Environment Variables

TaskView is configured through environment variables set in the .env.taskview file (or passed directly to the Docker container). This page documents every available variable.

Database

These must match your PostgreSQL setup.

Connection budget: the total number of Postgres connections is roughly PM2_INSTANCES × DB_POOL_MAX. Keep it below the max_connections of your PostgreSQL (default 100), leaving ~10 connections of headroom for migrations and maintenance. The API logs a warning at startup when the estimate exceeds 80.

Application

Web app

Unlike everything else on this page, this variable is set on the web app container (taskview-webapp), not in .env.taskview.

Authentication

Closing an instance: how ALLOW_PUBLIC_REGISTRATION=false works

By default anyone who can reach your instance can create an account — through the registration endpoint, or simply by entering an email on the login page (magic-link and social sign-in create the account on first login). Set ALLOW_PUBLIC_REGISTRATION=false to close the instance: from that moment accounts are created by invitation only.

Who can still get an account on a closed instance. TaskView invitations are stored by email, before any account exists. An email is considered invited — and its owner can sign in and get an account created on first login — if it appears in any of these places:

• Organization members — added via organization settings (or provisioned through SCIM)
• Project collaborators — invited to a project by an existing user

Everyone else is rejected: the registration endpoint returns 403, magic-link refuses to send a code to an unknown email, and social sign-in redirects back to the login page with an error. Existing accounts are not affected in any way — the flag only controls the creation of new ones.

SSO is not blocked by this flag. Signing in through a SAML/OIDC provider still provisions accounts, because an identity provider is configured by the administrator and is itself a controlled channel — your IdP decides who gets in.

The value must be true or false. Any other value (a typo like Flase, 0, no) stops the server at startup with a clear error instead of silently leaving the instance open.

SMTP (Email)

Required for password recovery, email confirmation, and invitation notifications. Without SMTP, these features won't work, but everything else functions normally.

Encryption

Required for SSO (SAML/OIDC) and GitHub/GitLab integrations. Secrets are encrypted at rest using AES-256-GCM.

Generate a key:

openssl rand -hex 32

What is encrypted:

• SSO: SAML certificates, SAML signing keys, OIDC client secrets
• Integrations: GitHub/GitLab OAuth tokens, webhook secrets

GitHub Integration

For connecting GitHub repositories. See GitHub, GitLab & Gitea Setup for a step-by-step guide.

GitLab Integration

For connecting GitLab repositories.

Gitea Integration

For connecting Gitea repositories.

Messaging Integrations (Telegram / Slack)

For delivering task notifications to messengers. See Telegram & Slack Setup for a step-by-step guide.

Notifications

Optional configuration for real-time and push notification delivery.

Centrifugo (real-time WebSocket notifications)

Required for in-app real-time notification delivery. Without Centrifugo, notifications are still saved to the database but will not appear instantly in the browser. Users will see them on the next page load.

Firebase Cloud Messaging (mobile push notifications)

Required for native push notifications on iOS and Android. Without Firebase, push notifications are silently skipped.

Centrifugo configuration file

Centrifugo v6 uses a nested JSON config. Create centrifugo/config.json:

{
  "client": {
    "allowed_origins": ["https://app.example.com"],
    "token": {
      "hmac_secret_key": "your_centrifugo_token_secret"
    }
  },
  "channel": {
    "namespaces": [
      {
        "name": "personal",
        "presence": false,
        "join_leave": false,
        "history_size": 0,
        "history_ttl": "0s"
      }
    ]
  },
  "http_api": {
    "key": "your_centrifugo_api_key"
  }
}

• http_api.key must match CENTRIFUGO_API_KEY in .env.taskview
• client.token.hmac_secret_key must match CENTRIFUGO_TOKEN_SECRET in .env.taskview
• client.allowed_origins should list your frontend domain(s). Use ["*"] only for development.

Nginx WebSocket proxy

To serve Centrifugo through your existing HTTPS domain, add to your nginx server block:

location /centrifugo/ {
    proxy_pass http://localhost:8000/;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
}

Then set CENTRIFUGO_PUBLIC_URL=wss://api.example.com/centrifugo/connection/websocket.

Full example

Here's a complete .env.taskview file for a production deployment:

DB_HOST="db"
DB_USER="taskview_db_user"
DB_PASSWORD="password"
DB_NAME="taskview"
DB_PORT=5432
# Postgres connections per API worker (this is the default)
DB_POOL_MAX=20
APP_PORT=1401
# API worker processes (this is the default). Accepts a number or "max" (one worker per CPU core).
# Keep PM2_INSTANCES x DB_POOL_MAX below the Postgres max_connections limit (default 100).
PM2_INSTANCES=2
JWT_ALG="HS256"
JWT_SIGN="secret"
ACCESS_LIFE_TIME="3d"
REFRESH_LIFE_TIME="9d"

# Login methods offered on the login page (unset = all enabled)
#AUTH_LOGIN_METHODS="magic-link,password,sso,social"
# Password change confirmation: "email" (code by email, needs SMTP) or "password" (no SMTP needed)
#PASSWORD_CHANGE_CONFIRMATION="email"

SMTP_HOST=smtp
SMTP_PORT=587
SMTP_USERNAME=
SMTP_PASSWORD=
SMTP_ENCRYPTION=tls
SMTP_FROM_NAME=TaskView
SMTP_FROM_EMAIL=

# Your domain 
APP_URL="https://app.taskview.tech"

GOOGLE_CLIENT_ID=""
GOOGLE_CLIENT_SECRET=""
#You domain
GOOGLE_CALLBACK_URL="https://api.taskview.tech/module/auth/provider/google/callback"
GITHUB_CLIENT_ID=""
GITHUB_CLIENT_SECRET=""
GITHUB_CALLBACK_URL="https://api.taskview.tech/module/auth/provider/github/callback"
APPLE_CLIENT_ID=""
APPLE_TEAM_ID=""
APPLE_KEY_ID=""
APPLE_KEY_LOCATION="/usr/src/app/AuthKey.p8"
# Your domain
APPLE_CALLBACK_URL="https://api.taskview.tech/module/auth/provider/apple/callback"

#integrations
GITHUB_INTEGRATION_CLIENT_ID=
GITHUB_INTEGRATION_CLIENT_SECRET=
GITHUB_INTEGRATION_CALLBACK_URL=https://api.taskview.tech/module/integrations/oauth/github/callback

GITLAB_INTEGRATION_CLIENT_ID=
GITLAB_INTEGRATION_CLIENT_SECRET=
GITLAB_INTEGRATION_CALLBACK_URL=https://api.taskview.tech/module/integrations/oauth/github/callback

ENCRYPTION_KEY=

# Messaging integrations
TELEGRAM_BOT_TOKEN=
TELEGRAM_BOT_USERNAME=
TELEGRAM_WEBHOOK_SECRET=
# SLACK_CLIENT_ID=
# SLACK_CLIENT_SECRET=
# SLACK_SIGNING_SECRET=

# Notifications (optional)
# FIREBASE_CREDENTIALS_PATH=./firebase-credentials.json
# CENTRIFUGO_API_URL=http://centrifugo:8000
# CENTRIFUGO_API_KEY=your_centrifugo_api_key
# CENTRIFUGO_TOKEN_SECRET=your_centrifugo_token_secret
# CENTRIFUGO_PUBLIC_URL=wss://api.example.com/centrifugo/connection/websocket