Configure

Bind address.

No doc comment in config.rs; described from the Dockerfile.

The container image sets 0.0.0.0.

Listen port.

No doc comment in config.rs; described from the Dockerfile.

The container image sets 8080.

e.g. https://rim.example.com. Required to build clickable reset-password/invite links; without it, emails fall back to including the bare token/no link.

Dockerfile: https origin; turns server-to-server traffic on. This or RIM_KEY_LOGIN_AUDIENCES is required: the server binds 0.0.0.0 and refuses to start without an audience for key logins.

one browser origin accepted besides the server's own (optional); the own origin is RIM_PUBLIC_BASE_URL's, else the request's Host.

No doc comment in config.rs; described from the Dockerfile.

When true, the server reads X-Forwarded-For / Forwarded headers to determine the real client IP for rate-limiting. Only enable this when a trusted reverse proxy (Nginx, Caddy, Traefik, …) is the sole entry point; enabling it without a proxy lets attackers spoof their IP and defeat the rate limiters.

Dockerfile: Read the client address from X-Forwarded-For / Forwarded when true; only behind a reverse proxy that is the sole way in.

When true, all session and CSRF cookies are issued with Secure=true regardless of the incoming request scheme or X-Forwarded-Proto header. Use this for direct-HTTPS deployments where the reverse proxy does not forward the X-Forwarded-Proto header.

Dockerfile: Mark session and CSRF cookies Secure whatever the request scheme when true.

Comma-separated host[:port] values a key login proof may name as its audience.

The audiences a key login proof may name: this server's host[:port] as clients reach it. A proof naming another server is refused, so a server that receives a proof cannot replay it elsewhere.

RIM_KEY_LOGIN_AUDIENCES when set; otherwise the host of RIM_PUBLIC_BASE_URL; otherwise localhost:PORT and 127.0.0.1:PORT, but only for a server bound to a loopback address. Lowercased.

Refused at boot with a message naming both variables when neither is set and RIM_SERVER_HOST accepts connections from other machines.

Dockerfile: comma-separated host[:port] clients reach this server at.

PostgreSQL connection string.

No doc comment in config.rs; described from the Dockerfile.

Largest number of Postgres connections the server's pool opens; unset keeps the driver's default of 10.

Unset, it keeps the driver's default of 10.

Dockerfile: Size of the PostgreSQL pool.

Data directory.

No doc comment in config.rs; described from the Dockerfile.

The container image sets /app/data.

Directory of uploaded files (attachments, custom emoji, plugin bundles), created when missing; unset uses files under RIM_DATA_DIR.

Unset, it uses `files` under `RIM_DATA_DIR`.

Dockerfile: Directory of uploaded files.

The container image sets /app/data/uploads.

Bytes one workspace may store: its attachments, uploads in progress included, and its plugin bundles; an upload past it is refused. Default 1 GiB (1073741824).

Dockerfile: Bytes of attachments and plugin bundles one workspace may store.

Path of the server key file. Default <RIM_DATA_DIR>/server-key.json.

Dockerfile: Server key file; keep the data directory on a volume, the key is the server's identity.

Path of the franking key file. Default <RIM_DATA_DIR>/franking-key.json.

Dockerfile: Franking key file.

Set RIM_OPEN_REGISTRATION=true to enable open signup.

Dockerfile: Let anyone sign up, rate-limited, when true.

Leading zero bits a key-only signup's proof-of-work needs; set, it turns on pow registration. 1 to 40.

Dockerfile: turns on proof-of-work signups with that many leading zero bits.

Refuse every password signup, so new accounts sign up with a key only; unset is true. Password sign-in of existing accounts is unaffected.

Whether password signups are refused: RIM_SIGNUP_REQUIRE_KEYS, true when unset.

Dockerfile: Refuse every password signup, so accounts sign up with a key; password sign-in of existing accounts still works.

The id of a workspace on this server that every new account joins as a member, with its public channels, whichever way it signs up. Unset keeps signups as they are: a new account joins only the workspace its invite names. The server refuses to start when the workspace does not exist here or is the direct space.

RIM_DEFAULT_WORKSPACE, trimmed; None when unset or blank. Whether the workspace exists is checked against the database at start.

Unset, it keeps signups as they are: a new account joins only the workspace its invite names.

Refused at boot with a message naming the variable when the value is not a workspace id.

Dockerfile: id of a workspace here every new account joins as a member; one that does not exist stops the server at boot.

Comma-separated usernames and display names signups and profile edits refuse, with each followed by -, _, . or a space.

RIM_RESERVED_NAMES, compared case-insensitively after NFKC normalisation; nothing is reserved when it is unset or blank.

Refused at boot with a message naming the variable when an entry is empty, as in rim,,admin.

Dockerfile: comma-separated usernames and display names signups and profile edits refuse, also followed by -, _, . or a space; an empty entry stops the server at boot.

Hours after its creation during which an account cannot create a workspace or send a DM request to a stranger; unset or 0 turns probation off.

Unset, it turns probation off.

Dockerfile: hours after creation during which an account creates no workspace and sends no DM request to a stranger.

Session lifetime.

No doc comment in config.rs; described from the Dockerfile.

The terms of service every signup accepts, an absolute http(s) URL.

RIM_TERMS_URL, trimmed; None when unset or blank.

Refused at boot with a message naming the variable when the value is not an absolute http or https URL with a host.

Dockerfile: absolute http(s) URL of the terms of service; set, every signup must accept it; a malformed URL stops the server at boot.

Days between an account's deletion request and its purge, 0 to 30; default 14.

Refused at boot with a message naming the variable when the value is above 30.

Dockerfile: days between an account's deletion request and its purge, 0-30; outside the range stops the server at boot.

relay, host or both (default).

Refused at boot with a message naming the value when it is not relay, host or both.

Dockerfile: relay, host or both.

Comma-separated server ids allowed on host endpoints; empty allows any relay.

Refused at boot with a message naming the first entry that is not a server id.

Dockerfile: Server ids allowed on host endpoints, comma-separated.

DMs from people on other servers, and from people here who share no workspace with the recipient: open (no floor), requests (default: their first message is a request the recipient accepts), partners (only people on the servers RIM_DM_PARTNERS lists, and on this one, with a request; other servers get no identity or key package of anyone here) or none (nobody outside a shared workspace; other servers get no identity or key package). Members of a shared workspace follow the workspace's rules instead.

Refused at boot with a message naming the variable whose value is not one it takes, or the first partner that is not a server id.

Dockerfile: DMs from other servers, and from people here who share no workspace with the recipient: open, requests (their first message is a request the recipient accepts), partners (only people on the RIM_DM_PARTNERS servers and this one, with a request) or none; with partners or none other servers get no identity of anyone here.

DMs people here start with people on other servers: allowed (default), partners (only with people on the servers RIM_DM_PARTNERS lists) or none.

Dockerfile: DMs people here start with people on other servers: allowed, partners (only with people on the RIM_DM_PARTNERS servers) or none.

Comma-separated server ids the partners settings of RIM_DM_INBOUND and RIM_DM_OUTBOUND name.

Dockerfile: Server ids the partners settings of RIM_DM_INBOUND and RIM_DM_OUTBOUND name, comma-separated.

Comma-separated server ids refused on every server-to-server endpoint.

Refused at boot with a message naming the first entry that is not a server id.

Dockerfile: Server ids refused on every server-to-server endpoint, comma-separated.

Server-to-server requests accepted per peer per minute, per node. Default 600.

Dockerfile: Server-to-server requests per peer per minute.

Largest server-to-server request body. Default 8 MiB.

Dockerfile: Largest server-to-server request body.

Allow peers on loopback, private, link-local and unique-local addresses (development and tests only).

Dockerfile: Allow peers on private addresses when true; development only.

Allow server-to-server traffic over plain http (development and tests only).

Dockerfile: Allow server-to-server traffic over http when true; development only.

Forwarded requests accepted per device per minute. Default 120.

Dockerfile: Forwarded requests per device per minute.

Active delegations one relay may hold on this host. Default 10,000.

Dockerfile: Delegations one relay may hold on this host.

Bytes queued per local user before the oldest items are dropped. Default 256 MiB.

Dockerfile: bytes queued per local user before the oldest items are dropped, at least 1048576.

Days queued items and DM requests are kept. Default 30.

Dockerfile: days queued items and DM requests are kept, 1-365.

Largest profile card, in bytes. Default and most 131072.

Dockerfile: largest profile card, 1024-131072.

Unclaimed one-time key packages per device and cipher suite. Default 100.

Dockerfile: unclaimed key packages per device, 1-1000.

Devices that are not revoked, per user. Default 32.

Dockerfile: devices per user that are not revoked, 1-64.

Requests a user sends through /api/remote/… per day. Default 50000.

Dockerfile: requests a user sends through /api/remote per day.

DM requests one sender principal files here per day, and invites a local user sends to people on other servers per day. Default 20.

Dockerfile: DM requests one sender files here, and invites a local user sends to other servers, per day.

How often (seconds) the notification digest job looks for due digests. Default: 900 (15 minutes); values below 60 are raised to 60.

Dockerfile: Seconds between digest runs, at least 60.

SMTP server; without it or RIM_SMTP_FROM mail is only logged.

No doc comment in config.rs; described from the Dockerfile.

Defaults to 587 (STARTTLS) when unset.

Dockerfile: SMTP port.

SMTP user name.

No doc comment in config.rs; described from the Dockerfile.

SMTP password.

No doc comment in config.rs; described from the Dockerfile.

The From: address/mailbox, e.g. "RIM <noreply@example.com>".

Dockerfile: From address, e.g. RIM noreply@example.org.

"starttls" (default) | "implicit" | "none" (dev/localhost only).

Dockerfile: starttls, implicit or none.

host:port of the Prometheus listener serving GET /metrics; unset turns metrics off.

Unset, it turns metrics off.

Refused at boot with a message naming the variable when the value is not an ip:port address.

Dockerfile: ip:port of the Prometheus /metrics listener. In a container bind 0.0.0.0:9090 and do not publish it: keep it on an internal network, never behind the public proxy.

Directory of audit.log

Read by rim_logging/src/logging.rs, not config.rs.

Days command audit log rows are kept before the daily purge exports and deletes them; unset keeps them forever. 1 to 3650.

Unset, it keeps them forever.

Refused at boot with a message naming the variable when the value is outside 1 to 3650.

Dockerfile: days command audit rows are kept, 1-3650; older rows are exported to $RIM_DATA_DIR/audit-exports and deleted daily.

Comma-separated optional features switched off on this instance, e.g. attachments,custom_emoji; unset or empty keeps every feature on.

RIM_FEATURES_DISABLED as features; empty when unset.

Unset, it keeps every feature on.

Refused at boot with a message naming the variable and the first name that is not a feature, so a typo stops the server instead of leaving a feature on.

Dockerfile: comma-separated optional features to switch off: attachments, link_previews, email, custom_emoji, workspace_plugins, ai_commands; an unknown name stops the server at boot.

Log filter, e.g. info or rim_server=debug.

The logger reads it, not config.rs.

Serve the GraphiQL explorer at GET /api when true.

No doc comment in config.rs; described from the Dockerfile.

A short text shown to people on this instance, at most 500 characters.

RIM_INSTANCE_NOTICE, trimmed; None when unset or blank.

Refused at boot with a message naming the variable when the notice is longer than 500 characters.

Dockerfile: a short text shown to people on this instance, at most 500 characters; longer stops the server at boot.

Link preview fetches the process runs at once, 1 to 64; default 8.

RIM_LINK_PREVIEW_CONCURRENCY: the link preview fetches the process runs at once; 8 when unset.

Refused at boot with a message naming the variable when the value is outside 1 to 64.

Dockerfile: link preview fetches the server runs at once, 1-64; outside the range stops the server at boot.

Argon2 hashes and verifications the server runs at once, 1 to 64; default the number of CPUs.

RIM_PASSWORD_HASH_CONCURRENCY: the Argon2 computations run at once; the number of CPUs, within 1 to 64, when unset.

Refused at boot with a message naming the variable when the value is outside 1 to 64.

Dockerfile: Argon2 password hashes and checks run at once, 1-64; each holds 64 MiB while it runs, and a request that waits over 10 seconds for a turn answers UNAVAILABLE.

Most GraphQL requests in one batch. Default 20.

Dockerfile: GraphQL requests in one batch.

Seconds between rechecks of the sessions WebSocket connections run under; unset is 30, 0 turns the recheck off.

Dockerfile: seconds between rechecks of the sessions WebSocket connections run under, closing those that ended elsewhere.

Requests one client address sends to /api routes per minute, with a burst of the same size; unset or 0 sets no limit.

Unset, it sets no limit.

Dockerfile: requests per client address per minute to /api routes, with a burst of the same size; over it 429.

Mutation fields one session runs per minute, counted per GraphQL request; callers without a session count per address. Unset or 0 sets no limit.

Unset, it sets no limit.

Dockerfile: mutation fields per session per minute.

Messages one user sends per minute; unset or 0 sets no limit.

Unset, it sets no limit.

Dockerfile: messages per user per minute.

Messages one user may send at once before the per-minute rate applies; unset uses the per-minute number.

Unset, it uses the per-minute number.

Dockerfile: messages a user may send at once.

WebSocket connections one user holds open at once; unset or 0 sets no limit.

Unset, it sets no limit.

Dockerfile: open WebSocket connections per user.

Subscriptions one WebSocket connection holds at once; unset or 0 sets no limit.

Unset, it sets no limit.

Dockerfile: subscriptions per WebSocket connection.

Messages an account in probation sends per minute, with a burst of the same size, instead of the normal message rate; unset or 0 keeps the normal rate.

Unset, it keeps the normal rate.

Dockerfile: messages per minute of an account in probation, instead of the normal rate.

Workspaces one user owns.

Dockerfile: workspaces one user owns.

Members of one workspace; the direct space has no cap.

Dockerfile: members of a workspace (the direct space has none).

Channels of one workspace, public and private.

Dockerfile: channels of a workspace, public and private.

Devices on one account; the stricter of this and RIM_RELAY_DEVICES_PER_USER applies.

Dockerfile: devices on one account; the stricter of this and RIM_RELAY_DEVICES_PER_USER applies.

DM requests one user sends to strangers per day; the stricter of this and RIM_RELAY_DM_REQUESTS_PER_DAY applies.

Dockerfile: DM requests to strangers per user per day; the stricter of this and RIM_RELAY_DM_REQUESTS_PER_DAY applies.

Macros of one workspace.

Dockerfile: macros of a workspace.

Pipelines of one workspace.

Dockerfile: pipelines of a workspace.

Plugins of one workspace's registry.

Dockerfile: plugins of a workspace's registry.

Invites one user creates per day.

Dockerfile: workspace invites one user creates per day.

Uses one invite may have.

Dockerfile: the uses one invite may have.

Bytes of one message's text, at most 65536.

Dockerfile: bytes of a message's text, at most 65536; more stops the server at boot.

Pending invitations to encrypted conversations one user holds; unlike the other caps it defaults to 50, and 0 turns it off.

Dockerfile: pending invitations to encrypted conversations one user holds; unlike the others it is on unless set to 0.