Configuration reference
Everything in .env: the secrets, the address, ports, email and sign-in.
All settings live in .env next to docker-compose.yml. After changing one, apply it with docker compose up -d. The installer writes the first group for you.
Secrets (required)
POSTGRES_PASSWORD (hex; never change it after the first start, because the database keeps the original), JWT_SECRET (signs sessions) and ENCRYPTION_KEY (encrypts every stored credential). Talos refuses to start if JWT_SECRET or ENCRYPTION_KEY is missing or still a published default; the check runs before anything is written.
ENCRYPTION_KEY cannot be changed once you have data. Back it up alongside your database, not only in .env on the server.
Setup token
SETUP_TOKEN: needed once, to create the first account (see “The setup token”). If empty, it is derived from ENCRYPTION_KEY and printed in the backend log while there is no account.
Address, ports, version
FRONTEND_URL is where users reach Talos; it is used in invitation and password-reset emails. FRONTEND_PORT and BACKEND_PORT move the host ports off 3000 and 3001. TALOS_BIND sets the address they listen on: unset means every network interface, 127.0.0.1 means only this computer (for example behind your own reverse proxy on the same machine). TALOS_VERSION is the image version; keep it pinned. COMPOSE_PROJECT_NAME keeps the volume names fixed if the folder is renamed. Never change it on an existing install, or Compose starts with new, empty volumes.
Without email, invitation and password-reset links are written to the backend log (docker compose logs backend). This suits a single administrator; teams should configure email. To send them:
Sign in with Google or GitHub
Off unless configured. Register an OAuth app with the provider, with this callback URL exactly: <OAUTH_CALLBACK_BASE_URL>/api/auth/oauth/<google|github>/callback. A mismatch is the most common reason a sign-in fails without a clear message. Talos refuses to start with a provider enabled but missing its credentials, rather than show a button that cannot work.
Teams and organizations
By default an install has one organization and no self-service sign-up: people join by invitation. ALLOW_SELF_REGISTRATION=true lets people sign up themselves; ALLOW_MULTI_ORG=true lets an install hold several organizations.