Advanced config

Databasus runs with sensible defaults out of the box — a standard single-container install needs no configuration at all. Every variable on this page is optional and not needed in 99% of production setups

OAuth

By default Databasus uses email and password sign-in. You can additionally let people sign in with their Google or GitHub account. A provider's button appears as soon as its client ID is set, but sign-in only completes when both the client ID and the client secret are present.

When you register the OAuth application, set its redirect (callback) URL to https://<your-domain>/auth/callback. Because of that redirect, OAuth sign-in needs your instance served over HTTPS on a public domain — see the note below.

HTTPS is required for sign-in and email. OAuth sign-in and email both need your instance reachable over HTTPS on a public domain — OAuth providers redirect the browser back to https://<your-domain>/auth/callback, and links inside emails must open for whoever receives them. A localhost-only or plain-HTTP instance cannot use these features. The simplest way to get HTTPS is the Caddy reverse proxy setup.

Google

Create an OAuth client in the Google Cloud Console (APIs & Services → Credentials → Create credentials → OAuth client ID, application type Web application) and add https://<your-domain>/auth/callback as an authorized redirect URI.

Variable	Description
`GOOGLE_CLIENT_ID`	Client ID of your Google OAuth client. Setting it shows the "Sign in with Google" button.
`GOOGLE_CLIENT_SECRET`	Client secret of your Google OAuth client. Required together with the ID for sign-in to work.

GitHub

Create an OAuth app under GitHub Developer settings (Settings → Developer settings → OAuth Apps → New OAuth App) and set the authorization callback URL to https://<your-domain>/auth/callback.

Variable	Description
`GITHUB_CLIENT_ID`	Client ID of your GitHub OAuth app. Setting it shows the "Sign in with GitHub" button.
`GITHUB_CLIENT_SECRET`	Client secret of your GitHub OAuth app. Required together with the ID for sign-in to work.

Email (SMTP)

Connect an SMTP server so Databasus can send transactional email such as password-reset links and workspace invitations. Email is treated as configured only when both SMTP_HOST and DATABASUS_URL are set — until then, email features stay hidden in the UI.

Variable	Description
`SMTP_HOST`	SMTP server hostname (e.g. `smtp.gmail.com`). Enables email together with `DATABASUS_URL`.
`SMTP_PORT`	SMTP server port (e.g. `587`). Must be a positive integer when `SMTP_HOST` is set.
`SMTP_USER`	Username for SMTP authentication.
`SMTP_PASSWORD`	Password for SMTP authentication. For Gmail, use an App Password — not your account password.
`SMTP_FROM`	The "From" address on outgoing email.
`SMTP_INSECURE_SKIP_VERIFY`	Set to `true` to skip TLS certificate verification when connecting to the SMTP server. Defaults to `false`. Use it only for servers with a self-signed certificate on a trusted network — it disables protection against man-in-the-middle attacks.
`DATABASUS_URL`	Public base URL of your instance (e.g. `https://backup.example.com`). Used to build links inside emails. Required together with `SMTP_HOST`.

If your instance is reachable from the public internet, you can put a Cloudflare Turnstile challenge on the sign-up and sign-in forms to keep bots out. Both keys come from the Turnstile dashboard, and the challenge activates only when both are set.

To stop external sign-ups entirely rather than just challenging them, you do not need a captcha at all — open Databasus settings → Allow sign up in the UI and turn it off. That closes the sign-up form completely.

Variable	Description
`CLOUDFLARE_TURNSTILE_SITE_KEY`	Public Turnstile site key, used to render the widget in the browser.
`CLOUDFLARE_TURNSTILE_SECRET_KEY`	Secret Turnstile key, used by the backend to validate challenge responses.

Telemetry

Databasus sends anonymous, non-identifying usage telemetry by default. It carries no personal data and helps us understand how the project is used. You can read exactly what is collected in the privacy policy, and you can turn it off completely.

Variable	Default	Description
`IS_DISABLE_ANONYMOUS_TELEMETRY`	`false`	Set to `true` to disable anonymous usage telemetry.

Logging

Databasus writes its logs to stdout and mirrors them as JSON to databasus.log on the data volume. Set OPEN_TELEMETRY_URL and it also exports them over Open Telemetry to a backend such as VictoriaLogs, Graylog, SigNoz, Grafana Loki, Datadog or Honeycomb, or to an OpenTelemetry Collector, which is itself an OTLP receiver.

Transport follows the scheme. http:// and https:// send OTLP/HTTP and use the URL verbatim, path included; grpc:// and grpcs:// send OTLP/gRPC and use only the host and port.
Authentication goes into OPEN_TELEMETRY_HEADERS or into the URL as user:password@host.
Secrets (passwords, tokens, credentials) inside URLs — are redacted before a record leaves the process.
Audit entries ship with the application logs tagged log_type=audit and ignore LOG_LEVEL, so raising the level never drops the audit trail.

Variable	Default	Description
`OPEN_TELEMETRY_URL`	—	Full OTLP endpoint URL, including the path. Leave unset to keep logs in the container. A query string, a missing host or an unknown scheme stops the container at startup instead of exporting nowhere.
`OPEN_TELEMETRY_HEADERS`	—	Comma-separated `key=value` pairs sent with every export, usually an API key. Values are percent-decoded, matching the standard `OTEL_EXPORTER_OTLP_HEADERS` format.
`LOG_LEVEL`	`info`	One of `debug`, `info`, `warn` or `error`. An unrecognised value falls back to `info`.
`LOG_FILE_IS_ENABLED`	`true`	Writes `databasus.log` next to the rest of the data, rotating at 5 MB and keeping 3 older files. Set to `false` if your platform already collects stdout.

Values for common backends, each with the header that authenticates it. Replace hosts, regions and keys with your own:

Backend	`OPEN_TELEMETRY_URL`	`OPEN_TELEMETRY_HEADERS`
VictoriaLogs	`http://victoria-logs:9428/insert/opentelemetry/v1/logs`	`Authorization=Basic%20dXNlcjpwYXNzd29yZA==` — the credentials your `vmauth` or reverse proxy expects, since VictoriaLogs itself has no auth on the ingest path.
OpenTelemetry Collector	`grpc://otel-collector:4317`	`Authorization=Bearer%20your-token` — matches a `bearertokenauth` or `basicauth` extension on the receiver. A Collector reachable only inside your network usually needs none.
Graylog 6.2+	`grpc://graylog:4317`	`Authorization=Bearer%20your-token` — the token set on the OpenTelemetry (gRPC) input. The input also accepts mTLS instead.
SigNoz Cloud	`grpcs://ingest.eu.signoz.cloud:443`	`signoz-ingestion-key=your-ingestion-key`
Grafana Cloud	`https://otlp-gateway-prod-eu-west-0.grafana.net/otlp/v1/logs`	`Authorization=Basic%20<base64>` — base64 of `instance-id:api-token`
Honeycomb	`https://api.honeycomb.io/v1/logs`	`x-honeycomb-team=your-api-key`
Datadog Agent	`grpc://datadog-agent:4317`	None — the Agent holds the API key and forwards on your behalf.

Header values are percent-decoded, so the space after Basic or Bearer is written as %20 and a comma inside a value as %2C. Basic auth can also go straight into the URL as https://user:password@host/path — Databasus turns it into the same header and keeps it out of the logs. Over http:// and grpc:// keys and passwords travel in clear, so use https:// or grpcs:// outside a trusted network.

Analytics script

Databasus can inject your own analytics or tracking snippet — Google Analytics, Plausible, Umami and similar into the app. When ANALYTICS_SCRIPT is set, its value is inserted into the page <head> at startup.

Security warning: the value is injected verbatim as raw HTML and JavaScript and runs with full access to the Databasus UI in every visitor's browser. Only ever set it to a snippet you fully control and trust.

Variable	Description
`ANALYTICS_SCRIPT`	Custom `<script>` markup injected before the closing `</head>` tag. Leave unset to add no analytics.