Durations use Go duration syntax; lists are comma-separated. Empty values fall through to aliases or the default except for HTTPS_ADDR.

For HTTP-only deployment, set GODOXY_HTTPS_ADDR=. This disables shared HTTPS, its HTTP/3 listener and shared TCP SNI routing, but not dedicated route listeners. redirectHTTP does not redirect in this mode. Direct HTTP login also requires GODOXY_API_JWT_SECURE=false; keep secure cookies when clients use an external TLS-terminating proxy. Unset HTTPS_ADDR still defaults to :443 and requires a certificate.

Compose inputs

Variable	Type	Default	Description
`TAG`	string	`latest`	Container image tag.
`TZ`	string	`Etc/UTC`	IANA timezone for log timestamps.
`GODOXY_UID`	int	`1000`	Container user ID; must own mounted directories.
`GODOXY_GID`	int	`1000`	Container group ID; must own mounted directories.
`DOCKER_SOCKET`	string	`/var/run/docker.sock`	Host Docker socket path; use /var/run/podman/podman.sock for Podman.
`LISTEN_ADDR`	address	`127.0.0.1:2375`	Socket-proxy listener used by the Compose example.

Server settings

Variable	Type	Default	Description
`GODOXY_HTTP_ADDR`	address	`:80`	HTTP proxy listener.
`GODOXY_HTTPS_ADDR`	address	`:443`	Shared HTTPS proxy listener; explicitly empty disables it (including shared HTTP/3 and TCP SNI routing). Dedicated route listeners are unaffected.
`GODOXY_HTTP3_ENABLED`	bool	`false`	Enable HTTP/3 on HTTPS, except with PROXY protocol.
`GODOXY_SNI_ROUTING_FOR_TCP_ROUTES`	bool	`true`	Route TCP over the shared HTTPS listener using TLS SNI.
`GODOXY_API_ADDR`	address	`127.0.0.1:8888`	API and WebUI backend listener.
`GODOXY_LOCAL_API_ADDR`	address	empty	Unauthenticated local API listener; empty disables it.
`GODOXY_LOCAL_API_ALLOW_NON_LOOPBACK`	bool	`false`	Allow unauthenticated local API outside loopback. Exposes unrestricted access.
`GODOXY_API_JWT_SECURE`	bool	`true`	Require HTTPS for login cookies.
`GODOXY_API_JWT_SECRET`	string	empty	JWT signing key; generate with openssl rand -base64 32. Empty generates a temporary random key.
`GODOXY_API_JWT_TOKEN_TTL`	duration	`24h`	Login token lifetime.
`GODOXY_API_USER`	string	empty	WebUI username; required with password unless OIDC or disabled authentication is used.
`GODOXY_API_PASSWORD`	string	empty	WebUI password.
`GODOXY_OIDC_ISSUER_URL`	string	empty	OIDC issuer URL; empty disables OIDC.
`GODOXY_OIDC_CLIENT_ID`	string	empty	OIDC client ID.
`GODOXY_OIDC_CLIENT_SECRET`	string	empty	OIDC client secret.
`GODOXY_OIDC_SCOPES`	list	`openid, profile, email, groups`	OIDC scopes; add offline_access if supported by the identity provider.
`GODOXY_OIDC_ALLOWED_USERS`	list	empty	Comma-separated users allowed to log in.
`GODOXY_OIDC_ALLOWED_GROUPS`	list	empty	Comma-separated groups allowed to log in.
`GODOXY_OIDC_RATE_LIMIT`	int	`10`	OIDC login requests allowed per period.
`GODOXY_OIDC_RATE_LIMIT_PERIOD`	duration	`1s`	OIDC login rate limit period.
`GODOXY_FRONTEND_ALIASES`	list	`godoxy`	Legacy WebUI aliases, used only when webui.aliases is empty.
`GODOXY_SHORTLINK_PREFIX`	string	`go`	Path prefix for short links.
`GODOXY_INIT_TIMEOUT`	duration	`1m`	Startup initialization timeout; unavailable providers retry in the background.
`GODOXY_DOCKER_HOST`	string	`unix:///var/run/docker.sock`	Docker endpoint for $DOCKER_HOST entries in config.yml.
`GODOXY_METRICS_DISABLE_CPU`	bool	`false`	Disable cpu metrics collection.
`GODOXY_METRICS_DISABLE_MEMORY`	bool	`false`	Disable memory metrics collection.
`GODOXY_METRICS_DISABLE_DISK`	bool	`false`	Disable disk metrics collection.
`GODOXY_METRICS_DISABLE_NETWORK`	bool	`false`	Disable network metrics collection.
`GODOXY_METRICS_DISABLE_SENSORS`	bool	`false`	Disable sensors metrics collection.
`GODOXY_MAXMIND_COUNTRY_ONLY`	bool	`false`	Use Country instead of City databases; opt out of City downloads when unavailable. Country databases do not support timezone rules.
`GODOXY_FORCE_RESOLVE_COUNTRY`	bool	`false`	Always resolve the client country with GeoIP.
`GODOXY_DEBUG`	bool	`false`	General debug logging. Defaults to TEST or a Go test executable; explicit false overrides that default.
`GODOXY_TRACE`	bool	`false`	Trace logging; effective only when DEBUG is enabled.
`GODOXY_SERVER_DEBUG`	bool	`false`	HTTP server debug logging; explicit DEBUG=true also enables this, but test-derived DEBUG does not.
`GODOXY_WEBSOCKET_DEBUG`	bool	`false`	Websocket debug logging; explicit DEBUG=true also enables this, but test-derived DEBUG does not.

Development and testing only

Never enable these in production. DEBUG_DISABLE_AUTH disables authentication entirely.

Variable	Type	Default	Description
`GODOXY_API_SKIP_ORIGIN_CHECK`	bool	`false`	Skip API origin checks. Development only.
`GODOXY_DEBUG_DISABLE_AUTH`	bool	`false`	Disable authentication entirely. Never enable in production.
`GODOXY_TEST`	bool	`false`	Test mode; Go test executables always enable this. Development only.

Environment Variables

Compose inputsCopy Anchor Link

Server settingsCopy Anchor Link

Development and testing onlyCopy Anchor Link

On this page

Compose inputs

Server settings

Development and testing only