These go in the .env next to docker-compose.yml. The bundle's compose file passes a fixed set of them to the containers, so a variable it does not list (the UPLOADS_COMPRESS_* pair below, for example) has to be added to the community-server service's environment: block as well.
Community server required
| Variable | Required | Description | Example |
|---|---|---|---|
SERVER_TOKEN | Cloud only | Server token used for registration and heartbeat. Leave empty when OFFGRID_MODE=true; it is ignored there. | abc123... |
COMMUNITY_PUBLIC_URL | Yes | Public base URL for this community API, with scheme and host (registered with Core as api_url). Required in .env: Docker Compose does not substitute a default. Required in Offgrid too: it drives voice and attachment URLs. | https://community.example.com |
CORE_SERVER_URL | Cloud only | Core URL used by the community-server for token validation and registration. The bundle's compose file defaults it to https://api.tusile.com, so you only set it to point somewhere else. Forced empty when OFFGRID_MODE=true, which is what stops every call to tusile.com. | https://api.tusile.com |
DATABASE_URL | Yes | Postgres connection string. The bundle's compose file sets it to its own postgres service; you only provide it when running the image without the bundle. | postgres://user:pass@db:5432/tusile_community?sslmode=disable |
LIVEKIT_API_KEY | Yes | LiveKit key used to mint room tokens. Generated by the setup script; run docker run --rm livekit/livekit-server generate-keys to make one by hand. There is no default, and the server will not start without it. | APIabcd1234wxyz |
LIVEKIT_API_SECRET | Yes | LiveKit secret paired with the API key. Anyone holding it can mint a token for any voice room on your server, so treat it like a password and never reuse an example value. | a 32+ character random string |
Community server optional
| Variable | Default | Purpose |
|---|---|---|
OFFGRID_MODE | false | Run standalone: the server mints its own signing key, issues its own accounts, and never contacts Core. Requires an empty SERVER_TOKEN / CORE_SERVER_URL (both are forced empty anyway) and cannot be combined with multi-tenant mode. See the install guide. |
DATA_DIR | /app/data | Holds the install ID, the Offgrid owner claim token and, in Offgrid, community_key: the signing key the server’s identity is derived from. The bundle keeps it on the community-data volume. It must stay on a persisted volume and be included in backups; losing it in Offgrid invalidates every session and changes the server ID. |
COMPOSE_PROJECT_NAME | written by setup | Compose project name, which prefixes every volume. The setup script writes community-<hash> for new installs (community-offgrid-<hash> on Offgrid); without the line, compose falls back to community-${SERVER_TOKEN}, which is what installs from before 30 July 2026 still use. Never change it on a running deployment: the stack would attach to new, empty volumes. See Backup & restore. |
PORT | 9090 | Host port the bundle publishes the community API on, for direct access next to Caddy. The container always listens on 9090. |
CORS_ALLOWED_HOSTS | - | Extra browser origins allowed to call this API, comma-separated. The host of COMMUNITY_PUBLIC_URL is added automatically. |
STORAGE_BACKEND | local | File storage backend: local or s3. |
STORAGE_LOCAL_PATH | /app/uploads | Upload location for local storage. The bundle keeps it on the community-uploads volume. |
UPLOAD_MAX_SIZE | 52428800 | Attachment size cap in bytes, enforced only on Tusile's free managed hosting. A self-hosted server does not cap attachments, so this has no effect there. Server icons, banners and avatars keep their own fixed limits (5 to 10 MB). |
UPLOADS_COMPRESS_ENABLED | true | Toggle ffmpeg image/video re-encoding on upload. Poster (thumbnail) generation is unaffected. Set false (or 0, no, off) on small instances (e.g. t3.micro) where libx264 pegs CPU. Not passed through by the bundle's compose file; add it to the community-server environment. |
UPLOADS_COMPRESS_CONCURRENCY | 1 | Max parallel image/video compress jobs. Not passed through by the bundle's compose file either. |
S3_BUCKET, S3_REGION, S3_ACCESS_KEY, S3_SECRET_KEY | - | Required together when STORAGE_BACKEND=s3. |
S3_ENDPOINT, S3_PUBLIC_URL | - | Optional custom S3 endpoint/public URL. |
S3_KEY_PREFIX | - | Optional prefix for every object key, for a bucket shared with other servers. Not passed through by the bundle's compose file. |
LIVEKIT_URL | - | Optional explicit LiveKit WebSocket URL override. |
LIVEKIT_PORT | 7880 | Used when LIVEKIT_URL is not set; combines with COMMUNITY_PUBLIC_URL. |
LIVEKIT_API_URL | http://livekit:7880 | LiveKit's server API as reached from the community-server container. Drives server-side voice moderation (kick, server mute) and the voice-presence repair loop. Left empty, moderation is advisory only and the repair loop does not run. The default is the bundle's; the server itself has none. |
LIVEKIT_CONFIG | livekit.prod.yaml | Path to LiveKit config file. |
LIVEKIT_RTC_PORT, LIVEKIT_TURN_UDP_PORT, LIVEKIT_TURN_TLS_PORT | 7881, 3478, 5349 | Host ports the bundle publishes for LiveKit ICE/TCP, TURN/UDP and TURN/TLS. |
LIVEKIT_RTP_PORT_START, LIVEKIT_RTP_PORT_END | 50000, 50060 | The published RTP media range. Must match rtc.port_range_start / port_range_end in livekit.prod.yaml; about one port per simultaneous voice user, so widen both together for a busy server. |
TURN_DOMAIN | - | Optional override for the LiveKit TURN/TLS (5349) cert domain synced by the livekit-cert-sync container. Defaults to the host of COMMUNITY_PUBLIC_URL. |
Your backup plan always needs the database and the community-data volume. For local storage, also include the community-uploads Docker volume (or bind-mounted directory). For S3, back up the bucket using your provider’s tools. See Backup & restore.
This page is the operator-facing summary for quick setup and audits.