DDM HelpSelf-hosting
Configuration
The settings of an installation – what each one does and when you need it.
An installation reads its settings from environment variables when it starts – with Docker Compose from .env, with Kubernetes from config.env and secrets.env. A change takes effect as soon as the service restarts. The images contain no settings; the same image runs at every customer.
Required
| Variable | Meaning |
|---|---|
DDM_CMS_HOST, DDM_APP_HOST | The two host names: CMS and reader app. |
AUTH_COOKIE_DOMAIN | The domain both host names share, for example company.com – so that a sign-in works in both apps. |
POSTGRES_PASSWORD | The database password. Taken over on the first start and not changed after that. |
BETTER_AUTH_SECRET | Key for sessions and tokens. At least 32 random characters; changing it signs everybody out. |
LICENCE_KEY | The licence from us (ddm1.…). Needed from the first start. |
MAIL_DRIVER, MAIL_FROM | How DDM sends e-mails: smtp with the details below. |
SMTP_HOST, SMTP_PORT, SMTP_USER, SMTP_PASSWORD | Your mail server. SMTP_SECURE=true for TLS from the first byte (port 465), SMTP_ALLOW_SELF_SIGNED=true for an internal server with its own certificate authority. |
Documents
| Variable | Meaning |
|---|---|
S3_ENDPOINT, S3_BUCKET, S3_REGION, S3_ACCESS_KEY_ID, S3_SECRET_ACCESS_KEY | The documents in an S3-compatible bucket instead of on the volume. The database backups then go to the same bucket. |
S3_FORCE_PATH_STYLE | true (default) for MinIO and most self-run storage; false for providers with the bucket in the host name. |
MAX_UPLOAD_BYTES | The largest file anybody can upload. Default 1 GB. Your reverse proxy must let at least that much through. |
THUMBNAILS | off leaves out thumbnails – for servers with very little memory. |
RENDER_LARGE_OFFICE | on: Office files over 64 MB get a PDF view too. Needs several GB of memory for the render worker. |
Network
| Variable | Meaning |
|---|---|
HTTPS_PROXY | A proxy for outgoing connections: licence, updates, feature requests, external sources. |
LDAP_PRIVATE_NETWORKS, SOURCES_PRIVATE_NETWORKS | off forbids directories and external sources from using addresses in your own network. For you, usually leave it on – your directory and your file servers are there. |
Sign-in
| Variable | Meaning |
|---|---|
MICROSOFT_CLIENT_ID, MICROSOFT_CLIENT_SECRET | "Sign in with Entra ID" for the whole installation – an app in your Entra ID. |
GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET | "Sign in with Google Workspace". |
OKTA_ISSUER, OKTA_CLIENT_ID, OKTA_CLIENT_SECRET | "Sign in with Okta". |
PASSKEY_RP_ID | The domain passkeys are bound to. If not set, the CMS host name – set the shared domain (for example company.com) so that a passkey works in both the CMS and the reader app. |
Single sign-on per organisation (SAML, OpenID Connect) and directories (LDAP, Active Directory), on the other hand, you set up in DDM itself, under Settings › Single sign-on and Settings › Directory services.
Licence and updates
| Variable | Meaning |
|---|---|
LICENCE_RENEWAL | off for a server without internet access: the licence is then renewed by hand. |
UPDATE_CHECK | off: the installation does not tell you when there is a new version. |
MIGRATE_ON_START | off: the CMS does not apply migrations when it starts. Only if you apply them yourself (bun run db:migrate). |