Environment variables

Every STERNWAY_* environment variable the sync server, the desktop app and the sternway-cli command read. Variables used only by tests, development builds, Sternway’s own builds and its hosted service are left out.

Sync server

Variable	Default	What it does
STERNWAY_DATABASE_URL	pglite://memory	Where the server keeps its data: postgres://user:password@host:5432/database for a real server. pglite://memory and pglite://<folder> are for development and tests only: not durable, not safe for concurrent use.
STERNWAY_SERVER_SECRET	none (required)	At least 32 random bytes, base64 (openssl rand -base64 32). Encrypts the stored two-factor secrets. Changing it makes every stored two-factor secret unreadable, so users set up two-factor again: treat it like a database password.
STERNWAY_PUBLIC_URL	http://localhost:<port>	The address apps and browsers reach the server at. Used in invite links, for passkeys, for SAML and for the licence. Set it to the https:// address.
STERNWAY_PORT	8080	The port the server listens on.
STERNWAY_HOST	0.0.0.0	The address the server listens on.
STERNWAY_LOG_LEVEL	info	How much the server logs (fatal, error, warn, info, debug, trace).
STERNWAY_CORS_ORIGINS	none	Browser origins allowed to call the API, separated by commas. The apps do not need it.
STERNWAY_TRUST_PROXY	trust no proxy	The reverse proxies allowed to set X-Forwarded-For: their exact addresses or CIDR ranges, separated by commas (127.0.0.1). true trusts every hop, which lets any client choose its own address; avoid it.
STERNWAY_SMTP_URL	none	An SMTP address (smtp://user:password@mail.example.com:587) for invite mail, passkey notices and email verification. Without it invites work by link and email addresses cannot be verified.
STERNWAY_AI_PROXY	none	JSON {"kind":"openai","baseUrl","apiKey","model","timeoutMs"?}: lets the apps send AI requests through the server to an OpenAI-compatible service, instead of each device using its own key.
STERNWAY_OIDC	none (SSO off)	JSON {"issuer","clientId","clientSecret"?,"publicClientId"?,"audiences"?,"mode":"hybrid"|"enforced","scopes"?}: server-wide single sign-on through an OpenID Connect provider. enforced refuses password sign-in.
STERNWAY_WEBAUTHN_RP_ID	the host of STERNWAY_PUBLIC_URL	The domain passkeys are bound to: that host or a parent domain of it. Moving the server outside it makes every passkey stop working.
STERNWAY_WEBAUTHN_ORIGINS	none	More origins passkey ceremonies may run on, separated by commas, when the server is reached under more than one address.
STERNWAY_AUDIT_PUSH_URL	none	An https:// endpoint (a SIEM collector) the server sends every audit event to as NDJSON. Needs a licence that includes audit push.
STERNWAY_AUDIT_PUSH_TOKEN	none	Sent with each audit push as Authorization: Bearer <token>. Never logged.
STERNWAY_LICENCE	none	The path of the licence file. Read at start and every hour. Without one, teams have the features a self-hosted server has without a licence.
STERNWAY_DELEGATED_SIGNING	on	off refuses every team change an admin signs; the owner’s changes still go through. A switch for emergencies.
STERNWAY_TEAM_TAIL_MAX	500	How many admin-signed changes a team may collect before its owner’s app checkpoints them (100 to 2000).

Desktop app

Variable	Default	What it does
STERNWAY_TITLEBAR	chosen by the app	system gives the window the operating system’s title bar, custom the app’s own, for one run.
STERNWAY_FIDO_DEVICE	search every device	Linux: the security key device nodes to use, separated by commas (/dev/hidraw3), instead of searching for them.

sternway-cli

Variable	Default	What it does
STERNWAY_CLI_DIR	see the command line reference	An absolute folder for the command line’s socket and endpoint file, used by the app and the command alike. For tests.
STERNWAY_TOKEN	none	The CLI token the command sends, unless --token-file names a file.

How to set the server’s variables: Run your own sync server and Run the sync server.