Harbor

Configuration

The settings the installer writes to /data/harbor.env, and what each one means. Change them with harbor config.

On this page

Most settings are made once by the installer. Since v0.4.0 the language model is chosen in Settings, not here. harbor config edits the file; harbor start applies it.

Where things are#

VariableMeaning
HARBOR_DATA_DIRWhere documents, database, queues and secrets live. Default /data. Must be on an encrypted volume.
HARBOR_IMAGE_TAGThe release the box runs. Changed by harbor config, applied by harbor upgrade.

Reaching the vault#

VariableMeaning
TS_AUTHKEYOptional. A Tailscale auth key, for Tailscale running as one of Harbor's containers. With it the vault is reachable only on your tailnet, over HTTPS, and nothing listens on the machine's own interfaces. Needed only on first start.
TAILSCALE_HOSTNAMEThe name the vault takes in your tailnet.
HARBOR_DOMAINFor the internet: the domain the vault is served at, over HTTPS.
HARBOR_PROXYWith HARBOR_DOMAIN: caddy answers on ports 80 and 443 with a Let's Encrypt certificate; own leaves that to a reverse proxy already on the machine, which forwards to HARBOR_WEB_PORT on 127.0.0.1.
HARBOR_SETUP_TOKENWith caddy: the token in the setup link. The first account can only be created through /setup?token= with it. Generated by the installer.
WEB_ORIGINThe address the vault is reached at, such as https://harbor.example.com or https://harbor.your-tailnet.ts.net. Sign-ins from any other address are refused.
HARBOR_BIND, HARBOR_WEB_PORTOn your own network, the address and port to publish on: a LAN address, or the address a VPN you run gives the box. Default 127.0.0.1:3000.
SESSION_COOKIE_SECUREtrue behind HTTPS, false on plain HTTP.

Backups#

VariableMeaning
RESTIC_REPOSITORYWhere snapshots go: b2:bucket:/harbor, sftp:user@host:/path, or /backup for a second disk.
B2_ACCOUNT_ID, B2_ACCOUNT_KEYThe Backblaze application key, restricted to that bucket and without the permission to delete.
HARBOR_BACKUP_DIRFor a second disk: the directory on the host mounted as /backup.
BACKUP_HOURWhen the nightly run starts. Default 3.
BACKUP_PRUNEfalse to keep every snapshot until you prune from a machine with a full key.
TZThe zone BACKUP_HOUR is read in, such as Europe/Berlin.

Reading documents#

VariableMeaning
OCR_CONCURRENCYPages read at once. Cores minus one on a small box.
OCR_LANGUAGESThe languages your paperwork arrives in, such as deu+eng.

Suggestions#

VariableMeaning
SUGGEST_SEND_PEOPLEfalse withholds your list of people and things from the model. Suggestions then arrive without a "who is this about" prefill. See The language model.

Mail#

VariableMeaning
MAIL_SYNC_INTERVAL_SECONDSHow often connected mailboxes are checked. Default 300.

The secrets, the master key and the backup password, are files under HARBOR_DATA_DIR/secrets, never variables. They belong on the envelope.