03 · Configure
Operator-facing configuration knobs and secrets.
Eddytor's settings split cleanly in two: non-secret operator settings live in
config.toml, and secrets live in environment variables. This section covers
both, plus the boundary concerns - CORS, TLS, SMTP - and protecting the one
secret you can't lose.
In this section
- Where config lives -
config.tomlvs env, and the resolution order. - Required & optional environment variables - what the server reads at boot.
- CORS allowlist - which browser origins may call the API.
- TLS termination & reverse proxy - Eddytor speaks plaintext; encrypt at the edge.
- SMTP for magic-link delivery - so teammates can actually receive sign-in links.
- Custom config file with Compose - use your own
config.tomlwithout editing the installer's. - Backups & encryption key rotation - protect (and, rarely, rotate)
EDDYTOR_ENCRYPTION_KEY.
Heads up
Config is read at boot, not hot-reloaded. Restart the
server (
docker compose restart, or roll the deployment) after changing
config.toml or env.