Environment Variables Reference
Complete reference of all environment variables supported by Mydia.
Required Variables
| Variable | Description | Example |
|---|---|---|
SECRET_KEY_BASE |
Phoenix secret key for cookies/sessions | Generate with: openssl rand -base64 48 |
GUARDIAN_SECRET_KEY |
JWT signing key for authentication | Generate with: openssl rand -base64 48 |
Both must be set to a non-empty value of at least 32 characters, and Mydia
refuses to start otherwise with an error naming the variable. Set-but-blank
counts as unset: a zero-length signing key is accepted by the JWT library for
both signing and verification, which would make tokens forgeable. The 32
character floor is the one mix phx.gen.secret and mix guardian.gen.secret
enforce themselves, so any secret produced by the commands above passes.
GUARDIAN_SECRET_KEY is required in its own right and is never inherited from
SECRET_KEY_BASE.
Container Configuration
| Variable | Description | Default |
|---|---|---|
PUID |
User ID for file permissions | 1000 |
PGID |
Group ID for file permissions | 1000 |
TZ |
Timezone (e.g., America/New_York) |
UTC |
DATABASE_PATH |
Path to SQLite database file | /config/mydia.db |
Server Configuration
| Variable | Description | Default |
|---|---|---|
PHX_HOST |
Public hostname for the application | localhost |
PORT |
HTTP server port (also used for URL generation) | 4000 |
HTTPS_PORT |
HTTPS server port (also used for URL generation) | 4443 |
HOST |
Server binding address | 0.0.0.0 |
URL_SCHEME |
No effect in a container. Accepted and validated, but a release build hardcodes its external URL to https://{PHX_HOST} and never reads this. |
http |
PHX_CHECK_ORIGIN |
WebSocket origin checking | Allows PHX_HOST with any scheme |
URL_SCHEME does not change generated links
Absolute URLs, including the OIDC redirect URI, are always https://{PHX_HOST}
regardless of what you set here. If you serve Mydia over plain http, set
OIDC_REDIRECT_URI explicitly. See
SSO / OIDC.
Port Configuration Notes
The PORT and HTTPS_PORT environment variables serve dual purposes:
1. Server binding - The ports on which the HTTP and HTTPS servers listen
2. URL generation - Used to generate direct access URLs (e.g., sslip.io URLs for remote access)
This simplifies configuration by eliminating the need for separate port variables for URL generation.
PHX_CHECK_ORIGIN Options
false- Allow all origins (useful for IP-based access)- Comma-separated list of allowed origins
Media Library
| Variable | Description | Default |
|---|---|---|
MOVIES_PATH |
Movies directory path | /media/movies |
TV_PATH |
TV shows directory path | /media/tv |
Additional Library Paths
Configure additional libraries using numbered variables (<N> = 1, 2, 3, etc.):
| Variable Pattern | Description | Example |
|---|---|---|
LIBRARY_PATH_<N>_PATH |
Directory path | /media/anime |
LIBRARY_PATH_<N>_TYPE |
Library type | mixed |
LIBRARY_PATH_<N>_MONITORED |
Enable monitoring | true |
LIBRARY_PATH_<N>_SCAN_INTERVAL |
Automatic scan interval in seconds. Minimum 900. Omit for manual-only scanning. | 3600 |
Library Types: movies, series, or mixed
Authentication
| Variable | Description | Default |
|---|---|---|
LOCAL_AUTH_ENABLED |
Enable local username/password auth | true |
OIDC_ENABLED |
Enable OIDC/OpenID Connect auth | false |
OIDC_ISSUER |
OIDC issuer URL (e.g., https://auth.example.com) |
- |
OIDC_CLIENT_ID |
OIDC client ID | - |
OIDC_CLIENT_SECRET |
OIDC client secret | - |
OIDC_REDIRECT_URI |
OIDC callback URL | Auto-computed |
OIDC_SCOPES |
Space-separated scope list | openid profile email |
LIBRARY_API_KEY |
Admin key for the Library API, sent as the x-api-key header. Optional; unset means only database API keys work. Minimum 32 characters. Generate with openssl rand -hex 32. Remove it and restart to revoke. |
(unset) |
Legacy Variable
OIDC_DISCOVERY_DOCUMENT_URI is accepted as a legacy alias for OIDC_ISSUER. The issuer is extracted by stripping the /.well-known/openid-configuration suffix.
Feature Flags
| Variable | Description | Default |
|---|---|---|
ENABLE_PLAYER |
Everything that serves the Mydia player: p2p remote access and pairing, streaming, offline downloads, intro and credits detection, and the player's pages and buttons | true |
ENABLE_CARDIGANN |
Enable native Cardigann indexer support | true |
ENABLE_IMPORT_LISTS |
Enable import lists for syncing external lists (TMDB watchlists, popular, etc.) | true |
ENABLE_REMOTE_ACCESS |
P2P remote access for the player. Also a toggle under Admin › System › Remote Access; when the variable is set it wins and the toggle is locked | true |
ENABLE_PLAYER=false is for servers nobody plays from. Mydia then starts no p2p
node, answers 404 on the player's routes, and hides the Player and Devices
entries. It accepts true, false, 1 and 0, and refuses to start on
anything else, so a typo cannot leave the player running. It is read at
startup, so changing it takes a restart.
ENABLE_PLAYBACK is gone. If you set it, Mydia logs a warning and ignores it.
Import Lists
| Variable | Description | Default |
|---|---|---|
IMPORT_LISTS_ALLOW_PRIVATE_DESTINATIONS |
Allow a Custom URL import list to fetch from private, loopback or link-local addresses | false |
Only enable this for a list you host yourself
A Custom URL list is fetched by the Mydia server, not by your browser, so the URL can reach anything the server can reach: other containers, your router, a cloud metadata endpoint. Mydia refuses those destinations by default and revalidates every redirect hop.
Set this to true only if you serve the list from your own LAN or container
network, for example a JSON file on a NAS. It never relaxes the scheme
allowlist, which is always limited to http and https.
Download Clients
Configure multiple clients using numbered variables (<N> = 1, 2, 3, etc.):
| Variable Pattern | Description | Example |
|---|---|---|
DOWNLOAD_CLIENT_<N>_NAME |
Display name | qBittorrent |
DOWNLOAD_CLIENT_<N>_TYPE |
Client type | qbittorrent |
DOWNLOAD_CLIENT_<N>_ENABLED |
Enable this client | true |
DOWNLOAD_CLIENT_<N>_PRIORITY |
Client priority. Lower wins: 1 is tried before 2. | 1 |
DOWNLOAD_CLIENT_<N>_HOST |
Hostname or IP | qbittorrent |
DOWNLOAD_CLIENT_<N>_PORT |
Client port | 8080 |
DOWNLOAD_CLIENT_<N>_USE_SSL |
Use SSL/TLS | false |
DOWNLOAD_CLIENT_<N>_USERNAME |
Auth username | - |
DOWNLOAD_CLIENT_<N>_PASSWORD |
Auth password | - |
DOWNLOAD_CLIENT_<N>_API_KEY |
API key (SABnzbd, debrid, qBittorrent 5.2+) | - |
DOWNLOAD_CLIENT_<N>_CATEGORY |
Default category | - |
DOWNLOAD_CLIENT_<N>_EXTERNAL_TORRENTS |
What to do with torrents Mydia did not add: auto, adopt, category_only, ignore. category_only is not valid for rqbit. |
auto |
DOWNLOAD_CLIENT_<N>_DOWNLOAD_DIRECTORY |
Download directory | - |
DOWNLOAD_CLIENT_<N>_PROVIDER |
Debrid provider (debrid only) | real_debrid |
DOWNLOAD_CLIENT_<N>_WATCH_FOLDER |
Watch folder (blackhole only) | /downloads/watch |
DOWNLOAD_CLIENT_<N>_COMPLETED_FOLDER |
Completed folder (blackhole only) | /downloads/complete |
DOWNLOAD_CLIENT_<N>_NAMEis required: clients are discovered by their_NAMEvariable, so a block without it is ignored.
Client Types: qbittorrent, transmission, rqbit, rtorrent, blackhole, sabnzbd, nzbget, debrid
# qBittorrent
DOWNLOAD_CLIENT_1_NAME=qBittorrent
DOWNLOAD_CLIENT_1_TYPE=qbittorrent
DOWNLOAD_CLIENT_1_HOST=qbittorrent
DOWNLOAD_CLIENT_1_PORT=8080
DOWNLOAD_CLIENT_1_USERNAME=admin
DOWNLOAD_CLIENT_1_PASSWORD=adminpass
# Alternative to username/password on qBittorrent 5.2 and newer. Generate the
# key in qBittorrent under Preferences, WebUI, API Key. When set, it takes
# precedence over the username and password. qBittorrent holds exactly one
# API key at a time, so generating a new one immediately invalidates the
# previous one and breaks any other integration still using it.
# DOWNLOAD_CLIENT_1_API_KEY=qbt_yourkeyhere
# Transmission
DOWNLOAD_CLIENT_2_NAME=Transmission
DOWNLOAD_CLIENT_2_TYPE=transmission
DOWNLOAD_CLIENT_2_HOST=transmission
DOWNLOAD_CLIENT_2_PORT=9091
DOWNLOAD_CLIENT_2_USERNAME=admin
DOWNLOAD_CLIENT_2_PASSWORD=adminpass
# rqbit
DOWNLOAD_CLIENT_3_NAME=rqbit
DOWNLOAD_CLIENT_3_TYPE=rqbit
DOWNLOAD_CLIENT_3_HOST=rqbit
DOWNLOAD_CLIENT_3_PORT=3030
# Optional, when rqbit HTTP basic auth is enabled
DOWNLOAD_CLIENT_3_USERNAME=admin
DOWNLOAD_CLIENT_3_PASSWORD=adminpass
# SABnzbd
DOWNLOAD_CLIENT_4_NAME=SABnzbd
DOWNLOAD_CLIENT_4_TYPE=sabnzbd
DOWNLOAD_CLIENT_4_HOST=sabnzbd
DOWNLOAD_CLIENT_4_PORT=8080
DOWNLOAD_CLIENT_4_API_KEY=your-sabnzbd-api-key
# NZBGet
DOWNLOAD_CLIENT_5_NAME=NZBGet
DOWNLOAD_CLIENT_5_TYPE=nzbget
DOWNLOAD_CLIENT_5_HOST=nzbget
DOWNLOAD_CLIENT_5_PORT=6789
DOWNLOAD_CLIENT_5_USERNAME=nzbget
DOWNLOAD_CLIENT_5_PASSWORD=tegbzn6789
# rTorrent (uses the XML-RPC path /RPC2 by default)
DOWNLOAD_CLIENT_6_NAME=rTorrent
DOWNLOAD_CLIENT_6_TYPE=rtorrent
DOWNLOAD_CLIENT_6_HOST=rtorrent
DOWNLOAD_CLIENT_6_PORT=8080
DOWNLOAD_CLIENT_6_USERNAME=admin
DOWNLOAD_CLIENT_6_PASSWORD=adminpass
Debrid Clients
Debrid clients connect to a hosted debrid service rather than a self-hosted
torrent/usenet daemon. They require TYPE=debrid, an API_KEY, and a
PROVIDER selecting which service to use. HOST/PORT are ignored: each
provider's API endpoint is built in.
Providers: real_debrid, all_debrid, premiumize, tor_box
DOWNLOAD_CLIENT_7_NAME=Real-Debrid
DOWNLOAD_CLIENT_7_TYPE=debrid
DOWNLOAD_CLIENT_7_API_KEY=your-debrid-api-key
DOWNLOAD_CLIENT_7_PROVIDER=real_debrid
Swap PROVIDER for any of the values above (e.g. all_debrid, premiumize,
tor_box) to use a different service. Debrid clients default to a 24-hour
stall-detection grace period (vs. 60 minutes for other clients), since remote
caching can take longer to resolve a download.
Blackhole Clients
Blackhole clients drop .torrent files into a watched folder for an external
client to pick up, and detect finished downloads in a completed folder. They
require TYPE=blackhole, a WATCH_FOLDER, and a COMPLETED_FOLDER instead of
host/port.
DOWNLOAD_CLIENT_8_NAME=Blackhole
DOWNLOAD_CLIENT_8_TYPE=blackhole
DOWNLOAD_CLIENT_8_WATCH_FOLDER=/downloads/watch
DOWNLOAD_CLIENT_8_COMPLETED_FOLDER=/downloads/complete
Indexers
Configure multiple indexers using numbered variables (<N> = 1, 2, 3, etc.):
| Variable Pattern | Description | Example |
|---|---|---|
INDEXER_<N>_NAME |
Display name | Prowlarr |
INDEXER_<N>_TYPE |
Indexer type | prowlarr |
INDEXER_<N>_ENABLED |
Enable this indexer | true |
INDEXER_<N>_PRIORITY |
Display order only, does not affect searching | 1 |
INDEXER_<N>_BASE_URL |
Indexer base URL | http://prowlarr:9696 |
INDEXER_<N>_API_KEY |
Indexer API key | - |
INDEXER_<N>_API_PATH |
Newznab only. Endpoint path appended to the base URL; defaults to /api |
/api |
INDEXER_<N>_INDEXER_IDS |
Comma-separated indexer IDs | 1,2,3 |
INDEXER_<N>_CATEGORIES |
Comma-separated categories | movies,tv |
INDEXER_<N>_RATE_LIMIT |
Maximum requests per minute. Unset means no limit. | - |
INDEXER_<N>_TIMEOUT |
Request timeout in milliseconds | - |
Indexer Types: prowlarr, jackett, newznab, public
# Prowlarr
INDEXER_1_NAME=Prowlarr
INDEXER_1_TYPE=prowlarr
INDEXER_1_BASE_URL=http://prowlarr:9696
INDEXER_1_API_KEY=your-prowlarr-api-key
# Jackett
INDEXER_2_NAME=Jackett
INDEXER_2_TYPE=jackett
INDEXER_2_BASE_URL=http://jackett:9117
INDEXER_2_API_KEY=your-jackett-api-key
# Newznab (works with any Newznab-compatible indexer)
INDEXER_3_NAME=NZB Indexer
INDEXER_3_TYPE=newznab
INDEXER_3_BASE_URL=https://indexer.example
INDEXER_3_API_KEY=your-newznab-api-key
# Optional; defaults to /api
INDEXER_3_API_PATH=/api
Legacy nzbhydra2 type
Existing configurations with INDEXER_<N>_TYPE=nzbhydra2 keep working;
Mydia accepts the legacy value and treats it as newznab. New
configurations should use newznab.
Automatic Search
| Variable | Description | Default |
|---|---|---|
AUTO_SEARCH_MIN_SEEDERS |
Minimum seeders a result must report for an automatic search to consider it. A hard filter applied before ranking, so a torrent below it is removed rather than demoted. Manual searches have their own control, and Usenet results report no seeders and are exempt | 0 (filters nothing) |
Some indexers report zero seeders when they could not read the count rather than when a torrent is dead, so any nonzero floor can silently empty their results. See How Mydia decides which release to grab before raising it. Also settable under Admin > System > Settings > Downloads.
PostgreSQL Configuration
For PostgreSQL deployments (using latest-pg image):
| Variable | Description | Default |
|---|---|---|
DATABASE_TYPE |
Set to postgres |
sqlite |
DATABASE_HOST |
PostgreSQL hostname | localhost |
DATABASE_PORT |
PostgreSQL port | 5432 |
DATABASE_NAME |
Database name | mydia |
DATABASE_USER |
Database username | postgres |
DATABASE_PASSWORD |
Database password | - |
POOL_SIZE |
Connection pool size | 10 |
Remote Access (P2P)
| Variable | Description | Default |
|---|---|---|
P2P_KEYPAIR_PATH |
Path to store the P2P keypair for persistent node identity | - |
P2P_BIND_PORT |
UDP port for direct peer-to-peer connections (enables hole punching) | Random |
Note
P2P_KEYPAIR_PATH is required for remote access. Without it, the node ID changes on restart and paired devices can't reconnect.
Metadata Relay
| Variable | Description | Default |
|---|---|---|
METADATA_RELAY_URL |
URL for the metadata relay service | https://relay.mydia.dev |
The metadata relay proxies requests to TVDB/TMDB and handles remote access relay connections. See Architecture for details.
Language
| Variable | Description | Default |
|---|---|---|
DOWNLOAD_AUDIO_LANGUAGE |
Audio that automatic and manual search prefer when choosing a release: original for the show or film's own language, or a language code such as en, which prefers that dub and falls back to the original. Each show can override it from its page |
original |
AUDIO_LANGUAGE |
Audio track that plays, as a comma-separated list tried in order, for example original,en. When none matches, the track the file marks as default plays |
original,en |
PREFER_DEFAULT_AUDIO_TRACK |
Play the track the file marks as default and ignore AUDIO_LANGUAGE |
false |
DOWNLOAD_SUBTITLE_LANGUAGE |
Subtitles to go and fetch, comma-separated, for example en,es. Decides what a season fetch looks for and what subtitle search starts from |
en |
SUBTITLE_PLAYBACK_LANGUAGE |
Subtitle track to switch on for a show nobody has chosen one for, as a comma-separated list tried in order. Empty means no automatic subtitle | (empty) |
SUBTITLE_LANGUAGE |
Legacy name for DOWNLOAD_SUBTITLE_LANGUAGE and still read as the same setting. It names what to acquire, as it always did; only the key it lives under moved |
en |
METADATA_LANGUAGE |
Language sent to TMDB/TVDB for titles, descriptions, and posters. Accepts ISO 639-1 codes (de) or BCP 47 tags (de-DE, pt-BR). |
en-US |
Download audio and playback audio are separate settings. The first decides which release is downloaded, the second which of its tracks plays. Subtitles split the same way: DOWNLOAD_SUBTITLE_LANGUAGE decides what gets fetched, SUBTITLE_PLAYBACK_LANGUAGE which track switches on. SUBTITLE_LANGUAGE keeps working and still means acquisition: its meaning never changed, only where the setting lives.
Every variable in this section can also be set from Admin > System > Settings, under Language. An environment variable overrides the database value and locks the field there. Playback audio and the default-track option appear only when the player is enabled.
FlareSolverr
FlareSolverr is a proxy server used to bypass Cloudflare protection on indexer sites. Used by Cardigann indexers that require browser-based challenge solving.
| Variable | Description | Default |
|---|---|---|
FLARESOLVERR_URL |
FlareSolverr instance URL | - |
FLARESOLVERR_ENABLED |
Enable FlareSolverr integration | Auto-enabled if URL is set |
FLARESOLVERR_TIMEOUT |
Request timeout in milliseconds | 60000 |
FLARESOLVERR_MAX_TIMEOUT |
Maximum timeout in milliseconds | 120000 |
Automatic Quality Upgrades
These pace the daily upgrade sweep instance-wide. Which items it considers is set per quality profile instead; see Quality Profiles.
| Variable | Description | Default |
|---|---|---|
UPGRADE_SWEEP_ENABLED |
Master switch for the daily upgrade sweep. false stops all automatic upgrades without editing any profile |
true |
UPGRADE_SWEEP_BATCH_SIZE |
Maximum indexer searches one sweep run may cost. Counts searches, not items: a season pack covers a whole season for one | 50 |
MYDIA_TRASH_DIR |
Where replaced and deleted files are moved. Must be outside every library path. Unset trashes into .mydia-trash beside each library |
Beside each library |
See Automatic Quality Upgrades for what these cost you in disk.
Streaming
| Variable | Description | Default |
|---|---|---|
MAX_TRANSCODE_HEIGHT |
Ceiling in pixels on the output height of any transcode, for example 720. Unset means no ceiling and a transcode keeps the source resolution |
No limit |
A transcode only happens when a file's codec is not playable as-is, or when a player asks for a quality below the source. This ceiling bounds those; it never upscales, and it does not apply when a file is streamed without re-encoding. Set it on a server that cannot encode 4K in realtime, which is what an incompatible 4K file would otherwise ask of it. Also settable under Admin > System > Settings > Streaming.
Advanced Configuration
| Variable | Description | Default |
|---|---|---|
LOG_LEVEL |
Log level (debug, info, warning, error) | info |
MYDIA_PERF_METRICS |
Records hourly performance timings (page loads, API calls, database queries, background jobs) in the database, kept 14 days, for diagnosing slowness. Set to false, 0, no, or off to turn off |
true |
SKIP_BACKUPS |
Skip the automatic database snapshot Mydia takes before applying pending migrations. SQLite only, since PostgreSQL has no automatic backup to skip. Accepts true, 1, yes, on |
false |
See Backing Up and Restoring for what the automatic backup does, where it writes, and what it does not protect you from.
See Configuration for how these variables interact with database settings and the YAML config file.