Self-Hosting Configuration

Complete reference for Docker environment variables, Convex backend variables, service topology, and volume persistence.

This page is the complete configuration reference for a self-hosted Owlat instance. For step-by-step setup, see Self-Hosting.

Two Configuration Layers

Docker .env vs Convex env vars

Owlat uses two separate configuration layers. Mixing them up is the most common setup mistake.

  • Docker .env — read by Docker Compose at container startup. Controls ports, secrets shared between containers, and browser-facing URLs.
  • Convex environment variables — read by serverless functions inside the Convex backend. Set after deployment via npx convex env set. Controls application behavior: email provider, auth secrets, sender identity, integrations.

Docker Environment Variables

These go in the .env file at the project root. Docker Compose reads them when starting containers.

Convex Backend

VariableRequiredDefaultDescription
INSTANCE_SECRETYesConvex backend instance identity. Generate with openssl rand -hex 32.
CONVEX_ADMIN_KEYYesAdmin key for deploying functions. Generated after first boot via docker compose exec convex ./generate_admin_key.sh.

Public URLs

These must be reachable from the user's browser — do not use Docker-internal hostnames.

VariableRequiredDefaultDescription
NUXT_PUBLIC_CONVEX_URLYeshttp://localhost:3210Convex backend URL (browser → Convex).
NUXT_PUBLIC_CONVEX_SITE_URLYeshttp://localhost:3211Convex site proxy URL (browser → HTTP actions).
NUXT_PUBLIC_SITE_URLYeshttp://localhost:3000Web application URL.

MTA Configuration

VariableRequiredDefaultDescription
MTA_API_KEYYesShared secret for Convex → MTA authentication. Generate with openssl rand -base64 32.
MTA_WEBHOOK_SECRETYesHMAC secret for MTA → Convex webhook callbacks. Generate with openssl rand -base64 32.
EHLO_HOSTNAMEYesmail.localhostSMTP EHLO/HELO hostname. Must match your server's rDNS PTR record in production.
RETURN_PATH_DOMAINYesbounces.localhostDomain for VERP bounce return-path addresses. Needs an MX record pointing to your server.
IP_POOLS_TRANSACTIONALNo127.0.0.1Comma-separated IPs for transactional email delivery.
IP_POOLS_CAMPAIGNNo127.0.0.1Comma-separated IPs for campaign/marketing email delivery.
DKIM_KEYSNo{}DKIM signing keys as JSON. See DNS & Email Setup.
WORKER_CONCURRENCYNo50Number of parallel MTA worker threads.
MTA_LOG_LEVELNoinfoMTA log verbosity: debug, info, warn, error.

Port Overrides

All ports can be changed if the defaults conflict with existing services.

VariableDefaultService
CONVEX_PORT3210Convex backend API
CONVEX_SITE_PORT3211Convex HTTP actions
DASHBOARD_PORT6791Convex dashboard
WEB_PORT3000Web application
MTA_HTTP_PORT3100MTA HTTP API
MTA_SMTP_PORT25MTA SMTP (bounce processing)
REDIS_PORT6379Redis
CLAMAV_PORT3310ClamAV
NEST_PORT3001Admin panel

Analytics (Optional)

VariableDefaultDescription
NUXT_PUBLIC_POSTHOG_API_KEYPostHog project API key for client-side tracking.
NUXT_PUBLIC_POSTHOG_HOSThttps://eu.i.posthog.comPostHog instance URL.

Convex Environment Variables

These are set after deploying functions. They control application-level behavior inside the Convex backend.

npx convex env set VAR_NAME "value" \
  --url http://localhost:3210 \
  --admin-key <your-admin-key>

Required

VariableDescription
SITE_URLPublic site URL for auth redirects (e.g., http://localhost:3000).
CONVEX_SITE_URLConvex site URL for tracking pixels and unsubscribe links.
BETTER_AUTH_SECRETSecret for signing auth sessions. Generate with openssl rand -base64 32.
UNSUBSCRIBE_SECRETHMAC secret for signed unsubscribe tokens. Generate with openssl rand -base64 32.
EMAIL_PROVIDEREmail provider: mta (default), ses, or resend.
MTA_API_URLMTA service URL. Use http://mta:3100 for Docker networking.
MTA_API_KEYMust match the MTA_API_KEY in Docker .env.
MTA_WEBHOOK_SECRETMust match the MTA_WEBHOOK_SECRET in Docker .env.

Sender Identity

VariableDefaultDescription
DEFAULT_FROM_EMAILnoreply@example.comDefault sender email address.
DEFAULT_FROM_NAMEOwlatDefault sender display name.
DEFAULT_FROM_DOMAINmail.owlat.appDomain for system emails (invitations, etc.).
ALLOWED_ORIGINSComma-separated CORS origins (e.g., http://localhost:3000,http://localhost:3001).

Optional Integrations

VariableDescription
GOOGLE_SAFE_BROWSING_API_KEYGoogle Safe Browsing API v4 key for URL reputation checking.
MTA_INTERNAL_URLMTA URL for ClamAV attachment scanning (e.g., http://mta:3100).
POSTHOG_API_KEYPostHog API key for server-side analytics.
POSTHOG_HOSTPostHog instance URL (default: https://eu.i.posthog.com).
OPENROUTER_API_KEYOpenRouter API key for AI-powered translations.
OPENAI_API_KEYOpenAI API key for AI translations (fallback).

For the complete variable reference including AWS SES, Resend, and control plane variables, see Environment Variables.

Service Topology

ServicePortsDepends OnHealthcheck
convex3210 (API), 3211 (site proxy)curl -f http://localhost:3210/version every 15s
convex-dashboard6791convex (healthy)
web3000convex (healthy)
mta3100 (HTTP), 25 (SMTP)redis (healthy), clamav (healthy), convex (healthy)
redis6379redis-cli ping every 10s
clamav3310clamdcheck every 60s (120s start delay)
nest3001convex (healthy)
convex-deployconvex (healthy)One-shot (deploy profile)
nest-api-deployconvex (healthy)One-shot (deploy profile)

Volumes

VolumePersistsBackup Priority
convex-dataDatabase, file storage, vector indexesCritical — all application data
redis-dataMTA job queue (AOF)Medium — in-flight email jobs
clamav-dataVirus definition signaturesLow — re-downloads automatically