Settings Reference
Every environment variable the SealSkin server reads, with its default.
Every setting is read once at start-up from an environment variable named
SEALSKIN_<NAME>. Booleans accept true, 1, or yes (anything else is
false); an unparsable integer falls back to the default with an error in the
log. When the server runs in the
linuxserver/sealskin
container the defaults already point at the /config and /storage volumes,
so most installations set none of these.
HOST_URL is the one variable without the prefix: it is read by the
first-run admin bootstrap and written into /config/admin.json as the
server address. See Configuration for the files these
paths refer to.
| Variable | Type | Default | Description |
|---|---|---|---|
SEALSKIN_LOG_LEVEL | str | INFO | Logging level (e.g., DEBUG, INFO, WARNING). |
SEALSKIN_API_PORT | int | 8000 | Port for the main API server. |
SEALSKIN_SESSION_PORT | int | 8443 | Port for the session proxy server. |
SEALSKIN_DEFAULT_PROVIDER | str | auto | Backend that runs sessions: docker, kubernetes, or auto, which picks Kubernetes when the server runs in a Kubernetes pod and Docker otherwise. |
SEALSKIN_APP_RESOURCE_PATH | str | https://raw.githubusercontent.com/linuxserver/sealskin-apps/refs/heads/master/apps.yml | URL for the YAML file defining default available applications. |
SEALSKIN_INSTALLED_APPS_PATH | str | /config/.config/sealskin/installed_apps.yml | Path to the YAML file for installed application configurations. |
SEALSKIN_APP_STORES_PATH | str | /config/.config/sealskin/app_stores.yml | Path to the YAML file defining available app stores. |
SEALSKIN_APP_TEMPLATES_PATH | str | /config/.config/sealskin/app_templates | Path to the directory for user-defined application templates. |
SEALSKIN_DEFAULT_APP_TEMPLATES_PATH | str | app/default_templates | Path to the directory for default application templates. |
SEALSKIN_UPLOAD_DIR | str | /storage/sealskin_uploads | Directory for temporary file uploads (one sub-directory per user). |
SEALSKIN_SESSION_COOKIE_NAME | str | sealskin_session_token | Name of the session cookie. |
SEALSKIN_AUTOSTART_CACHE_PATH | str | /config/.config/sealskin/autostart_cache | Path to cache autostart scripts. |
SEALSKIN_APP_STORE_CACHE_PATH | str | /config/.config/sealskin/app_stores_cache | Path to cache app store YAML files. |
SEALSKIN_PROOT_CATALOGS_PATH | str | /config/.config/sealskin/proot_catalogs.yml | Path to the YAML file of the PRoot Apps catalogs, shared by the nodes of a cluster. |
SEALSKIN_PROOT_APPS_PATH | str | /storage/sealskin_proot_apps | Directory this node keeps the content of every PRoot Apps catalog in, one folder per catalog, mounted read-only into the sessions of the users assigned to it. |
SEALSKIN_PROOT_APPS_REMOTE | str | linuxserver/proot-apps | The PRoot Apps remote the catalog editor opens with: the GitHub owner/repo of a proot-apps repository, whose apps are tags of ghcr.io/<owner>/<repo>, or the base URL under which metadata/metadata.yml is served and the registry its apps are tags of, separated by a space (https://git.example/raw/it/proot-apps/main registry.example/it/proot-apps). Catalogs name its apps by their short names, which sessions on a catalog resolve through PA_DEFAULT_REPO; the apps of any other remote are named by their image. |
SEALSKIN_VPN_PROFILES_PATH | str | /config/.config/sealskin/vpn_profiles.yml | Path to the YAML file of the VPN profiles, shared by the nodes of a cluster. |
SEALSKIN_VPN_IMAGE | str | ghcr.io/selkies-project/sealskin-vpn:latest | Image of the VPN gateway a node starts beside the sessions that chose a VPN profile, and of the helper that points a session's default route at it. |
SEALSKIN_VPN_HUB_SUBNET | str | 10.231.0.0/16 | On Kubernetes, the network a VPN hub and the sessions' spokes take their addresses from, the hub at .1; change it when it collides with a network the cluster reaches. |
SEALSKIN_VPN_LOCAL_CIDRS | str | 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 | On Kubernetes, the networks a session pod and a VPN hub keep reaching directly beside the tunnel: the cluster's pod and Service ranges, and whatever else on the private ranges a session must reach without the VPN. Comma separated. |
SEALSKIN_VPN_SUBNETS | str | 10.230.0.0/16 | Address range the internal networks of the VPN gateways are carved from, one /24 per gateway; change it when it collides with a network the host reaches. |
SEALSKIN_AUTO_UPDATE_APPS | bool | true | Enable automatic pulling of the latest app images in the background. |
SEALSKIN_AUTO_UPDATE_INTERVAL_SECONDS | int | 3600 | How often to check for app image updates (in seconds). |
SEALSKIN_IMAGE_MIRRORS | str | (empty) | Mirror per upstream registry every image is pulled through, as upstream=mirror pairs separated by commas: lscr.io=registry.example/lscr,docker.io=registry.example/hub pulls lscr.io/linuxserver/firefox as registry.example/lscr/linuxserver/firefox. Records keep the upstream name. |
SEALSKIN_REGISTRY_AUTH_PATH | str | /config/.docker/config.json | Docker config.json whose auths sign this node in to registries: for session and gateway images, digest checks, and the packages of PRoot Apps catalogs. Read at every use; credential helpers are not run. On Kubernetes the session template's pull secrets add to it. |
SEALSKIN_NETRC_PATH | str | /config/.netrc | netrc file whose machines sign this node in to the hosts of app stores, autostart scripts, logos, and the metadata and icons of PRoot Apps catalogs, with basic authentication. Read at every use. |
SEALSKIN_PUID | int | 1000 | Default User ID to run containers as. |
SEALSKIN_PGID | int | 1000 | Default Group ID to run containers as. |
SEALSKIN_KEYS_BASE_PATH | str | /config/.config/sealskin/keys | Base directory for admin and user public keys. |
SEALSKIN_GROUPS_BASE_PATH | str | /config/.config/sealskin/groups | Base directory for group definition files. |
SEALSKIN_STORAGE_PATH | str | /storage | Base directory for user home directories. |
SEALSKIN_APP_ICONS_PATH | str | /storage/sealskin_app_icons | Directory for storing custom-uploaded application icons. |
SEALSKIN_BRANDING_PATH | str | /config/.config/sealskin/branding | Directory of the brand the web app wears: branding.yml and the logo and wallpaper an administrator uploads. Shared by every node of a cluster. |
SEALSKIN_HOME_TEMPLATES_PATH | str | /storage/sealskin_home_templates | Base directory for meta-app home directory templates. |
SEALSKIN_CONTAINER_CONFIG_PATH | str | /config | Mount point for home directories inside the container. |
SEALSKIN_SERVER_PRIVATE_KEY_PATH | str | /config/ssl/server_key.pem | Path to the server private key PEM file. |
SEALSKIN_PROXY_KEY_PATH | str | /config/ssl/proxy_key.pem | Path to the proxy SSL private key file. |
SEALSKIN_PROXY_CERT_PATH | str | /config/ssl/proxy_cert.pem | Path to the proxy SSL certificate file. |
SEALSKIN_PUBLIC_STORAGE_PATH | str | /storage/sealskin_public | Directory for storing publicly shared files. |
SEALSKIN_PUBLIC_SHARES_METADATA_PATH | str | /config/.config/sealskin/public_shares.yml | Path to the YAML file for public share metadata. |
SEALSKIN_SHARE_CLEANUP_INTERVAL_SECONDS | int | 600 | How often to run the cleanup job for expired shares (in seconds). |
SEALSKIN_SESSIONS_DB_PATH | str | /config/.config/sealskin/sessions.yml | Path to the YAML file for session persistence. |
SEALSKIN_CADDYFILE_PATH | str | /config/.config/sealskin/Caddyfile | Path to the generated Caddyfile for the proxy. |
SEALSKIN_UI_PATH | str | app/ui inside the installed package, else <repo>/client/dist/ui | Directory holding the built web UI served under /ui. |
SEALSKIN_TEMPLATE_SCHEMA_PATH | str | template_schema.yml next to the server package | YAML file describing the environment variables editable in app templates. |
SEALSKIN_CRYPTO_SESSION_TTL_SECONDS | int | 86400 | Idle lifetime of an E2EE session key before it is discarded. |
SEALSKIN_SSO_KEYS_PATH | str | /config/.config/sealskin/sso_keys.yml | Path to the YAML file of browser keys registered by signing in through an identity provider. |
SEALSKIN_OIDC_ISSUER | str | (empty) | Issuer URL of an OpenID Connect provider the web app offers sign-in with; empty offers none. |
SEALSKIN_OIDC_CLIENT_ID | str | (empty) | Client ID of SealSkin at the OpenID Connect provider. |
SEALSKIN_OIDC_CLIENT_SECRET | str | (empty) | Client secret of SealSkin at the OpenID Connect provider; empty for a public client. |
SEALSKIN_OIDC_SCOPES | str | openid profile email | Scopes requested from the OpenID Connect provider. |
SEALSKIN_SAML_METADATA_URL | str | (empty) | Metadata URL of a SAML identity provider the web app offers sign-in with; empty offers none. |
SEALSKIN_SSO_USERNAME_CLAIM | str | (empty) | Claim (OpenID Connect) or attribute (SAML, by its Name or FriendlyName) naming the SealSkin user; empty takes preferred_username, or the SAML attribute username, else the SAML NameID. |
SEALSKIN_SSO_GROUPS_CLAIM | str | groups | Claim or attribute listing the user's groups at the identity provider. |
SEALSKIN_SAML_USERNAME_ATTRIBUTE | str | (empty) | SAML attribute naming the SealSkin user, by its Name or FriendlyName, where OpenID Connect is set up beside SAML and names its claim otherwise; empty takes sso_username_claim. |
SEALSKIN_SAML_GROUPS_ATTRIBUTE | str | (empty) | SAML attribute listing the user's groups; empty takes sso_groups_claim. |
SEALSKIN_SSO_ADMIN_GROUP | str | (empty) | Identity provider group whose members sign in as administrators; empty makes none. |
SEALSKIN_SSO_MAX_AGE_SECONDS | int | 43200 | Longest an identity provider sign-in lasts; one the provider ends sooner ends then. |
SEALSKIN_STORE_URL | str | file | Where the objects the nodes of a cluster share are kept: file for this server's own files, or s3://<bucket>/<prefix>?endpoint=<url>®ion=<region> for a bucket of an S3-compatible service. |
SEALSKIN_STORE_ACCESS_KEY | str | (empty) | Access key id for an S3 store. |
SEALSKIN_STORE_SECRET_KEY | str | (empty) | Secret access key for an S3 store. |
SEALSKIN_STORE_KEY | str | (empty) | Secret every node of a cluster holds, under which the users' shared files are encrypted on their way to a remote store, each user under a key of their own. Any long random string, the same on every node; empty sends the files as they are. |
SEALSKIN_STORE_POLL_SECONDS | int | 15 | How often a node looks for objects another node changed in a remote store. |
SEALSKIN_CLUSTER_PATH | str | /config/.config/sealskin/cluster | Directory of the cluster's shared records (nodes, pools, sign-in settings, home locations). |
SEALSKIN_NODE_STATE_PATH | str | /config/.config/sealskin/node | Directory of this node's own state: web sign-ins, its join record, and usage not yet reported. |
SEALSKIN_NODE_NAME | str | (empty) | Name of this node, which is its identity in the cluster: its records are kept under it, and a node started again with an empty configuration directory but the same name and storage is the same node. Empty takes the container's name in Docker, else the host name. |
SEALSKIN_NODE_ROLES | str | frontend,runtime | Comma-separated roles of this node: frontend signs users in and proxies their sessions, runtime runs sessions. |
SEALSKIN_NODE_POOL | str | default | Pool this node joins when it first registers; an administrator can move it later. |
SEALSKIN_NODE_ADDRESS | str | (empty) | host:port other nodes reach this node's peer listener on; empty takes the host of HOST_URL and peer_port. |
SEALSKIN_NODE_MAX_SESSIONS | int | 0 | Most sessions this node runs at once; 0 sets no limit. |
SEALSKIN_NODE_GPU_SLOTS | int | 0 | Most GPU sessions this node runs at once; 0 sets no limit. |
SEALSKIN_PEER_PORT | int | 8444 | Port of the listener other nodes of the cluster reach this one on. |
SEALSKIN_PEER_POLL_SECONDS | int | 10 | How often a node asks every other node for its sessions and load. |
SEALSKIN_JOIN_URL | str | (empty) | host:port of the peer listener of a node of the cluster to join; with join_code, the node asks to join at start and keeps the cluster's records on that node. |
SEALSKIN_JOIN_CODE | str | (empty) | Join code an administrator of the cluster issued for this node. |
SEALSKIN_LEGACY_AUTH | bool | true | Accept the key-file clients (browser extension and mobile app configuration files) and their encrypted API; they reach this node alone, never the rest of a cluster. Off, the dashboard makes sign-in-only users and no administrators. Also written for the whole cluster under Sign In. |
SEALSKIN_PUBLIC_URL | str | (empty) | URL browsers reach the web app on, https://sealskin.example.com; empty takes HOST_URL and the session port. Set it behind a reverse proxy. |
SEALSKIN_SESSION_DOMAIN | str | (empty) | Domain whose every subdomain reaches this node, apps.example.com: with session_isolation, a session of a signed-in web user opens on <session id>.<domain>, apart from the web app. Needs wildcard DNS and a certificate for *.<domain>; empty takes the host of public_url. |
SEALSKIN_SESSION_ISOLATION | bool | false | Serve each session of a signed-in web user on an origin of its own, <session id>.<session_domain>, apart from the web app and the other sessions, which needs wildcard DNS and a certificate for every such name. Off serves sessions at /<session id>/ on the web app's origin, where this node serves the application's web client itself and the container answers its API alone. |
SEALSKIN_WEB_CLIENT_PATH | str | /usr/share/selkies | Directory of an application image holding the Selkies web client, one dashboard per subdirectory as the linuxserver images keep them, which this node exports once per image and serves to browsers in place of the container's own copy. |
SEALSKIN_TRUSTED_PROXIES | str | (empty) | Comma-separated addresses or networks of the reverse proxies in front of this node, whose forwarded client address and sign-in headers are believed. |
SEALSKIN_PROXY_AUTH_USER_HEADER | str | (empty) | Header a trusted proxy names the signed-in user in, Remote-User; empty takes no sign-in from a proxy. |
SEALSKIN_PROXY_AUTH_GROUPS_HEADER | str | (empty) | Header a trusted proxy lists the user's groups in, Remote-Groups, separated by commas or by |; empty takes no groups from a proxy. Name only a header the proxy sets. |
SEALSKIN_PROXY_AUTH_UNCHECKED | bool | false | Believe the proxy's sign-in header although this node cannot check, by reaching its own public_url or a trusted proxy's address, that the proxy removes the header a visitor sends. Leave it off wherever the check can run. |
SEALSKIN_PROXY_AUTH_LOGOUT_URL | str | (empty) | URL the web app opens to sign out a user a proxy signed in, as the proxy's or its identity provider's logout page; empty leaves signing out to the proxy. |
SEALSKIN_HTTP_PORT | int | 0 | Port of a plain HTTP listener for a reverse proxy that terminates TLS, serving what the session port does; 0 opens none. It answers the addresses in trusted_proxies alone, and only requests they say arrived over HTTPS. |
SEALSKIN_ROOT_KEY | str | (empty) | Application key the built-in administrator admin signs in to the web app with, kept as their key named environment; empty generates one at first start and writes it to root_key_path. |
SEALSKIN_ROOT_KEY_PATH | str | /config/root_key | File the generated root application key is written to, for the administrator to copy and delete. |
SEALSKIN_WEB_SESSION_SECONDS | int | 43200 | Longest a web sign-in with the root key, or a reverse proxy's sign-in, lasts unused. |
SEALSKIN_ROOT_SIGN_IN | bool | true | Accept the root key, the built-in administrator's, on this node's web sign-in. Turn it off once administrators sign in through an identity provider; a node restarted with it on takes the key again. |
SEALSKIN_AUTO_SIGN_IN | str | (empty) | Identity provider, oidc or saml, the web app sends a signed-out browser to at once instead of showing its sign-in page; #root on the web app's address shows the page anyway. |
SEALSKIN_SSO_FORCE_LOGIN | bool | false | Make the identity provider ask for credentials at every sign-in instead of reusing its session. |
SEALSKIN_SSO_CREATE_USERS | bool | true | Create a user at the first sign-in an identity provider or a proxy vouches for. |
SEALSKIN_SSO_HOLD_NEW_USERS | bool | true | Hold a user a sign-in creates, who may do nothing here, until an administrator places them in a group or approves them; a user the provider puts in a group is never held. Off, new users are let in at once; those already held stay held until approved. |
SEALSKIN_USAGE_FLUSH_SECONDS | int | 300 | How often a node adds the session time it ran to the cluster's usage records. |
SEALSKIN_FILES_SYNC | str | auto | Keep every user's shared files in the object store so each node a session starts on has them: on, off, or auto, which syncs once the cluster has a second node. |
SEALSKIN_SHARED_FILES_PATH | str | /storage/sealskin_shared_store | Directory a file store keeps the users' shared files in. |
SEALSKIN_WATCH_CONFIG_FILES | bool | true | Reload YAML configuration files automatically when they change on disk. |