Environment Variables
Some features of Bitwarden are not configured by the bitwarden.sh
installer. Configure these settings by editing the environment file, located at ./bwdata/env/global.override.env
. This .env
file comes pre-baked with configurable variables (see Included variables), however there are additional variables which can be manually added (see Optional variables).
Whenever you make changes to global.override.env
, perform a ./bitwarden.sh restart
to apply your changes.
note
This article will not define every environment variable, instead focusing on those used or configured by most installations.
Included variables
The following variables are among those that already exist in global.override.env
:
Variable | Description |
---|---|
| Enter the domain of your Bitwarden instance. If not configured, domain will default to localhost. Must not include a trailing slash. |
| Use this field to connect to an external MSSQL database. |
| A randomly generated OpenID Connect client key. For more information, see OpenID Documentation. |
| A randomly generated Duo akey. For more information, see Duo's Documentation. |
| Client ID for YubiCloud Validation Service or self-hosted Yubico Validation Server. |
| Secret Key for YubiCloud Validation Service or self-hosted Yubico Validation Server. |
| Email address used for invitations, typically |
| Your SMTP server hostname (recommended) or IP address. |
| The SMTP port used by the SMTP server. |
| (Boolean) Whether your SMTP server uses an encryption protocol: |
| A valid username for the |
| A valid password for the |
| Specify |
| Your HaveIBeenPwned (HIBP) API Key, available here. This key allows users to run the Data Breach report and to check their master password for presence in breaches when they create an account. |
| Email addresses which may access the System Administrator Portal. |
Optional variables
The following variables do not already exist in global.override.env
, and can be manually added:
Variable | Description |
---|---|
| Specifies the directory to save container log file output to. By default, |
| Specify the size limit in bytes to use for container log files (for example, |
| Specify a syslog server or endpoint to send container log output to (for example, |
| Specify |
| Specify |
| Specify |
| Specify the number of hours after which an organization invite will expire ( |
| Primary URL for self-hosted Yubico Validation Server. For example:
|
| Set to |
| Specify the number of days after which to permanently delete items from the trash. By default, |
| Specify |
| Specify If you're using EU, you'll also need to setup a few other variables as documented here. |
| Specify These tasks require elevated MSSQL privileges and should be reconfigured to run as a database user if this value is set to |
| Specify This task requires elevated MSSQL privileges and, if this value is set to |
Refresh token variables
Refresh token variables allow you to change the timeout of tokens. Administrators can use these values, for example, to require users to log in every day. Use the following variables to configure the handling of refresh tokens by your server:
Variable | Description |
---|---|
| Specify When true, only Specify When |
| Specify a integer. Refresh tokens will expire after the absolute lifetime of that integer in seconds, regardless of whether sliding is allowed or not. This variable may only be |
| Specify a integer greater than Refresh tokens will always expire after their configured absolute lifetime, regardless of what's set here. |