Configuration
Everything is configured at container startup via environment variables — there is no admin UI to drift from your compose file. This page lists every variable in the community edition.
Core
| Variable | Default | Purpose |
|---|---|---|
SITEBIN_BASE_DOMAIN | — (required) | Main domain. View subdomains, edit UI, API and WebDAV live under it. May include a port for URL generation (host:8085). |
SITEBIN_VIEW_ACCESS | subdomain | How site content is served: subdomain (<id>.base, needs a wildcard cert), path (base/v/<id>/, no wildcard needed), or both. |
SITEBIN_VIEW_DOMAIN | = base domain | Domain user sites are served from (<id>.<view-domain>). Point it at a separate registrable domain, listed in the Public Suffix List, so uploaded content does not share a browser "site" with your dashboard — see Operations & security. Needs its own wildcard DNS record and DNS-challenge access. Cannot be combined with SITEBIN_VIEW_ACCESS=path or both. |
SITEBIN_DATA_DIR | /data | Data root. |
SITEBIN_PUBLIC_ADDR | :8080 | Address the backend listens on for everything Caddy proxies. |
SITEBIN_INTERNAL_ADDR | :9000 | Address of the internal listener (authz, tls-check, health). Never proxied — do not publish this port. |
TLS & domains
| Variable | Default | Purpose |
|---|---|---|
SITEBIN_DNS_PROVIDER | — | DNS module for the wildcard cert: cloudflare, hetzner, duckdns. Only needed for subdomain/both. |
SITEBIN_DNS_TOKEN | — | API token for the DNS provider (read via env by Caddy, never written to disk). |
SITEBIN_TLS_SNIPPET | — | Advanced: raw lines injected into the wildcard site's tls { … } block (for multi-credential providers like netcup/porkbun). |
SITEBIN_ACME_EMAIL | — | ACME account email. |
SITEBIN_HTTP_ONLY | false | Serve plain HTTP only (local testing / external TLS). |
SITEBIN_DOMAIN_VERIFICATION | dns | How a custom domain proves it belongs to the site that claims it. dns attaches it only once a TXT record with the site's token or a CNAME at the site's own address is visible; off attaches on the owner's word alone, with a startup warning — only for an instance whose every account holder you trust. See Custom domains. |
Limits & rates
| Variable | Default | Purpose |
|---|---|---|
SITEBIN_MAX_SITE_BYTES | 104857600 | Per-site storage cap (100 MiB). |
SITEBIN_MAX_FILES | 1000 | Per-site file-count cap. |
SITEBIN_MAX_EXPIRY_DAYS | 0 (off) | Cap on how far in the future expiry may be set. A cap is also the default lifetime of a site created without an explicit expiry, and it cannot be cleared from the API. |
SITEBIN_RATE_CREATE_PER_HOUR / SITEBIN_RATE_CREATE_BURST | 30 / 10 | Anonymous creation limit per IP. |
SITEBIN_RATE_AUTH_PER_5MIN | 10 | Password-attempt limit per (IP, site) — edit, view, and WebDAV auth. |
WebDAV & FTP
| Variable | Default | Purpose |
|---|---|---|
SITEBIN_WEBDAV_ENABLED | true | Global WebDAV switch (per-site toggle still applies). |
SITEBIN_FTP_ENABLED | false | Global FTP switch (per-site toggle also required). |
SITEBIN_FTP_ADDR / SITEBIN_FTP_PASV_PORT_MIN / _MAX | :21 / 21000 / 21010 | FTP control port + passive data-port range (map them in docker run). |
SITEBIN_FTP_PUBLIC_HOST | base domain | Host advertised for FTP passive mode. |
SITEBIN_FTP_TLS_CERT / SITEBIN_FTP_TLS_KEY | — | Optional PEM cert/key for FTPS (encrypts credentials). |
MCP (AI agents)
| Variable | Default | Purpose |
|---|---|---|
SITEBIN_MCP_ENABLED | true | Serve the MCP endpoint at /mcp. See MCP for AI agents. |
SITEBIN_MCP_OAUTH_ISSUER | — | Authorization server whose access tokens /mcp accepts. It must be the same issuer as SITEBIN_OAUTH_OIDC_ISSUER, and is still not inherited from it: turning on OAuth for /mcp is a decision, not a side effect of configuring SSO. Edit passwords and account tokens keep working beside it; only calls that need an account are challenged. Empty disables OAuth. |
SITEBIN_MCP_OAUTH_RESOURCE | <base>/mcp | This server's OAuth resource identifier — the value a token's audience must contain. Immutable once published. |
Forms
| Variable | Default | Purpose |
|---|---|---|
SITEBIN_FORMS_SMTP_HOST | — | SMTP server for forms. Unset: the instance has no forms. Separate from the account mailer's SITEBIN_SMTP_*. |
SITEBIN_FORMS_SMTP_PORT | 587 | |
SITEBIN_FORMS_SMTP_USER / _PASS | — | Optional SMTP AUTH (PLAIN), sent only over TLS or to localhost. |
SITEBIN_FORMS_SMTP_FROM | — | Required with the host: a bare address such as forms@example.com. Each form supplies the display name. SPF/DKIM for its domain must cover the SMTP server. |
SITEBIN_FORMS_SMTP_TLS | false | Implicit TLS (port 465). Otherwise STARTTLS whenever the server offers it. |
SITEBIN_FORMS_MAX_PER_SITE | 10 · 0 with accounts | Forms per site where no plan says otherwise. With accounts, a tier's max_forms decides. |
SITEBIN_FORMS_MAX_FILES | 5 | Attachments per submission; 0 turns attachments off. |
SITEBIN_FORMS_MAX_FILE_BYTES | 2097152 | Bytes per attachment. |
SITEBIN_FORMS_PER_IP_HOUR | 10 | Submissions per visitor IP per hour, across all forms. |
SITEBIN_FORMS_PER_FORM_HOUR | 60 | Submissions per form per hour. |
Abuse & content security
| Variable | Default | Purpose |
|---|---|---|
SITEBIN_ABUSE_ALERTS_TO | the SITEBIN_ADMIN_ACCOUNTS addresses | Comma-separated bare addresses that receive the plain-text abuse alerts — scanner holds and flags, tripwire hits, every stored report, and a digest line for every locked site the lock retention purged; one that is not a bare address refuses startup, so a typo cannot silence the alarm. Sent through the forms mailer (SITEBIN_FORMS_SMTP_* above); without it alerts are only logged, with a startup warning. |
SITEBIN_ABUSE_CONTACT | — | Public abuse mailbox (a bare address), shown on the view domain's info page and in /.well-known/security.txt. Unset: omitted. See Operations. |
SITEBIN_ABUSE_REPORT_URL | https://<base>/report | The report page the info page, security.txt and the "Site suspended" page link to; none omits it. |
SITEBIN_HOME_URL | the base URL | Your main site, linked from the view domain's info page. |
SITEBIN_CSP_SCRIPT_HOSTS | cdnjs, jsDelivr, unpkg, Tailwind CDN, jQuery CDN | Hosts an untrusted site may load scripts from, besides itself. Host sources separated by commas or spaces; none empties the list; anything else is refused at startup. |
SITEBIN_CSP_STYLE_HOSTS | Google Fonts CSS, cdnjs, jsDelivr, unpkg | The same, for stylesheets. |
SITEBIN_CSP_FONT_HOSTS | Google Fonts files, cdnjs, jsDelivr, unpkg | The same, for fonts. |
SITEBIN_CSP_IMG_HOSTS | none | The same, for images: by default an untrusted site shows only its own images and data:/blob: ones. |
The upload scanner's rules live in a file, not a variable:
abuse-rules.json in the data directory, re-read while the
instance runs — see Rules are a
file.
Misc
| Variable | Default | Purpose |
|---|---|---|
SITEBIN_EMBED_ORIGINS | — | Origins allowed to embed the create flow cross-origin (comma-separated, or *). Enterprise feature — the community edition ignores it with a warning. See Embed component. |
SITEBIN_TRACK_VIEWS | true | Count per-site page views (Accept: text/html) + last-seen. |
SITEBIN_READONLY | false | Freeze new site creation. |
SITEBIN_CLEANUP_INTERVAL | 10m | Expiry sweep interval. The same sweep re-checks pending and verified custom domains. |
SITEBIN_LOCK_RETENTION_DAYS | 180 | How long a lock keeps a site as evidence, counted from the lock: the cleanup sweep then purges it completely, unless you placed an evidence hold on it (sitebin hold, or the register). It also bounds how long a suspended account's provenance outlives its 90 days. 0 keeps locked sites forever; a negative value, or one above 36500 (a century), refuses startup. |
Enterprise variables
Accounts, tiers, OAuth, SMTP, billing, licensing and the SaaS-Stack
registration (SITEBIN_STACK_*, including the consent
documents and the GDPR secret) and container sites
(SITEBIN_CONTAINERS*) are enterprise-edition settings and are
listed on Enterprise setup; the stack's
own wiring is walked through on
SaaS-Stack integration.