{ "schema_version": 1, "generated_at": "2026-10-22T00:00:00.000Z", "canonical_url": "https://openlogs.fyi/tools/wekan", "slug": "wekan", "name": "WeKan", "tagline": "Kanban board app built with Meteor for tracking cards across lists.", "replaces": { "summary": "Paid kanban board services, such as Trello.", "products": [ { "slug": "trello", "name": "Trello", "vendor": "Atlassian", "url": "https://openlogs.fyi/alternatives/trello" } ] }, "stack": [ { "kind": "language", "name": "JavaScript" } ], "deployment_methods": [ "docker_compose" ], "requirements": { "min_ram_mb": null, "min_cpu_cores": null, "source_url": null }, "license": { "spdx": "MIT", "class": "osi", "source_url": "https://github.com/wekan/wekan/blob/770acdcee64a5cc7a38ea987e78c4891d5c9061c/LICENSE" }, "business_model": { "value": "unknown", "notes": "The README at the pinned commit does not state a business model, so it stays unknown.", "source_url": "https://github.com/wekan/wekan/blob/770acdcee64a5cc7a38ea987e78c4891d5c9061c/README.md", "checked_at": "2026-10-22" }, "difficulty": { "value": "easy", "reason": "2 services, 3 volume mounts, no env values to set, no elevated host access. Heuristic score 2 of 11: easy." }, "repository": { "owner": "wekan", "name": "wekan", "url": "https://github.com/wekan/wekan" }, "compose_check": { "status": "config_ok", "validated_at": "2026-10-22", "summary": "config_ok on 2026-10-22" }, "recipe": { "version": 1, "source_path": "docker-compose.yml", "source_repo": "wekan/wekan", "source_commit_sha": "770acdcee64a5cc7a38ea987e78c4891d5c9061c", "source_kind": "app_repo", "source_url": "https://github.com/wekan/wekan/blob/770acdcee64a5cc7a38ea987e78c4891d5c9061c/docker-compose.yml" }, "install_steps": [ { "order": 1, "kind": "prerequisite", "language": "text", "label": "Docker with the Compose plugin", "body": "A host with Docker and the Docker Compose plugin. This entry runs from a compose file.", "source_url": "https://github.com/wekan/wekan/blob/770acdcee64a5cc7a38ea987e78c4891d5c9061c/docker-compose.yml", "validation_status": "unvalidated" }, { "order": 2, "kind": "compose", "language": "yaml", "label": "Save the compose file as docker-compose.yml", "body": "# This docker-compose.yml uses FerretDB v1 with SQLite from\n# https://github.com/wekan/FerretDB by default.\n#\n# WeKan with FerretDB v1 + embedded SQLite (no PostgreSQL, no MongoDB)\n#\n# This is the DEFAULT WeKan compose file (docker-compose.yml): a light,\n# self-contained database — FerretDB v1 (the wekan/FerretDB fork,\n# https://github.com/wekan/FerretDB) with its embedded pure-Go SQLite backend,\n# which speaks the MongoDB wire protocol. There is no separate PostgreSQL or\n# MongoDB server — FerretDB stores everything in SQLite files on a volume, and\n# WeKan stores attachments/avatars on the filesystem.\n#\n# The other WeKan compose files:\n# docker-compose.yml FerretDB v1 + SQLite (default)\n# docker-compose-ferretdb-v1-postgresql.yml FerretDB v1 + PostgreSQL\n# docker-compose-ferretdb-v1-mysql.yml FerretDB v1 + MySQL\n# docker-compose-ferretdb-v1-mariadb.yml FerretDB v1 + MariaDB\n# docker-compose-ferretdb-v1-sap-hana.yml FerretDB v1 + SAP HANA\n# docker-compose-ferretdb-v2-postgresql.yml FerretDB 2 + PostgreSQL\n# docker-compose-mongodb-v7.yml MongoDB 7\n# docker-compose-multitenancy.yml MongoDB, multitenancy example\n#\n# The FerretDB binary is downloaded (once, then cached on the volume) from the\n# newest wekan/FerretDB release: https://github.com/wekan/FerretDB/releases\n# Each platform is a separate ferretdb- asset there; the container downloads\n# only the one matching its architecture (amd64, arm64, ppc64le, s390x, riscv64, ...).\n#\n# Setup (this is the default docker-compose.yml, so no -f is needed):\n# docker compose up -d\n#\n# To follow the logs:\n# docker compose logs -f\n#\n# To stop:\n# docker compose down\n\nservices:\n\n # FerretDB v1 with the embedded SQLite backend (MongoDB-compatible on :27017).\n # A tiny Debian container fetches the wekan/FerretDB v1 release binary for its\n # architecture (cached on the volume and replaced when this required release\n # changes) and runs it.\n # SQLite data lives in /data/sqlite on the ferretdb-data volume.\n ferretdb:\n image: debian:bookworm-slim\n container_name: wekan-ferretdb\n restart: always\n environment:\n DO_NOT_TRACK: \"1\"\n FERRETDB_TELEMETRY: disable\n # Follow the newest published release. A specific download/vX.Y.Z remains\n # available for rollback; the marker below upgrades an older cached binary.\n FERRETDB_RELEASE: ${FERRETDB_RELEASE:-latest/download}\n command:\n - sh\n - -c\n - |\n set -eu\n BIN=/data/bin/ferretdb\n RELEASE_FILE=/data/bin/ferretdb.release\n if ! command -v curl >/dev/null 2>&1; then\n apt-get update -qq\n apt-get install -y -qq --no-install-recommends curl ca-certificates >/dev/null\n fi\n DOWNLOAD_RELEASE=\"$$FERRETDB_RELEASE\"\n REQUIRED_RELEASE=\"$$FERRETDB_RELEASE\"\n if [ \"$$FERRETDB_RELEASE\" = latest/download ]; then\n LATEST_URL=\"$$(curl -fsSIL --retry 5 -o /dev/null -w '%{url_effective}' \\\n https://github.com/wekan/FerretDB/releases/latest)\"\n REQUIRED_RELEASE=\"$${LATEST_URL##*/}\"\n [ -n \"$$REQUIRED_RELEASE\" ]\n DOWNLOAD_RELEASE=\"download/$$REQUIRED_RELEASE\"\n fi\n CACHED_RELEASE=\"$$(cat \"$$RELEASE_FILE\" 2>/dev/null || true)\"\n if [ ! -x \"$$BIN\" ] || [ \"$$CACHED_RELEASE\" != \"$$REQUIRED_RELEASE\" ]; then\n echo \"Fetching newest FerretDB v1 $${REQUIRED_RELEASE} from the wekan/FerretDB release ...\"\n arch=\"$$(dpkg --print-architecture)\"\n case \"$$arch\" in ppc64el) arch=ppc64le ;; esac\n mkdir -p /data/bin\n # Download only this arch's binary (per-arch release assets, no ferretdb.zip).\n curl -fSL --retry 5 -o \"$$BIN.new\" \\\n \"https://github.com/wekan/FerretDB/releases/$${DOWNLOAD_RELEASE}/ferretdb-$${arch}\"\n curl -fSL --retry 5 -o \"$$BIN.new.sha256sum\" \\\n \"https://github.com/wekan/FerretDB/releases/$${DOWNLOAD_RELEASE}/ferretdb-$${arch}.sha256sum\"\n EXPECTED=\"$$(awk '{print $$1; exit}' \"$$BIN.new.sha256sum\")\"\n ACTUAL=\"$$(sha256sum \"$$BIN.new\" | awk '{print $$1}')\"\n [ -n \"$$EXPECTED\" ] && [ \"$$ACTUAL\" = \"$$EXPECTED\" ]\n chmod +x \"$$BIN.new\"\n mv \"$$BIN.new\" \"$$BIN\"\n rm \"$$BIN.new.sha256sum\"\n printf '%s\\n' \"$$REQUIRED_RELEASE\" > \"$$RELEASE_FILE\"\n chmod +x \"$$BIN\"\n fi\n mkdir -p /data/files/db\n # --repl-set-name only makes FerretDB keep local.oplog.rs, which Admin Panel /\n # Attachments / Continuous backup streams the database from (maintainer\n # decision of 2026-10-03). WeKan itself still polls: no MONGO_OPLOG_URL.\n exec \"$$BIN\" \\\n --handler=sqlite \\\n --sqlite-url=file:/data/files/db/ \\\n --listen-addr=0.0.0.0:27017 \\\n --repl-set-name=rs0 \\\n --telemetry=disable \\\n --log-level=error\n # Healthy only once FerretDB is actually accepting connections on 27017 — i.e.\n # AFTER the first-run binary download (apt-get + curl) has finished and the server\n # is listening. WeKan's depends_on: condition: service_healthy waits for this, so it\n # never starts against a not-yet-ready database (which showed up as the browser\n # getting \"Connection reset by peer\" on a fresh `docker compose up`). bash + /dev/tcp\n # needs no extra tools in debian-slim. start_period covers a slow first download.\n healthcheck:\n test: [\"CMD-SHELL\", \"bash -c '/dev/null\"]\n interval: 5s\n timeout: 3s\n retries: 40\n start_period: 30s\n volumes:\n - ferretdb-data:/data\n networks:\n - wekan-tier\n # Expose only on localhost by default; remove to keep it internal to the network.\n ports:\n - 127.0.0.1:27017:27017\n\n wekan:\n #-------------------------------------------------------------------------------------\n # ==== WEKAN FROM GITHUB/QUAY/DOCKER HUB ====\n # All of GitHub, Quay and Docker Hub have latest, but because\n # latest tag changes when is newest release,\n # when upgrading would be better to use version tag.\n # a) Using specific version tag is better:\n # image: ghcr.io/wekan/wekan:v6.89\n # image: quay.io/wekan/wekan:v6.89\n # image: wekanteam/wekan:v6.89\n # b) GitHub Container registry.\n # b1) Latest release tag:\n image: ghcr.io/wekan/wekan:latest\n # b2) Newest git commit automatic build:\n #image: ghcr.io/wekan/wekan:main\n # c) Quay:\n #image: quay.io/wekan/wekan:latest\n # d) Docker Hub:\n #image: wekanteam/wekan:latest\n #-------------------------------------------------------------------------------------\n container_name: wekan-app\n # On CentOS 7 there is seccomp issue with glibc 6,\n # so CentOS 7 users shoud use these security_opt seccomp:unconfined\n # settings to get WeKan working. See:\n # - https://github.com/wekan/wekan/issues/4585\n # - https://github.com/wekan/wekan/issues/4587\n #security_opt:\n # - seccomp:unconfined\n restart: always\n networks:\n - wekan-tier\n #-------------------------------------------------------------------------------------\n # ==== BUILD wekan-app DOCKER CONTAINER FROM SOURCE, if you uncomment these ====\n # ==== and use commands: docker compose up -d --build\n #build:\n # context: .\n # dockerfile: Dockerfile\n #-------------------------------------------------------------------------------------\n ports:\n # Docker outsideport:insideport. Do not add anything extra here.\n # For example, if you want to have wekan on port 3001,\n # use 3001:8080 . Do not add any extra address etc here, that way it does not work.\n # remove port mapping if you use nginx reverse proxy, port 8080 is already exposed to wekan-tier network\n - 80:8080\n environment:\n # FerretDB v1 deployments are polling-only. Use docker-compose-mongodb-v7.yml\n # for MongoDB replica-set/change-stream reactivity.\n - DEFAULT_METEOR_REACTIVITY_ORDER=polling\n - METEOR_REACTIVITY_ORDER=polling\n # uws does not work at s390x. sockjs works.\n # sockjs is the only transport WeKan ships: no bundle or image carries\n # uWebSockets.js, and DDP_TRANSPORT=uws is coerced to sockjs at startup.\n - DDP_TRANSPORT=sockjs\n #-----------------------------------------------------------------\n # ==== WRITEABLE PATH FOR FILE UPLOADS ====\n - WRITABLE_PATH=/data\n #-----------------------------------------------------------------\n # ==== AWS S3 FOR FILES ====\n # Any region. For example:\n # us-standard,us-west-1,us-west-2,\n # eu-west-1,eu-central-1,\n # ap-southeast-1,ap-northeast-1,sa-east-1\n #\n #- S3='{\"s3\":{\"key\": \"xxx\", \"secret\": \"xxx\", \"bucket\": \"xxx\", \"region\": \"xxx\"}}'\n #- S3_SECRET_KEY_FILE=/run/secrets/s3_secret_key\n #-----------------------------------------------------------------\n # ==== MONGO_URL — points to FerretDB (MongoDB-compatible) ====\n #- MONGO_URL=mongodb://wekan-ferretdb:27017/wekan?directConnection=true\n # directConnection: FerretDB answers as a one-member replica set whose\n # member is its listen address 0.0.0.0, which is nowhere from this container.\n - MONGO_URL=mongodb://ferretdb:27017/wekan?directConnection=true\n #- MONGO_URL_FILE=/run/secrets/mongo_url\n #---------------------------------------------------------------\n # ==== ROOT_URL SETTING ====\n # Change ROOT_URL to your real Wekan URL, for example:\n # If you have Caddy/Nginx/Apache providing SSL\n # - https://example.com\n # - https://boards.example.com\n # This can be problematic with avatars https://github.com/wekan/wekan/issues/1776\n # - https://example.com/wekan\n # If without https, can be only wekan node, no need for Caddy/Nginx/Apache if you don't need them\n # - http://example.com\n # - http://boards.example.com\n # - http://192.168.1.100 <=== using at local LAN\n - ROOT_URL=http://localhost # <=== using only at same laptop/desktop where Wekan is installed\n #---------------------------------------------------------------\n # ==== EMAIL SETTINGS ====\n # In Admin Panel / People / Email, enable \"Enable below email settings\"\n # to reveal additional email sending options below the checkbox.\n # see https://github.com/wekan/wekan/blob/main/docs/Email/Troubleshooting-Mail.md\n # For SSL in email, change smtp:// to smtps://\n # NOTE: Special characters need to be url-encoded in MAIL_URL.\n # You can encode those characters for example at: https://www.urlencoder.org\n #- MAIL_URL=smtp://user:pass@mailserver.example.com:25/\n - MAIL_URL=smtp://:25/?ignoreTLS=true&tls={rejectUnauthorized:false}\n - MAIL_FROM=Wekan Notifications \n # Currently MAIL_SERVICE is not in use.\n #- MAIL_SERVICE=Outlook365\n #- MAIL_SERVICE_USER=firstname.lastname@hotmail.com\n #- MAIL_SERVICE_PASSWORD=SecretPassword\n #- MAIL_URL_FILE=/run/secrets/mail_url\n #---------------------------------------------------------------\n # https://github.com/wekan/wekan/issues/3585#issuecomment-1021522132\n # Add more Node heap, this is done by default at Dockerfile:\n # - NODE_OPTIONS=\"--max_old_space_size=4096\"\n # Add more stack, this is done at Dockerfile:\n # bash -c \"ulimit -s 65500; exec node --stack-size=65500 main.js\"\n #---------------------------------------------------------------\n # ==== OPTIONAL: KADIRA PERFORMANCE MONITORING FOR METEOR ====\n # https://github.com/edemaine/kadira-compose\n # https://github.com/meteor/meteor-apm-agent\n # https://blog.meteor.com/kadira-apm-is-now-open-source-490469ffc85f\n #- APM_OPTIONS_ENDPOINT=http://:11011\n #- APM_APP_ID=\n #- APM_APP_SECRET=\n #---------------------------------------------------------------\n # ==== OPTIONAL: LOGS AND STATS ====\n # https://github.com/wekan/wekan/blob/main/docs/Features/Logs.md\n #\n # Daily export of Wekan changes as JSON to Logstash and ElasticSearch / Kibana (ELK)\n # https://github.com/wekan/wekan-logstash\n #\n # Statistics Python script for Wekan Dashboard\n # https://github.com/wekan/wekan-stats\n #\n # The legacy Winston/Zulip database-change logger was removed in 2017:\n # replacing Meteor's default console transport could prevent database startup (#1094).\n # Use the current logging integrations documented above instead.\n #\n # There is Feature Request: Logging date and time of all activity with summary reports,\n # and requesting reason for changing card to other column https://github.com/wekan/wekan/issues/1598\n #---------------------------------------------------------------\n # ==== NUMBER OF SEARCH RESULTS PER PAGE BY DEFAULT ====\n #- RESULTS_PER_PAGE=20\n #---------------------------------------------------------------\n # ==== AFTER OIDC LOGIN, ADD USERS AUTOMATICALLY TO THIS BOARD ID ====\n # https://github.com/wekan/wekan/pull/5098\n #- DEFAULT_BOARD_ID=abcd1234\n #---------------------------------------------------------------\n # ==== WEKAN API AND EXPORT BOARD ====\n # Wekan Export Board works when WITH_API=true.\n # https://github.com/wekan/wekan/blob/main/docs/API/REST-API.md\n # https://github.com/wekan/wekan-gogs\n # If you disable Wekan API with false, Export Board does not work.\n - WITH_API=true\n #---------------------------------------------------------------\n # ==== PASSWORD BRUTE FORCE PROTECTION ====\n #https://atmospherejs.com/lucasantoniassi/accounts-lockout\n #Defaults below. Uncomment to change. wekan/server/accounts-lockout.js\n #- ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURES_BEFORE=3\n #- ACCOUNTS_LOCKOUT_KNOWN_USERS_PERIOD=60\n #- ACCOUNTS_LOCKOUT_KNOWN_USERS_FAILURE_WINDOW=15\n #- ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURES_BERORE=3\n #- ACCOUNTS_LOCKOUT_UNKNOWN_USERS_LOCKOUT_PERIOD=60\n #- ACCOUNTS_LOCKOUT_UNKNOWN_USERS_FAILURE_WINDOW=15\n #---------------------------------------------------------------\n # ==== ACCOUNT OPTIONS ====\n # https://docs.meteor.com/api/accounts-multi.html#AccountsCommon-config\n # Defaults below. Uncomment to change. wekan/server/accounts-common.js\n # - ACCOUNTS_COMMON_LOGIN_EXPIRATION_IN_DAYS=90\n #---------------------------------------------------------------\n #---------------------------------------------------------------\n # ==== CARD LOADING: all (default) or lazy ====\n # 'all' = load every card of a board into the browser (default).\n # 'lazy' = each list loads only the cards currently visible\n # (infinite scroll) plus a live count, so boards with\n # thousands of cards use less memory/bandwidth.\n # Also changeable at runtime in Admin Panel / Features.\n - CARDS_LOADING=auto\n #---------------------------------------------------------------\n # ==== CARD OPENED, SEND WEBHOOK MESSAGE ====\n # https://github.com/wekan/wekan/issues/2518\n - CARD_OPENED_WEBHOOK_ENABLED=false\n #---------------------------------------------------------------\n # ==== Allow configuration to validate uploaded attachments ====\n #-ATTACHMENTS_UPLOAD_EXTERNAL_PROGRAM=/usr/local/bin/avscan {file}\n #-ATTACHMENTS_UPLOAD_MIME_TYPES=image/*,text/*\n #-ATTACHMENTS_UPLOAD_MAX_SIZE=5000000\n #---------------------------------------------------------------\n # ==== Allow configuration to validate uploaded avatars ====\n #-AVATARS_UPLOAD_EXTERNAL_PROGRAM=/usr/local/bin/avscan {file}\n #-AVATARS_UPLOAD_MIME_TYPES=image/*\n #-AVATARS_UPLOAD_MAX_SIZE=500000\n # DEFAULT_AVATAR_URL : avatar of users who have not set one, a URL with {username},\n # {userId}, {emailMd5} or {emailSha256} replaced. Example: http://192.168.1.200/avatars/{username}.png\n #- DEFAULT_AVATAR_URL=\n #---------------------------------------------------------------\n # ==== Allow to shrink attached/pasted image ====\n # https://github.com/wekan/wekan/pull/2544\n #- MAX_IMAGE_PIXEL=1024\n #- IMAGE_COMPRESS_RATIO=80\n #---------------------------------------------------------------\n # ==== NOTIFICATION TRAY AFTER READ DAYS BEFORE REMOVE =====\n # Number of days after a notification is read before we remove it.\n # Default: 2\n #- NOTIFICATION_TRAY_AFTER_READ_DAYS_BEFORE_REMOVE=2\n #---------------------------------------------------------------\n # ==== BIGEVENTS DUE ETC NOTIFICATIONS =====\n # https://github.com/wekan/wekan/pull/2541\n # Introduced a system env var BIGEVENTS_PATTERN default as \"NONE\",\n # so any activityType matches the pattern, system will send out\n # notifications to all board members no matter they are watching\n # or tracking the board or not. Owner of the wekan server can\n # disable the feature by setting this variable to \"NONE\" or\n # change the pattern to any valid regex. i.e. '|' delimited\n # activityType names.\n # a) Example\n #- BIGEVENTS_PATTERN=due\n # b) All\n #- BIGEVENTS_PATTERN=received|start|due|end\n # c) Disabled\n - BIGEVENTS_PATTERN=NONE\n #---------------------------------------------------------------\n # ==== NOTIFY ON ASSIGN =====\n # Notify the user directly when they are added as a card member or\n # assignee. Set false to disable.\n #- NOTIFY_ON_ASSIGN=true\n #---------------------------------------------------------------\n # ==== EMAIL DUE DATE NOTIFICATION =====\n # https://github.com/wekan/wekan/pull/2536\n # System timelines will be showing any user modification for\n # dueat startat endat receivedat, also notification to\n # the watchers and if any card is due, about due or past due.\n #\n # Notify due days, default is None, 2 days before and on the event day\n #- NOTIFY_DUE_DAYS_BEFORE_AND_AFTER=2,0\n #\n # Notify due at hour of day. Default every morning at 8am. Can be 0-23.\n # If env variable has parsing error, use default. Notification sent to watchers.\n #- NOTIFY_DUE_AT_HOUR_OF_DAY=8\n #-----------------------------------------------------------------\n # ==== EMAIL NOTIFICATION TIMEOUT, ms =====\n # Default: 30000 ms = 30s\n #- EMAIL_NOTIFICATION_TIMEOUT=30000\n #-----------------------------------------------------------------\n # ==== CORS =====\n # CORS: Set Access-Control-Allow-Origin header.\n #- CORS=*\n # CORS_ALLOW_HEADERS: Set Access-Control-Allow-Headers header. \"Authorization,Content-Type\" is required for cross-origin use of the API.\n #- CORS_ALLOW_HEADERS=Authorization,Content-Type\n # CORS_EXPOSE_HEADERS: Set Access-Control-Expose-Headers header. This is not needed for typical CORS situations\n #- CORS_EXPOSE_HEADERS=*\n #-----------------------------------------------------------------\n # ==== MATOMO INTEGRATION ====\n # Optional: Integration with Matomo https://matomo.org that is installed to your server\n # The address of the server where Matomo is hosted.\n #- MATOMO_ADDRESS=https://example.com/matomo\n # The value of the site ID given in Matomo server for Wekan\n #- MATOMO_SITE_ID=1\n # The option do not track which enables users to not be tracked by matomo\n #- MATOMO_DO_NOT_TRACK=true\n # The option that allows matomo to retrieve the username:\n #- MATOMO_WITH_USERNAME=true\n #-----------------------------------------------------------------\n # ==== BROWSER POLICY AND TRUSTED IFRAME URL ====\n # Enable browser policy and allow one trusted URL that can have iframe that has Wekan embedded inside.\n # Setting this to false is not recommended, it also disables all other browser policy protections\n # and allows all iframing etc. See wekan/server/policy.js\n - BROWSER_POLICY_ENABLED=true\n # When browser policy is enabled, HTML code at this Trusted URL can have iframe that embeds Wekan inside.\n #- TRUSTED_URL=https://intra.example.com\n #-----------------------------------------------------------------\n # ==== METRICS ALLOWED IP ADDRESSES ====\n # https://github.com/wekan/wekan/blob/main/docs/Features/Metrics.md\n #- METRICS_ALLOWED_IP_ADDRESSES=192.168.0.100,192.168.0.200\n #-----------------------------------------------------------------\n # ==== OUTGOING WEBHOOKS ====\n # What to send to Outgoing Webhook, or leave out. If commented out the default values will be: cardId,listId,oldListId,boardId,comment,user,card,commentId,swimlaneId,customerField,customFieldValue\n #- WEBHOOKS_ATTRIBUTES=cardId,listId,oldListId,boardId,comment,user,card,board,list,swimlane,commentId\n #-----------------------------------------------------------------\n # ==== Debug OIDC OAuth2 etc ====\n #- DEBUG=true\n #---------------------------------------------\n # ==== AUTOLOGIN WITH OIDC/OAUTH2 ====\n # https://github.com/wekan/wekan/blob/main/docs/Login/autologin.md\n #- OIDC_REDIRECTION_ENABLED=true\n # OIDC RP-initiated logout endpoint (end_session_endpoint). When set, the\n # \"Log Out\" menu redirects to this endpoint so the identity provider session\n # is also ended and the user is returned to Wekan (ROOT_URL) via\n # post_logout_redirect_uri, instead of landing on the provider home page\n # (which errors for non-admin users). See https://github.com/wekan/wekan/issues/6158\n # Keycloak example:\n #- OAUTH2_LOGOUT_ENDPOINT=/realms//protocol/openid-connect/logout\n #-----------------------------------------------------------------\n # ==== OAUTH2 ORACLE on premise identity manager OIM ====\n #- ORACLE_OIM_ENABLED=true\n #-----------------------------------------------------------------\n # ==== OAUTH2 AZURE ====\n # https://github.com/wekan/wekan/blob/main/docs/Login/Azure/Azure.md\n # 1) Register the application with Azure. Make sure you capture\n # the application ID as well as generate a secret key.\n # 2) Configure the environment variables. This differs slightly\n # by installation type, but make sure you have the following:\n #- OAUTH2_ENABLED=true\n # Optional OAuth2 CA Cert, see https://github.com/wekan/wekan/issues/3299\n #- OAUTH2_CA_CERT=ABCD1234\n # Use OAuth2 ADFS additional changes. Also needs OAUTH2_ENABLED=true setting.\n #- OAUTH2_ADFS_ENABLED=false\n # Azure AD B2C. https://github.com/wekan/wekan/issues/5242\n #- OAUTH2_B2C_ENABLED=false\n # SECURITY (GHSA-mp7g-hj5q-gxhq): Link an OIDC login to a pre-existing\n # Wekan account (password/LDAP) with the same email. OFF by default; when\n # false an OIDC login whose email already exists is rejected instead of\n # merged, preventing account takeover via spoofed email claims. Only\n # enable if you fully trust your OIDC provider's email claims, and even\n # then the provider must send email_verified=true for the merge to happen.\n #- OAUTH2_MERGE_EXISTING_USERS=false\n # When false, OAuth2/OIDC login is refused for users that do not already\n # have a Wekan account (matched by verified email).\n #- OAUTH2_AUTO_REGISTRATION=true\n # Comma/space separated OAuth2/OIDC group names whose members become Wekan\n # admins. Empty = off.\n #- OAUTH2_ADMIN_GROUPS=\n # OAuth2 login style: redirect (default) or popup.\n #- OAUTH2_LOGIN_STYLE=redirect\n # Application GUID captured during app registration:\n #- OAUTH2_CLIENT_ID=xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx\n # Secret key generated during app registration:\n #- OAUTH2_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\n #- OAUTH2_SECRET_FILE=/run/secrets/oauth2_secret\n #- OAUTH2_SERVER_URL=https://login.microsoftonline.com/\n #- OAUTH2_AUTH_ENDPOINT=/oauth2/v2.0/authorize\n #- OAUTH2_USERINFO_ENDPOINT=https://graph.microsoft.com/oidc/userinfo\n #- OAUTH2_TOKEN_ENDPOINT=/oauth2/v2.0/token\n # The claim name you want to map to the unique ID field:\n #- OAUTH2_ID_MAP=email\n # The claim name you want to map to the username field:\n #- OAUTH2_USERNAME_MAP=email\n # The claim name you want to map to the full name field:\n #- OAUTH2_FULLNAME_MAP=name\n # The claim name you want to map to the email field:\n #- OAUTH2_EMAIL_MAP=email\n # Optional exact email domains for generic OAuth2/OIDC login (on-premise supported).\n #- OAUTH2_ALLOWED_EMAIL_DOMAINS=example.internal,other.internal\n # OAUTH2_DEFAULT_ORGANIZATION : an existing organization that every account\n # created by an OAuth2/OIDC login joins (short name, display name or id).\n #- OAUTH2_DEFAULT_ORGANIZATION=Nextcloud users\n #-----------------------------------------------------------------\n # ==== OAUTH2 Nextcloud ====\n # 1) Register the application with Nextcloud: https://your.nextcloud/index.php/settings/admin/security\n # Make sure you capture the application ID as well as generate a secret key.\n # Use https://your.wekan/_oauth/oidc for the redirect URI.\n # 2) Configure the environment variables. This differs slightly\n # by installation type, but make sure you have the following:\n #- OAUTH2_ENABLED=true\n # OAuth2 login style: redirect (default) or popup.\n #- OAUTH2_LOGIN_STYLE=redirect\n # Application GUID captured during app registration:\n #- OAUTH2_CLIENT_ID=xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx\n # Secret key generated during app registration:\n #- OAUTH2_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\n #- OAUTH2_SECRET_FILE=/run/secrets/oauth2_secret\n #- OAUTH2_SERVER_URL=https://your-nextcloud.tld\n #- OAUTH2_AUTH_ENDPOINT=/index.php/apps/oauth2/authorize\n #- OAUTH2_USERINFO_ENDPOINT=/ocs/v2.php/cloud/user?format=json\n #- OAUTH2_TOKEN_ENDPOINT=/index.php/apps/oauth2/api/v1/token\n # The claim name you want to map to the unique ID field:\n #- OAUTH2_ID_MAP=id\n # The claim name you want to map to the username field:\n #- OAUTH2_USERNAME_MAP=id\n # The claim name you want to map to the full name field:\n #- OAUTH2_FULLNAME_MAP=display-name\n # The claim name you want to map to the email field:\n #- OAUTH2_EMAIL_MAP=email\n #-----------------------------------------------------------------\n # ==== OAUTH2 KEYCLOAK ====\n # https://github.com/wekan/wekan/blob/main/docs/Login/Keycloak/Keycloak.md <== MAPPING INFO, REQUIRED\n #- OAUTH2_ENABLED=true\n # OAuth2 login style: redirect (default) or popup.\n #- OAUTH2_LOGIN_STYLE=redirect\n #- OAUTH2_CLIENT_ID=\n #- OAUTH2_SERVER_URL=\n #- OAUTH2_AUTH_ENDPOINT=/realms//protocol/openid-connect/auth\n #- OAUTH2_USERINFO_ENDPOINT=/realms//protocol/openid-connect/userinfo\n #- OAUTH2_TOKEN_ENDPOINT=/realms//protocol/openid-connect/token\n #- OAUTH2_SECRET=\n #- OAUTH2_SECRET_FILE=/run/secrets/oauth2_secret\n #- OAUTH2_ID_MAP=sub\n #- OAUTH2_USERNAME_MAP=preferred_username\n #- OAUTH2_EMAIL_MAP=email\n #- OAUTH2_FULLNAME_MAP=name\n #-----------------------------------------------------------------\n # ==== OAUTH2 AUTHELIA ====\n # https://github.com/wekan/wekan/blob/main/docs/Features/Login-Page/Authelia.md <== MAPPING INFO, REQUIRED\n # https://www.authelia.com/integration/openid-connect/introduction/\n #- OAUTH2_ENABLED=true\n # OAuth2 login style: redirect (default) or popup.\n #- OAUTH2_LOGIN_STYLE=redirect\n #- OAUTH2_CLIENT_ID=\n #- OAUTH2_SERVER_URL=https://auth.yourserver.com\n #- OAUTH2_AUTH_ENDPOINT=/api/oidc/authorization\n #- OAUTH2_USERINFO_ENDPOINT=/api/oidc/userinfo\n #- OAUTH2_TOKEN_ENDPOINT=/api/oidc/token\n #- OAUTH2_SECRET=\n #- OAUTH2_SECRET_FILE=/run/secrets/oauth2_secret\n #- OAUTH2_ID_MAP=sub\n #- OAUTH2_USERNAME_MAP=preferred_username\n #- OAUTH2_EMAIL_MAP=email\n #- OAUTH2_FULLNAME_MAP=name\n #- OAUTH2_REQUEST_PERMISSIONS=openid profile email\n #-----------------------------------------------------------------\n # ==== OAUTH2 DOORKEEPER ====\n # https://github.com/wekan/wekan/issues/1874\n # https://github.com/wekan/wekan/blob/main/docs/Login/OAuth2.md2\n # Enable the OAuth2 connection\n #- OAUTH2_ENABLED=true\n # OAuth2 docs: https://github.com/wekan/wekan/blob/main/docs/Login/OAuth2.md\n # OAuth2 login style: redirect (default) or popup.\n #- OAUTH2_LOGIN_STYLE=redirect\n # OAuth2 Client ID.\n #- OAUTH2_CLIENT_ID=abcde12345\n # OAuth2 Secret.\n #- OAUTH2_SECRET=54321abcde\n #- OAUTH2_SECRET_FILE=/run/secrets/oauth2_secret\n # OAuth2 Server URL.\n #- OAUTH2_SERVER_URL=https://chat.example.com\n # OAuth2 Authorization Endpoint.\n #- OAUTH2_AUTH_ENDPOINT=/oauth/authorize\n # OAuth2 Userinfo Endpoint.\n #- OAUTH2_USERINFO_ENDPOINT=/oauth/userinfo\n # OAuth2 Token Endpoint.\n #- OAUTH2_TOKEN_ENDPOINT=/oauth/token\n # OAUTH2 ID Token Whitelist Fields.\n #- OAUTH2_ID_TOKEN_WHITELIST_FIELDS=\"\"\n # OAUTH2 Request Permissions.\n #- OAUTH2_REQUEST_PERMISSIONS=openid profile email\n # OAuth2 ID Mapping\n #- OAUTH2_ID_MAP=\n # OAuth2 Username Mapping\n #- OAUTH2_USERNAME_MAP=\n # OAuth2 Fullname Mapping\n #- OAUTH2_FULLNAME_MAP=\n # OAuth2 Email Mapping\n #- OAUTH2_EMAIL_MAP=\n #-----------------------------------------------------------------\n # ==== LDAP: UNCOMMENT ALL TO ENABLE LDAP ====\n # https://github.com/wekan/wekan/blob/main/docs/Login/LDAP.md\n # For Snap settings see https://github.com/wekan/wekan/blob/main/docs/Platforms/FOSS/Container/Snap/Supported-settings-keys.md\n # Most settings work both on Snap and Docker below.\n # Note: Do not add single quotes '' to variables. Having spaces still works without quotes where required.\n #\n # The default authentication method used if a user does not exist to create and authenticate. Can be set as ldap.\n # (this is set properly in the Admin Panel, changing this item does not remove Password login option)\n #- DEFAULT_AUTHENTICATION_METHOD=ldap\n #\n # Enable or not the connection by the LDAP\n #- LDAP_ENABLE=true\n #\n # The port of the LDAP server\n #- LDAP_PORT=389\n #\n # The host server for the LDAP server\n #- LDAP_HOST=localhost\n #\n #-----------------------------------------------------------------\n # ==== LDAP AD Simple Auth ====\n #\n # Set to true, if you want to connect with Active Directory by Simple Authentication.\n # When using AD Simple Auth, LDAP_BASEDN is not needed.\n #\n # Example:\n #- LDAP_AD_SIMPLE_AUTH=true\n #\n # === LDAP User Authentication ===\n #\n # a) Option to login to the LDAP server with the user's own username and password, instead of\n # an administrator key. Default: false (use administrator key).\n #\n # b) When using AD Simple Auth, set to true, when login user is used for binding,\n # and LDAP_BASEDN is not needed.\n #\n # Example:\n #- LDAP_USER_AUTHENTICATION=true\n #\n # Which field is used to find the user for the user authentication. Default: uid.\n #- LDAP_USER_AUTHENTICATION_FIELD=uid\n #\n # === LDAP Default Domain ===\n #\n # a) In case AD SimpleAuth is configured, the default domain is appended to the given\n # loginname for creating the correct username for the bind request to AD.\n #\n # b) The default domain of the ldap it is used to create email if the field is not map\n # correctly with the LDAP_SYNC_USER_DATA_FIELDMAP\n #\n # Example :\n #- LDAP_DEFAULT_DOMAIN=mydomain.com\n #\n #-----------------------------------------------------------------\n # ==== LDAP BASEDN Auth ====\n #\n # The base DN for the LDAP Tree\n #- LDAP_BASEDN=ou=user,dc=example,dc=org\n #\n #-----------------------------------------------------------------\n # Fallback on the default authentication method\n #- LDAP_LOGIN_FALLBACK=false\n #\n # Reconnect to the server if the connection is lost\n #- LDAP_RECONNECT=true\n #\n # Overall timeout, in milliseconds\n #- LDAP_TIMEOUT=10000\n #\n # Specifies the timeout for idle LDAP connections in milliseconds\n #- LDAP_IDLE_TIMEOUT=10000\n #\n # Connection timeout, in milliseconds\n #- LDAP_CONNECT_TIMEOUT=10000\n #\n # If the LDAP needs a user account to search\n #- LDAP_AUTHENTIFICATION=true\n #\n # The search user DN - You need quotes when you have spaces in parameters\n # 2 examples:\n #- LDAP_AUTHENTIFICATION_USERDN=CN=ldap admin,CN=users,DC=domainmatter,DC=lan\n #- LDAP_AUTHENTIFICATION_USERDN=CN=wekan_adm,OU=serviceaccounts,OU=admin,OU=prod,DC=mydomain,DC=com\n #\n # The password for the search user\n #- LDAP_AUTHENTIFICATION_PASSWORD=pwd\n #- LDAP_AUTHENTIFICATION_PASSWORD_FILE=/run/secrets/ldap_auth_password\n #\n # Enable logs for the module\n #- LDAP_LOG_ENABLED=true\n #\n # If the sync of the users should be done in the background\n #- LDAP_BACKGROUND_SYNC=false\n #\n # LDAP_BACKGROUND_SYNC_INTERVAL : How often the background task syncs: milliseconds (3600000 = hourly) or text\n # Text is later.js text, quotes allowed, as specified in:\n # https://bunkat.github.io/later/parsers.html#text\n #- LDAP_BACKGROUND_SYNC_INTERVAL=every 1 hours\n # Unset or empty uses the default (hourly). A value it cannot read is logged\n # and the default is used; it no longer stops WeKan (#2354).\n # https://github.com/wekan/wekan/issues/2354#issuecomment-515305722\n - LDAP_BACKGROUND_SYNC_INTERVAL=''\n #\n #- LDAP_BACKGROUND_SYNC_KEEP_EXISTANT_USERS_UPDATED=false\n #\n #- LDAP_BACKGROUND_SYNC_IMPORT_NEW_USERS=false\n #\n # LDAP_BACKGROUND_SYNC_DISABLE_NONEXISTANT_USERS : When true, the LDAP\n # background sync disables users no longer present in LDAP (and re-enables\n # them when they reappear).\n #- LDAP_BACKGROUND_SYNC_DISABLE_NONEXISTANT_USERS=false\n #\n # If using LDAPS: LDAP_ENCRYPTION=ssl\n #- LDAP_ENCRYPTION=false\n #\n # The certification for the LDAPS server. Certificate needs to be included in this docker compose.yml file.\n #- LDAP_CA_CERT=-----BEGIN CERTIFICATE-----MIIE+G2FIdAgIC...-----END CERTIFICATE-----\n #\n # Reject Unauthorized Certificate\n #- LDAP_REJECT_UNAUTHORIZED=false\n #\n # Optional extra LDAP filters. Don't forget the outmost enclosing parentheses if needed\n #- LDAP_USER_SEARCH_FILTER=\n #\n # base (search only in the provided DN), one (search only in the provided DN and one level deep), or sub (search the whole subtree)\n #- LDAP_USER_SEARCH_SCOPE=one\n #\n # Which field is used to find the user, like uid / sAMAccountName\n #- LDAP_USER_SEARCH_FIELD=sAMAccountName\n #\n # Used for pagination (0=unlimited)\n #- LDAP_SEARCH_PAGE_SIZE=0\n #\n # The limit number of entries (0=unlimited)\n #- LDAP_SEARCH_SIZE_LIMIT=0\n #\n # Enable the login restriction group filter. Note the authenticated ldap user must be able to query all relevant group data with own login data from ldap.\n # When true, only members of LDAP_GROUP_FILTER_GROUP_NAME are allowed to log in.\n # NOTE: This flag ONLY controls the login restriction. Admin status sync\n # (LDAP_SYNC_ADMIN_STATUS / LDAP_SYNC_ADMIN_GROUPS) and group->role sync\n # (LDAP_SYNC_GROUP_ROLES) query LDAP groups independently and do NOT require\n # this flag to be true. The group filter metadata below\n # (LDAP_GROUP_FILTER_OBJECTCLASS, LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE,\n # LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT, LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE)\n # must still be configured for any group search to work.\n #- LDAP_GROUP_FILTER_ENABLE=false\n #\n # Where the GROUPS are, when they are not under LDAP_BASEDN. Leave this\n # unset when users and groups share one subtree: the group searches then\n # use LDAP_BASEDN, exactly as they always have. Set it when the directory\n # keeps them apart - ou=groups beside ou=people is a common layout - or\n # every group search runs under the USER base, finds nothing, and\n # LDAP_GROUP_FILTER_ENABLE=true refuses every login (wekan/wekan#5539).\n #- LDAP_GROUP_BASEDN=ou=groups,dc=example,dc=org\n #\n # The object class for filtering. Example: group\n #- LDAP_GROUP_FILTER_OBJECTCLASS=\n #\n # The attribute of a group identifying it. Example: cn\n #- LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE=\n #\n # The attribute inside a group object listing its members. Example: member\n #- LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE=\n #\n # The format of the value of LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE. Example: 'dn' if the users dn is saved as value into the attribute.\n #- LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT=\n #\n # Active Directory nested groups (#6744). When true, a user who is a member of\n # LDAP_GROUP_FILTER_GROUP_NAME through another group (team group -> access\n # group) is a member too: the group searches use AD's\n # LDAP_MATCHING_RULE_IN_CHAIN (1.2.840.113556.1.4.1941). Needs a DN-valued\n # member attribute (member, with LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT=dn).\n # Also applies to admin status, group->role and org/team sync. Default: false.\n #- LDAP_GROUP_FILTER_NESTED=true\n #\n # Let users moved from local password login to LDAP still log in with their old local password (true). Default: false\n #- LDAP_MIGRATION_ALLOW_PASSWORD_LOGIN=\n #\n # Comma separated LDAP attributes to read for a user. Empty: all attributes. Example: uid,cn,mail\n #- LDAP_USER_ATTRIBUTES=\n #\n # The OIDC user info claim that holds the avatar URL. Default: picture\n #- OAUTH2_AVATAR_MAP=\n #\n # Update groups, admin status, e-mail, full name and username from the OIDC provider at every login (true). Default: false\n #- PROPAGATE_OIDC_DATA=\n #\n # Sign in with Apple: path to the private key (.p8) that signs the client secret JWT. Empty: OAUTH2_SECRET is used\n #- OAUTH2_SECRET_JWT_KEY_PATH=\n #\n # Sign in with Apple: the Team ID, issuer of the client secret JWT\n #- OAUTH2_SECRET_JWT_ISSUER=\n #\n # Sign in with Apple: the Key ID of the private key\n #- OAUTH2_SECRET_JWT_KEY_ID=\n #\n # Audience of the client secret JWT. Default: https://appleid.apple.com\n #- OAUTH2_SECRET_JWT_AUDIENCE=\n #\n # Subject of the client secret JWT. Default: OAUTH2_CLIENT_ID\n #- OAUTH2_SECRET_JWT_SUBJECT=\n #\n # Lifetime of the client secret JWT in seconds. Default: 300\n #- OAUTH2_SECRET_JWT_EXPIRES_IN=\n #\n # Let a CAS login take over an existing local account with the same username (true). Default: false\n #- CAS_MERGE_EXISTING_USERS=\n #\n # The group name (id) that matches all users.\n #- LDAP_GROUP_FILTER_GROUP_NAME=\n #\n # LDAP_UNIQUE_IDENTIFIER_FIELD : This field is sometimes class GUID (Globally Unique Identifier). Example: guid\n #- LDAP_UNIQUE_IDENTIFIER_FIELD=\n #\n # LDAP_UTF8_NAMES_SLUGIFY : Convert the username to utf8\n #- LDAP_UTF8_NAMES_SLUGIFY=true\n #\n # LDAP_USERNAME_FIELD : Which field contains the ldap username. username / sAMAccountName\n #- LDAP_USERNAME_FIELD=sAMAccountName\n #\n # LDAP_FULLNAME_FIELD : Which field contains the ldap fullname. fullname / sAMAccountName\n #- LDAP_FULLNAME_FIELD=fullname\n #\n #- LDAP_MERGE_EXISTING_USERS=false\n #\n # Allow existing account matching by e-mail address when username does not match\n #- LDAP_EMAIL_MATCH_ENABLE=true\n #\n # LDAP_EMAIL_MATCH_REQUIRE : require existing account matching by e-mail address when username does match\n #- LDAP_EMAIL_MATCH_REQUIRE=true\n #\n # LDAP_EMAIL_MATCH_VERIFIED : require existing account email address to be verified for matching\n #- LDAP_EMAIL_MATCH_VERIFIED=true\n #\n # LDAP_EMAIL_FIELD : which field contains the LDAP e-mail address\n #- LDAP_EMAIL_FIELD=mail\n #-----------------------------------------------------------------\n #- LDAP_SYNC_USER_DATA=false\n #\n #- LDAP_SYNC_USER_DATA_FIELDMAP={\"cn\":\"name\", \"mail\":\"email\"}\n #\n #- LDAP_SYNC_GROUP_ROLES=\n #\n # The default domain of the ldap it is used to create email if the field is not map correctly\n # with the LDAP_SYNC_USER_DATA_FIELDMAP is defined in setting LDAP_DEFAULT_DOMAIN above.\n #\n # Enable/Disable syncing of admin status based on ldap groups:\n # NOTE: Admin status sync and group->role sync (LDAP_SYNC_GROUP_ROLES) query\n # LDAP groups on their own. They no longer require LDAP_GROUP_FILTER_ENABLE=true,\n # which only controls the login restriction filter. The group filter metadata\n # (LDAP_GROUP_FILTER_OBJECTCLASS, LDAP_GROUP_FILTER_GROUP_MEMBER_ATTRIBUTE,\n # LDAP_GROUP_FILTER_GROUP_MEMBER_FORMAT, LDAP_GROUP_FILTER_GROUP_ID_ATTRIBUTE)\n # must still be configured for the group search to work.\n #- LDAP_SYNC_ADMIN_STATUS=true\n #\n # Comma separated list of admin group names to sync.\n #- LDAP_SYNC_ADMIN_GROUPS=group1,group2\n #\n # When true, sync a user's LDAP groups as Wekan Organizations.\n #- LDAP_SYNC_ORGANIZATIONS=false\n #\n # Comma separated allowlist of LDAP group names/patterns to sync as Organizations.\n # Wildcards supported: * (any chars), ? (single char). Empty = all of the user's groups.\n #- LDAP_SYNC_ORGANIZATIONS_GROUPS=\n #\n # When true, sync a user's LDAP groups as Wekan Teams.\n #- LDAP_SYNC_TEAMS=false\n #\n # Comma separated allowlist of LDAP group names/patterns to sync as Teams.\n # Wildcards supported: * (any chars), ? (single char). Empty = all of the user's groups.\n #- LDAP_SYNC_TEAMS_GROUPS=\n #---------------------------------------------------------------------\n # Login to LDAP automatically with HTTP header.\n # In below example for siteminder, at right side of = is header name.\n #- HEADER_LOGIN_ID=HEADERUID\n #- HEADER_LOGIN_FIRSTNAME=HEADERFIRSTNAME\n #- HEADER_LOGIN_LASTNAME=HEADERLASTNAME\n #- HEADER_LOGIN_EMAIL=HEADEREMAILADDRESS\n # SECURITY (GHSA-jggc-qvfc-jr6x): comma-separated allowlist of source IPs\n # permitted to use header login. The source IP is the real TCP peer of the\n # connection (your reverse proxy), NOT the spoofable X-Forwarded-For header.\n # REQUIRED when header login is enabled: if empty/unset, header login fails\n # CLOSED and authenticates no one.\n #- HEADER_LOGIN_TRUSTED_IPS=127.0.0.1,10.0.0.2\n # Optional: if WeKan sits behind MULTIPLE proxy hops, list the intermediate\n # proxy IPs here. X-Forwarded-For is then honored ONLY when the immediate\n # TCP peer is one of these trusted proxies, and the right-most hop that is\n # not itself a trusted proxy (the real client) is matched against\n # HEADER_LOGIN_TRUSTED_IPS above.\n #- HEADER_LOGIN_TRUSTED_PROXIES=10.0.0.1,10.0.0.2\n #---------------------------------------------------------------------\n # ==== LOGOUT TIMER, probably does not work yet ====\n # LOGOUT_WITH_TIMER : Enables or not the option logout with timer\n # example : LOGOUT_WITH_TIMER=true\n #- LOGOUT_WITH_TIMER=\n #\n # LOGOUT_IN : The number of days\n # example : LOGOUT_IN=1\n #- LOGOUT_IN=\n #\n # LOGOUT_ON_HOURS : The number of hours\n # example : LOGOUT_ON_HOURS=9\n #- LOGOUT_ON_HOURS=\n #\n # LOGOUT_ON_MINUTES : The number of minutes\n # example : LOGOUT_ON_MINUTES=55\n #- LOGOUT_ON_MINUTES=\n #---------------------------------------------------------------\n # USERS_DISABLE_INACTIVE_AFTER_DAYS : once a night, disable accounts that\n # have not used WeKan for this many days (Admin Panel > People > Last\n # active). Admins are never disabled. Accounts with no recorded activity\n # yet are counted from the first run. Re-enabling an account restarts its\n # count. Unset or 0 = off (default). Admin Panel / People / Login can set\n # it too, and its value there wins.\n #- USERS_DISABLE_INACTIVE_AFTER_DAYS=180\n #---------------------------------------------------------------\n # BACKUP_KEEP_DAYS : after each successful Admin Panel backup, delete\n # local (filesystem) backups older than this many days; the newest is\n # always kept. Unset or 0 = keep all (default). Admin Panel / Attachments\n # / Backup can set it too, and its value there wins. docs/Backup/Backup.md\n #- BACKUP_KEEP_DAYS=7\n #---------------------------------------------------------------\n # ACCOUNTS_COOKIE_REFRESH_RATE_LIMIT : Login-cookie refreshes allowed per\n # 10 seconds from one address (Meteor default 30); raise it behind a\n # reverse proxy that is not trusted for the client address. Admin Panel /\n # People / Login overrides it; applies from the next start.\n #- ACCOUNTS_COOKIE_REFRESH_RATE_LIMIT=100\n # INBOUND_IMAP_POLL_SECONDS : Email to card: how often IMAP mailboxes are\n # read, in seconds (default 60, at least 15).\n #- INBOUND_IMAP_POLL_SECONDS=60\n # INBOUND_EMAIL_PER_ADDRESS_PER_HOUR : Email to card: cards one sender\n # address can make per hour (default 60).\n #- INBOUND_EMAIL_PER_ADDRESS_PER_HOUR=60\n # INBOUND_EMAIL_WEBHOOK_SECRET : the secret the mail provider must send\n # with each webhook POST, if not set in the Admin Panel.\n #- INBOUND_EMAIL_WEBHOOK_SECRET=long-random-value\n # INBOUND_EMAIL_MAX_BYTES : Email to card: largest message in bytes\n # (default 31457280, 30 MB).\n #- INBOUND_EMAIL_MAX_BYTES=31457280\n # INBOUND_EMAIL_MAX_ATTACHMENT_BYTES : Email to card: largest attachment\n # in bytes (default 26214400, 25 MB).\n #- INBOUND_EMAIL_MAX_ATTACHMENT_BYTES=26214400\n # EMAIL_VIEW_SENDS_PER_HOUR : Emails one user can send from the email view\n # per hour (default 50).\n #- EMAIL_VIEW_SENDS_PER_HOUR=50\n # Admin Panel / People / Notification Settings / Email to card overrides the email ones.\n #---------------------------------------------------------------\n # Per server process, environment only:\n # INBOUND_IMAP_DISABLED : true stops THIS server process from reading IMAP\n # mailboxes - for a multi-pod deployment where one pod should read them.\n # Environment only: an Admin Panel value would be shared by every pod.\n #- INBOUND_IMAP_DISABLED=true\n # WEKAN_DISK_MONITOR : false turns off the disk-usage monitor of this\n # server (Admin Panel / Problems / Disk usage). Default on.\n #- WEKAN_DISK_MONITOR=false\n # WEKAN_DISK_WATCH_PATHS : Comma-separated paths on this server whose disk\n # usage is watched, instead of the data and files directories.\n #- WEKAN_DISK_WATCH_PATHS=/data,/var/lib/wekan\n # WEKAN_RAM_MONITOR : false turns off the memory monitor of this server\n # (Admin Panel / Problems / Memory usage). Default on.\n #- WEKAN_RAM_MONITOR=false\n # WEKAN_IMPORT_RUN_STALE_MS : Milliseconds after which an import with no\n # progress counts as interrupted and can be resumed or discarded (at least\n # 60000).\n #- WEKAN_IMPORT_RUN_STALE_MS=600000\n #---------------------------------------------------------------\n # ATTACHMENT RETENTION (models/lib/attachmentRetention.js). Off unless set.\n # ATTACHMENTS_RETENTION_DAYS : once a night, delete card attachments older\n # than this many days. A normal delete: restorable from the card history.\n #- ATTACHMENTS_RETENTION_DAYS=730\n # ATTACHMENTS_RETENTION_MODE : uploaded (default) = by upload date;\n # card-inactive = also only when the card has had no activity for as long.\n #- ATTACHMENTS_RETENTION_MODE=uploaded\n # ATTACHMENTS_PURGE_DELETED_AFTER_DAYS : remove for good, file included,\n # attachments deleted (by retention or by anyone) this many days ago.\n # Only this frees storage.\n #- ATTACHMENTS_PURGE_DELETED_AFTER_DAYS=30\n # ATTACHMENTS_RETENTION_DRY_RUN=true : only log what would happen.\n #- ATTACHMENTS_RETENTION_DRY_RUN=true\n # ATTACHMENTS_RETENTION_MAX_PER_RUN : per step per night (default 1000).\n #- ATTACHMENTS_RETENTION_MAX_PER_RUN=1000\n #-------------------------------------------------------------------\n # Hide password login form\n # - PASSWORD_LOGIN_ENABLED=true\n #-------------------------------------------------------------------\n #- CAS_ENABLED=true\n #- CAS_BASE_URL=https://cas.example.com/cas\n #- CAS_LOGIN_URL=https://cas.example.com/login\n #- CAS_VALIDATE_URL=https://cas.example.com/cas/p3/serviceValidate\n #---------------------------------------------------------------------\n # SAML 2.0 (SP-initiated) login, see docs/Features/Login-Page/SAML.md.\n # SAML_ENABLED : turn the \"Sign In with SAML\" login button on.\n #- SAML_ENABLED=true\n # SAML_PROVIDER : short name for the identity provider, used to build\n # the ACS/callback URL and shown in Meteor.settings.public.\n #- SAML_PROVIDER=\n # SAML_ENTRYPOINT : the identity provider's SSO redirect endpoint.\n #- SAML_ENTRYPOINT=\n # SAML_ISSUER : this WeKan instance's SAML issuer/entity ID.\n #- SAML_ISSUER=\n # SAML_CERT : the identity provider's signing certificate (PEM, no\n # header/footer needed), used to verify the SAML response signature.\n #- SAML_CERT=\n #- SAML_IDPSLO_REDIRECTURL=\n # SAML_PRIVATE_KEYFILE / SAML_PUBLIC_CERTFILE : optional, paths (under\n # private/) to this WeKan instance's own key/cert, only needed if the\n # identity provider requires signed AuthnRequests.\n #- SAML_PRIVATE_KEYFILE=\n #- SAML_PUBLIC_CERTFILE=\n # SAML_IDENTIFIER_FORMAT : NameID format requested from the IdP.\n # Defaults to urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress.\n #- SAML_IDENTIFIER_FORMAT=\n # SAML_LOCAL_PROFILE_MATCH_ATTRIBUTE : assertion attribute whose value becomes\n # the WeKan username (e.g. username). Empty = the email / NameID. With\n # SAML_MERGE_EXISTING_USERS=true an existing account is found by that\n # username, or - when the value is the assertion's email - by a verified\n # email, so an LDAP account with its own short username can be linked.\n # Linking an existing account ALSO requires the assertion to carry the\n # attribute email_verified=true (SAML has no standard one: add it at the\n # IdP only if the IdP verifies addresses) and that email to be verified on\n # the local account. A refused link logs its reason in the server log.\n # docs/Features/Login-Page/SAML.md\n #- SAML_LOCAL_PROFILE_MATCH_ATTRIBUTE=\n # SAML_ATTRIBUTES : not used by login at the moment; attributes are read\n # from the validated assertion as named (email, username, displayName).\n #- SAML_ATTRIBUTES=\n #- SAML_MERGE_EXISTING_USERS=false\n #- SAML_IDP_PROFILE=standard\n #- SAML_WANT_RESPONSE_SIGNED=\n #- SAML_WANT_ASSERTIONS_SIGNED=\n #- SAML_LOGIN_FLOW=\n #---------------------------------------------------------------------\n # Login with Meteor accounts providers, see docs/Features/Login-Page/OAuth-Providers.md\n # and docs/Features/Login-Page/Passwordless.md. Every one of these can be overridden\n # in Admin Panel / People / Login; a value set there wins over the environment\n # variable. Register this callback URL at the provider:\n # /_oauth/ where service is google, github, facebook,\n # twitter, meteor-developer, weibo or meetup.\n # ==== Google ==== create the app at https://console.cloud.google.com/apis/credentials\n # callback URL: /_oauth/google\n #- OAUTH_GOOGLE_ENABLED=true\n #- OAUTH_GOOGLE_CLIENT_ID=\n #- OAUTH_GOOGLE_SECRET=\n # OAUTH_GOOGLE_SECRET_FILE : read the secret from a file (Docker secrets) instead\n #- OAUTH_GOOGLE_SECRET_FILE=/run/secrets/oauth_google_secret\n # ==== GitHub ==== create the app at https://github.com/settings/developers\n # callback URL: /_oauth/github\n #- OAUTH_GITHUB_ENABLED=true\n #- OAUTH_GITHUB_CLIENT_ID=\n #- OAUTH_GITHUB_SECRET=\n # OAUTH_GITHUB_SECRET_FILE : read the secret from a file (Docker secrets) instead\n #- OAUTH_GITHUB_SECRET_FILE=/run/secrets/oauth_github_secret\n # ==== Facebook ==== create the app at https://developers.facebook.com/apps/\n # callback URL: /_oauth/facebook\n #- OAUTH_FACEBOOK_ENABLED=true\n #- OAUTH_FACEBOOK_APP_ID=\n #- OAUTH_FACEBOOK_SECRET=\n # OAUTH_FACEBOOK_SECRET_FILE : read the secret from a file (Docker secrets) instead\n #- OAUTH_FACEBOOK_SECRET_FILE=/run/secrets/oauth_facebook_secret\n # ==== Twitter / X ==== create the app at https://developer.x.com/en/portal/dashboard\n # callback URL: /_oauth/twitter\n #- OAUTH_TWITTER_ENABLED=true\n #- OAUTH_TWITTER_CONSUMER_KEY=\n #- OAUTH_TWITTER_SECRET=\n # OAUTH_TWITTER_SECRET_FILE : read the secret from a file (Docker secrets) instead\n #- OAUTH_TWITTER_SECRET_FILE=/run/secrets/oauth_twitter_secret\n # ==== Meteor Developer ==== create the app at https://www.meteor.com/\n # callback URL: /_oauth/meteor-developer\n #- OAUTH_METEOR_DEVELOPER_ENABLED=true\n #- OAUTH_METEOR_DEVELOPER_CLIENT_ID=\n #- OAUTH_METEOR_DEVELOPER_SECRET=\n # OAUTH_METEOR_DEVELOPER_SECRET_FILE : read the secret from a file (Docker secrets) instead\n #- OAUTH_METEOR_DEVELOPER_SECRET_FILE=/run/secrets/oauth_meteor_developer_secret\n # ==== Weibo ==== create the app at https://open.weibo.com/\n # callback URL: /_oauth/weibo\n #- OAUTH_WEIBO_ENABLED=true\n #- OAUTH_WEIBO_CLIENT_ID=\n #- OAUTH_WEIBO_SECRET=\n # OAUTH_WEIBO_SECRET_FILE : read the secret from a file (Docker secrets) instead\n #- OAUTH_WEIBO_SECRET_FILE=/run/secrets/oauth_weibo_secret\n # ==== Meetup ==== create the app at https://www.meetup.com/api/oauth/list/\n # callback URL: /_oauth/meetup\n #- OAUTH_MEETUP_ENABLED=true\n #- OAUTH_MEETUP_CLIENT_ID=\n #- OAUTH_MEETUP_SECRET=\n # OAUTH_MEETUP_SECRET_FILE : read the secret from a file (Docker secrets) instead\n #- OAUTH_MEETUP_SECRET_FILE=/run/secrets/oauth_meetup_secret\n # OAUTH_PROVIDERS_LOGIN_STYLE : redirect or popup, for all providers above. Default: redirect\n #- OAUTH_PROVIDERS_LOGIN_STYLE=redirect\n # OAUTH_PROVIDERS_MERGE_EXISTING_USERS : link a provider login to an existing WeKan\n # account with the same email. Default: false = the login is refused, not merged,\n # like OAUTH2_MERGE_EXISTING_USERS. Enable only if you trust the provider's emails.\n #- OAUTH_PROVIDERS_MERGE_EXISTING_USERS=false\n # OAUTH_PROVIDERS_ALLOWED_EMAIL_DOMAINS : only these email domains may sign in with\n # the providers above, comma separated, like OAUTH2_ALLOWED_EMAIL_DOMAINS. Empty: all.\n #- OAUTH_PROVIDERS_ALLOWED_EMAIL_DOMAINS=example.com\n # PASSWORDLESS_ENABLED : email a one-time sign-in code instead of asking a\n # password. Needs MAIL_URL. Also switchable in Admin Panel / People / Login.\n #- PASSWORDLESS_ENABLED=true\n #---------------------------------------------------------------------\n # Wait spinner to use\n # - WAIT_SPINNER=Bounce\n #---------------------------------------------------------------------\n # Wait for MongoDB to be healthy (replica-set primary elected) before\n # starting WeKan, so index creation does not crash with \"Topology is closed\".\n # If you use FerretDB instead, comment out the wekandb block below and\n # uncomment the wekan-ferretdb block.\n depends_on:\n ferretdb:\n condition: service_healthy\n # wekan-migrate:\n # condition: service_completed_successfully\n # wekan-ferretdb:\n # condition: service_healthy\n volumes:\n - /etc/localtime:/etc/localtime:ro\n - wekan-files:/data:rw\n\nvolumes:\n wekan-files:\n driver: local\n ferretdb-data:\n driver: local\n\nnetworks:\n wekan-tier:\n driver: bridge\n", "source_url": "https://github.com/wekan/wekan/blob/770acdcee64a5cc7a38ea987e78c4891d5c9061c/docker-compose.yml", "validation_status": "config_ok" }, { "order": 3, "kind": "shell", "language": "bash", "label": "Start it", "body": "docker compose up -d", "source_url": "https://github.com/wekan/wekan/blob/770acdcee64a5cc7a38ea987e78c4891d5c9061c/docker-compose.yml", "validation_status": "unvalidated" }, { "order": 4, "kind": "verify", "language": "text", "label": "Open the app", "body": "Open http://localhost:80. The compose file publishes host port 80 for the wekan service.", "source_url": "https://github.com/wekan/wekan/blob/770acdcee64a5cc7a38ea987e78c4891d5c9061c/docker-compose.yml", "validation_status": "unvalidated" } ], "notes": [ { "kind": "gotcha", "title": "Some images use the latest tag or no tag", "body": "Images without a pinned version: wekan: ghcr.io/wekan/wekan:latest. A later pull can get a different version.", "source_url": "https://github.com/wekan/wekan/blob/770acdcee64a5cc7a38ea987e78c4891d5c9061c/docker-compose.yml", "checked_at": "2026-10-22" }, { "kind": "gotcha", "title": "The compose file publishes host ports", "body": "Host ports: 127.0.0.1:27017 (ferretdb), 80 (wekan). A port without a host address listens on all host network interfaces.", "source_url": "https://github.com/wekan/wekan/blob/770acdcee64a5cc7a38ea987e78c4891d5c9061c/docker-compose.yml", "checked_at": "2026-10-22" }, { "kind": "gotcha", "title": "The compose file mounts host folders", "body": "Host paths mounted into containers: /etc/localtime at /etc/localtime (wekan).", "source_url": "https://github.com/wekan/wekan/blob/770acdcee64a5cc7a38ea987e78c4891d5c9061c/docker-compose.yml", "checked_at": "2026-10-22" } ], "signals": { "captured_at": "2026-10-22", "stars": 21132, "forks": 3005, "open_issues": 2, "last_push": "2026-10-22", "days_since_push": 0, "latest_release": "v12.60", "latest_release_date": "2026-10-22", "days_since_release": 0 }, "links": { "html": "https://openlogs.fyi/tools/wekan", "markdown": "https://openlogs.fyi/tools/wekan.md", "json": "https://openlogs.fyi/tools/wekan.json" }, "updated_at": "2026-10-22" }