Self-Hosting

Configuration Reference

Configuration Reference

Everything is configured through environment variables. They come from the .env file in your install directory, which docker-compose.yml loads via env_file. Variables marked compose only are consumed by the compose file itself and never reach the application.

Edit .env, then apply:

cd docu.nexus
$EDITOR .env
docker compose up -d

Compose recreates only the containers whose configuration changed.

Core

Database

Authentication

Instance administrators

The instance administrator is the account that answers for the whole deployment: licensing, the directory connections, and the list of who else is an instance administrator. It is not a nexus role. These three variables are the deployment’s own say in who holds it. The last two, while set, outrank what Admin, then Instance Administrators stores.

A list that arrives in INSTANCE_ADMIN_GROUPS as cn=admins, ou=groups, dc=example has been split on its commas and matches nobody. Write each DN whole, and separate them with semicolons:

INSTANCE_ADMIN_GROUPS="CN=Docs Admins,OU=Groups,DC=corp,DC=example;CN=IT,OU=Groups,DC=corp,DC=example"

To find a connection’s id, run this from your install directory:

docker compose exec -T postgres psql -U docunexus -d docunexus -c \
  "SELECT id, name, url FROM ldap_configurations;"

LDAP

These variables do not switch LDAP on, and they do not change a saved connection. They fill in the form for a new connection at Admin, then Authentication, then LDAP, and nothing else. Sign-in reads what that form saves, and directory sign-in needs a saved connection with Use for sign-in on and the LDAP / Active Directory switch on the Sign-in methods tab of the same section. Set them when you deploy from configuration management and want the values already typed in for whoever finishes the setup. See LDAP and Active Directory Setup.

There is no variable for the bind password, the CA certificate or the connection name. Type those into the form, where a save checks a new bind password against the directory before storing it.

Retired and deprecated

The app writes a line to its log at every start while one of these is set, so docker compose logs app | grep -i ldap shows whether yours still are.

Collaboration

Confluence

The Confluence surface is off by default. Import, export, the webhook receiver, sync, and the background sync scheduler are not started, the /api/confluence/* endpoints answer 404, and the Import and Sync sections do not appear in the Admin panel. It ships off because the export half of the surface is not finished: those endpoints check that a caller is signed in and stop there, without checking whether that account may read the page or the space. Switching it on is a decision to accept that on an instance where every signed-in account is already trusted with every page.

One line in .env turns the whole subject back on, then restart:

ENABLE_CONFLUENCE=true

Nothing stored is lost while it is off. Saved connections, sync configurations, and past import jobs stay in the database and come back exactly as they were.

Storage

The production compose sets STORAGE_PATH=/app/storage and backs it with the app_storage volume. Set it explicitly. A few Confluence import paths fall back to ./uploads when it is unset, which splits your files across two directories.

Build-time front end

These are baked into the SPA bundle at build time, not read at runtime.

Git Docs

All optional; the plugin works with none of them set. Repo clones are cached under STORAGE_PATH/gitdocs/.

Licensing

Set this if you manage secrets through your orchestrator. Leave it unset if you prefer pasting the key once in Admin, Licensing.