Configuration

goloom is configured entirely through environment variables. When building from source, start from .env.example and copy it to .env.

cp .env.example .env

Core

Variable	Purpose
APP_ENV	Runtime environment (e.g. development, production).
HTTP_ADDR	Address/port the server listens on (default :8080).
PUBLIC_BASE_URL	Public URL of your instance — used for OAuth callbacks and links.
DATABASE_URL	Database connection string (see below).
ENCRYPTION_KEY	Required. Long random secret; encrypts provider tokens at rest.

Caution

Treat ENCRYPTION_KEY as permanent for a given database. If you lose or change it, previously encrypted provider tokens can no longer be decrypted.

Database

SQLite is the zero-config default:

DATABASE_URL=file:./data/goloom.db

Switch to PostgreSQL for larger deployments:

DATABASE_URL=postgres://postgres:postgres@localhost:5432/goloom?sslmode=disable

Bootstrap admin

Variable	Purpose
BOOTSTRAP_ADMIN_TOKEN	One-time token to create the first admin. Rotate after setup.

See First login for the bootstrap flow.

Scheduler

SCHEDULER_* variables tune how often goloom checks for and publishes due posts. The defaults are sensible for most deployments.

OIDC sign-in (optional)

Set the OIDC_* variables to let browser users sign in through your identity provider instead of API tokens.

AI provider

Team owners configure the AI provider (key, model, optional base URL) in the team settings. For SSRF protection, a custom base URL must resolve to a public address. To use a model server on your own network (e.g. Ollama), allow its host:

Variable	Purpose
AI_ALLOWED_PRIVATE_HOSTS	Comma-separated hosts a team base URL may use although they resolve to private/loopback addresses. Prefer host:port (e.g. localhost:11434,ollama.lan:11434) — an entry without port allows every port of that host to all team owners. Default: none.

LLM calls ignore HTTP(S)_PROXY (a proxy would hide the real target from the address check) and do not follow redirects.

Providers

Some providers need app credentials. For Mastodon, MASTODON_* variables can hold default app credentials, though Mastodon onboarding can also auto-register an app from the instance URL. See Connect accounts.