Harbor

Configuration

The settings the installer writes to /data/harbor.env, and what each one means. Change them with harbor config.

On this page

Most settings are made once by the installer. Since v0.4.0 the language model is chosen in Settings, not here. harbor config edits the file; harbor start applies it.

Where things are#

VariableMeaning
HARBOR_DATA_DIRWhere documents, database, queues and secrets live. Default /data. Must be on an encrypted volume.
HARBOR_IMAGE_TAGThe release the box runs. Changed by harbor config, applied by harbor upgrade.

Reaching the vault#

VariableMeaning
TS_AUTHKEYOptional. A Tailscale auth key. With it the vault is reachable only on your tailnet, over HTTPS, and nothing listens on the machine's own interfaces. Needed only on first start.
TAILSCALE_HOSTNAMEThe name the vault takes in your tailnet.
WEB_ORIGINThe address the vault is reached at, such as https://harbor.your-tailnet.ts.net.
HARBOR_BIND, HARBOR_WEB_PORTWithout Tailscale, the address and port to publish on: a LAN address, or the address a VPN you run gives the box. Default 127.0.0.1:3000.
SESSION_COOKIE_SECUREtrue behind HTTPS.

Backups#

VariableMeaning
RESTIC_REPOSITORYWhere snapshots go: b2:bucket:/harbor, sftp:user@host:/path, or /backup for a second disk.
B2_ACCOUNT_ID, B2_ACCOUNT_KEYThe Backblaze application key, restricted to that bucket and without the permission to delete.
HARBOR_BACKUP_DIRFor a second disk: the directory on the host mounted as /backup.
BACKUP_HOURWhen the nightly run starts. Default 3.
BACKUP_PRUNEfalse to keep every snapshot until you prune from a machine with a full key.
TZThe zone BACKUP_HOUR is read in, such as Europe/Berlin.

Reading documents#

VariableMeaning
OCR_CONCURRENCYPages read at once. Cores minus one on a small box.
OCR_LANGUAGESThe languages your paperwork arrives in, such as deu+eng.

Suggestions#

VariableMeaning
SUGGEST_SEND_PEOPLEfalse withholds your list of people and things from the model. Suggestions then arrive without a "who is this about" prefill. See The language model.

Mail#

VariableMeaning
MAIL_SYNC_INTERVAL_SECONDSHow often connected mailboxes are checked. Default 300.

The secrets, the master key and the backup password, are files under HARBOR_DATA_DIR/secrets, never variables. They belong on the envelope.