Environment Variables

All values live in ~/.config/auberge/config.toml. Manage with auberge config set <key> <value>.

Variable	Required	Description
admin_user_name	Yes	Server admin username
admin_user_email	Yes	Server admin email
domain	Yes	Primary domain (e.g. example.com)
ssh_port	Yes	SSH port for managed hosts
cloudflare_dns_api_token	Yes	Cloudflare token with DNS Edit + Zone Read; required for DNS commands and ACME challenges
tailscale_authkey	Optional	Pre-auth key for the tailnet. Minted per run by the CLI; set it only to bootstrap the host that will serve Headscale
tailscale_advertise_exit_node	Optional	true offers the host as a tailnet exit node; scope it under [hosts.<name>]
tailscale_api_key	Optional	Enables automatic Blocky DNS configuration via Tailscale API
tailscale_login_server	Optional	Self-hosted Headscale URL (e.g. https://hs.example.com); omit to use Tailscale SaaS
restic_repository	Optional	Restic destination (e.g. rclone:offsite:auberge-backup); required for backup push
restic_password	Optional	Restic encryption passphrase — NOT your cloud storage password; required for backup push
actual_subdomain	Optional	Subdomain for Actual Budget (default: actual; always tailnet-only)
baikal_subdomain	Optional	Subdomain for Baïkal
bichon_subdomain	Optional	Subdomain for Bichon
bichon_tailscale_ip	Optional	Tailnet address Blocky publishes for Bichon (see below)
blocky_subdomain	Optional	Subdomain for Blocky
freshrss_subdomain	Optional	Subdomain for FreshRSS
headscale_subdomain	Optional	Subdomain for Headscale; unset means Headscale is not deployed
navidrome_subdomain	Optional	Subdomain for Navidrome
paperless_subdomain	Optional	Subdomain for Paperless
paperless_tailscale_ip	Optional	Tailnet address Blocky publishes for Paperless (see below)
stirling_subdomain	Optional	Subdomain for Stirling-PDF (default: pdf)
gokapi_subdomain	Optional	Subdomain for Gokapi (default: share)
yourls_subdomain	Optional	Subdomain for YOURLS

Tip

<app>_tailscale_ip for a tailnet-only app — one whose playbook meta declares tailnet_only: true — is the address Blocky’s customDNS answers with. Leave it unset and Blocky answers with its own host’s tailnet address, which is right whenever the app runs on the host running Blocky (ADR-0059). Set it only for an app on another host, and set it at the top level of config.toml: Blocky builds the whole fleet’s map in one run against its own host, so a [hosts.<name>] answer scoped to the app’s own host never reaches that run. Setting it also arms auberge deploy’s tailnet DNS check for that app, which queries Blocky’s host — so that host needs a cached tailscale_ip too.

Tip

<app>_tailscale_ip for a public app is the address dns set-all writes as the A record instead of the public server IP. Public internet cannot route CGNAT addresses (100.64.0.0/10), so no firewall rules are needed; dns migrate skips records already holding one.

Tip

All values support ! command syntax to fetch secrets from a password manager: auberge config set restic_password '!pass show auberge/restic'. See Secrets Management.