Environment variables for self-hosted PostSider

All configuration for a self-hosted PostSider instance is managed through environment variables. Copy the repository’s .env.example to .env and fill in the values relevant to your deployment. The bundled Compose stack requires the database, Redis, Temporal, and MinIO variables shown below; some application checks are diagnostic rather than startup validation.

This page is for people running their own PostSider instance. On PostSider Cloud, the instance is already configured - you only manage your account, channels, and API keys.

Core and URLs

Variable	Description
`FRONTEND_URL`	Public URL of the dashboard, e.g. `https://social.example.com`.
`BACKEND_URL`	Public site URL used by server-side callbacks and media URLs; with the bundled proxy this is the site origin.
`NEXT_PUBLIC_BACKEND_URL`	Browser-facing API base URL; with the bundled proxy use the origin plus `/api`. This is a build-time argument.
`BACKEND_INTERNAL_URL`	Internal backend URL used by the frontend build, e.g. `http://localhost:3000`.
`MAIN_URL`	Optional; leave empty for the standard single-instance setup.
`TZ`	Container timezone, e.g. `UTC`.
`PORT` / `ORCHESTRATOR_PORT`	Internal ports for the backend and orchestrator processes.
`NODE_ENV`	`production` in the Compose stack.

Required secrets and database

Variable	Description
`JWT_SECRET`	Long random string used to sign session tokens. Required; the backend refuses to start without it.
`ENCRYPTION_KEY`	Long random key used to encrypt stored provider credentials and webhook secrets. Required in OSS `v1.0.1`; back it up with the database.
`POSTGRES_USER` / `POSTGRES_PASSWORD` / `POSTGRES_DB`	Application PostgreSQL credentials used by the Compose stack.
`DATABASE_URL`	PostgreSQL connection string for the application.
`REDIS_URL`	Redis connection string, e.g. `redis://redis:6379`.
`TEMPORAL_POSTGRES_PASSWORD`	Password for Temporal’s own PostgreSQL service.

Docker storage (MinIO)

Variable	Description
`STORAGE_PROVIDER`	`minio`, `local`, or `cloudflare`. The bundled Compose stack sets `minio`.
`MINIO_ENDPOINT`	MinIO S3 endpoint inside the stack, e.g. `http://minio:9000`.
`MINIO_ACCESS_KEY` / `MINIO_SECRET_KEY`	MinIO root credentials; used by both the stack and the application.
`MINIO_BUCKET`	Bucket name, e.g. `postsider-media`.
`MINIO_PUBLIC_URL`	Public URL prefix for media, e.g. `https://social.example.com/storage`.

Cloudflare R2 (STORAGE_PROVIDER=cloudflare): CLOUDFLARE_ACCOUNT_ID, CLOUDFLARE_ACCESS_KEY, CLOUDFLARE_SECRET_ACCESS_KEY, CLOUDFLARE_BUCKETNAME, CLOUDFLARE_BUCKET_URL, CLOUDFLARE_REGION.

Temporal

Variable	Description
`TEMPORAL_ADDRESS`	Temporal server address, e.g. `temporal:7233`.
`TEMPORAL_NAMESPACE`	Temporal namespace (default `default`).
`TEMPORAL_API_KEY` / `TEMPORAL_TLS`	Optional, for connecting to an external or encrypted Temporal server.
`RUN_CRON`	`true` enables the background workflows: stuck-post recovery, evergreen recycling, media cleanup, and token refresh. Keep it on for a production deployment.

Self-hosting flags

Variable	Description
`IS_GENERAL`	`true` in self-hosted deployments.
`NEXT_PUBLIC_SELF_HOSTED`	`true` on self-hosted instances; enables self-host-only surfaces. Build-time argument.
`DISABLE_REGISTRATION`	`true` makes the instance invite-only.
`NEXT_PUBLIC_DISABLE_REGISTRATION`	Frontend mirror of `DISABLE_REGISTRATION`; build-time argument - changing it requires a rebuild.
`REQUIRE_EMAIL_ACTIVATION`	`true` requires local sign-ups to confirm their email before first login.
`DISALLOW_PLUS`	Any non-empty value blocks `+` aliases in registration emails.

Leave NOT_SECURED unset in production. Do not set NOT_SECURED=false: some startup checks treat any non-empty value as insecure, while middleware checks vary by path. This mode is intended only for isolated local development.

Email

Variable	Description
`EMAIL_PROVIDER`	Empty by default; set to `resend` or `nodemailer` only after configuring the matching variables.
`EMAIL_FROM_NAME` / `EMAIL_FROM_ADDRESS`	Sender identity for outgoing mail.
`RESEND_API_KEY`	API key when using Resend.
`EMAIL_HOST` / `EMAIL_PORT` / `EMAIL_USER` / `EMAIL_PASS` / `EMAIL_SECURE`	SMTP settings when using `nodemailer`.

Invitations, password resets, activation links, and approval notifications are sent through the configured provider. If email is not configured, deliver invite and reset links manually.

AI

Variable	Description
`AI_API_KEY`	Platform AI key for PostSider Cloud (or self-hosted with a shared key). Also accepts `OPENAI_API_KEY` as an alias.
`AI_PROVIDER`	`openai` (default), `deepseek`, or `gemini`.
`AI_MODEL`	Model override; defaults per provider (`gpt-4.1`, `deepseek-chat`, `gemini-2.5-flash`).

Self-hosted instances can instead let each organization provide its own key under Settings → Post Checker. See AI Assistant. Each OAuth platform reads its app credentials from environment variables. Configure only the platforms you use and register each callback at https://your-domain.com/integrations/social/<provider>: X_API_KEY/X_API_SECRET, LINKEDIN_CLIENT_ID/LINKEDIN_CLIENT_SECRET, GITHUB_CLIENT_ID/GITHUB_CLIENT_SECRET, FACEBOOK_APP_ID/FACEBOOK_APP_SECRET, INSTAGRAM_APP_ID/INSTAGRAM_APP_SECRET, THREADS_APP_ID/THREADS_APP_SECRET, YOUTUBE_CLIENT_ID/YOUTUBE_CLIENT_SECRET, GOOGLE_GMB_CLIENT_ID/GOOGLE_GMB_CLIENT_SECRET, TIKTOK_CLIENT_ID/TIKTOK_CLIENT_SECRET, PINTEREST_CLIENT_ID/PINTEREST_CLIENT_SECRET, DRIBBBLE_CLIENT_ID/DRIBBBLE_CLIENT_SECRET, DISCORD_CLIENT_ID/DISCORD_CLIENT_SECRET/DISCORD_BOT_TOKEN_ID, SLACK_ID/SLACK_SECRET, TWITCH_CLIENT_ID/TWITCH_CLIENT_SECRET, WHOP_CLIENT_ID, MASTODON_URL/MASTODON_CLIENT_ID/MASTODON_CLIENT_SECRET, TELEGRAM_TOKEN/TELEGRAM_BOT_NAME/NEXT_PUBLIC_TELEGRAM_BOT_NAME, NEYNAR_CLIENT_ID/NEYNAR_SECRET_KEY. Credential-based platforms (Bluesky, Nostr, WordPress, Medium, and other token/username-password providers) are connected directly in the dashboard and need no environment variable. See the Channels guides for per-platform details.

Billing (Polar)

Leaving POLAR_ACCESS_TOKEN empty keeps a self-hosted instance unlimited. To enable managed billing, configure the token, server (sandbox or production), webhook secret, and all eight product mappings for Standard/Team/Pro/Ultimate monthly and yearly products (POLAR_PRODUCT_*). On Cloud these are set for you. See Billing.

Generic OIDC / SSO

Connect an external identity provider (for example Authentik): POSTSIDER_GENERIC_OAUTH, POSTSIDER_OAUTH_URL, POSTSIDER_OAUTH_AUTH_URL, POSTSIDER_OAUTH_TOKEN_URL, POSTSIDER_OAUTH_USERINFO_URL, POSTSIDER_OAUTH_CLIENT_ID, POSTSIDER_OAUTH_CLIENT_SECRET, NEXT_PUBLIC_POSTSIDER_OAUTH_DISPLAY_NAME, NEXT_PUBLIC_POSTSIDER_OAUTH_LOGO_URL.

Short-link providers (optional)

DUB_TOKEN/DUB_API_ENDPOINT/DUB_SHORT_LINK_DOMAIN, KUTT_API_KEY/KUTT_API_ENDPOINT/KUTT_SHORT_LINK_DOMAIN, SHORT_IO_SECRET_KEY, LINK_DRIP_API_KEY/LINK_DRIP_API_ENDPOINT/LINK_DRIP_SHORT_LINK_DOMAIN.

Monitoring and analytics (optional)

Variable	Description
`SENTRY_SPOTLIGHT` / `NEXT_PUBLIC_SENTRY_DSN`	Sentry configuration.
`DATAFAST_API_KEY`	Datafast enrichment.
`NEXT_PUBLIC_FACEBOOK_PIXEL` / `FACEBOOK_PIXEL_ACCESS_TOKEN`	Facebook pixel tracking.
`NEXT_PUBLIC_DISCORD_SUPPORT`	Discord support link surfaced in the UI.

Media and content

Variable	Description
`MEDIA_RETENTION_DAYS`	Media retention window in days (default 90); older media is removed by the cleanup workflow.
`RESTRICT_UPLOAD_DOMAINS`	Comma-separated allow-list for remote media import domains.
`NEXT_PUBLIC_UPLOAD_STATIC_DIRECTORY`	Overrides the static media directory path.
`MAX_UPLOAD_MB`	Upload size cap in MB (default 512).

Public API rate limiting

Variable	Description
`API_LIMIT`	Requests per minute per organization on the public API (default 60). Other application routes use a separate global throttler.

Frontend build arguments

NEXT_PUBLIC_* values are baked into the frontend bundle at build time: NEXT_PUBLIC_BACKEND_URL, NEXT_PUBLIC_SELF_HOSTED, NEXT_PUBLIC_DISABLE_REGISTRATION, NEXT_PUBLIC_VERSION, NEXT_PUBLIC_TELEGRAM_BOT_NAME. Changing any of these requires rebuilding the image.

Other

Variable	Description
`BOOTSTRAP_ORGANIZATION`	Optional name for the bootstrap organization.
`MOBILE_APP_SCHEME`	Mobile app scheme for deep links.
`EXTENSION_ID`	Reserved for the browser extension flow.

Full example

A minimal production-ready .env:

POSTGRES_PASSWORD="strong-random-password"
TEMPORAL_POSTGRES_PASSWORD="another-strong-random-password"
DATABASE_URL="postgresql://postsider:${POSTGRES_PASSWORD}@postgres:5432/postsider"
REDIS_URL="redis://redis:6379"
JWT_SECRET="generated-with-openssl-rand-base64-32"
ENCRYPTION_KEY="another-generated-key"
FRONTEND_URL="https://social.example.com"
NEXT_PUBLIC_BACKEND_URL="https://social.example.com/api"
BACKEND_URL="https://social.example.com"
RESEND_API_KEY="re_your_key"
EMAIL_FROM_ADDRESS="noreply@yourdomain.com"
EMAIL_FROM_NAME="PostSider"
DISABLE_REGISTRATION=true
RUN_CRON=true
STORAGE_PROVIDER="minio"
MINIO_ACCESS_KEY="generated-minio-access-key"
MINIO_SECRET_KEY="generated-minio-secret-key"
MINIO_BUCKET="postsider-media"
MINIO_PUBLIC_URL="https://social.example.com/storage"

Get Started

Core Concepts

Features

Settings

Channels

Configuration

Security

Resources

Environment variables for self-hosted PostSider

Core and URLs

Required secrets and database

Docker storage (MinIO)

Temporal

Self-hosting flags

Email

AI

Billing (Polar)

Generic OIDC / SSO

Short-link providers (optional)

Monitoring and analytics (optional)

Media and content

Public API rate limiting

Frontend build arguments

Other

Full example

​Core and URLs

​Required secrets and database

​Docker storage (MinIO)

​Temporal

​Self-hosting flags

​Email

​AI

​Social platform credentials

​Billing (Polar)

​Generic OIDC / SSO

​Short-link providers (optional)

​Monitoring and analytics (optional)

​Media and content

​Public API rate limiting

​Frontend build arguments

​Other

​Full example

Core and URLs

Required secrets and database

Docker storage (MinIO)

Temporal

Self-hosting flags

Email

AI

Social platform credentials

Billing (Polar)

Generic OIDC / SSO

Short-link providers (optional)

Monitoring and analytics (optional)

Media and content

Public API rate limiting

Frontend build arguments

Other

Full example