Skip to content

Configuration

Every setting is read from the environment with the XIQUE_ prefix. The quadlet units read them from the EnvironmentFile (by default ~/docker/xique/xique.env); see Installation.

Variable Default Purpose
XIQUE_DATABASE_PATH /data/db/xique.db sqlite database file
XIQUE_SECRET_KEY required signs sessions and CSRF tokens; also encrypts stored Jellyfin access tokens
XIQUE_TMDB_TOKEN unset TMDB read access token; without it the worker cannot compute recommendations
XIQUE_HOST 127.0.0.1 web listen address
XIQUE_PORT 8000 web listen port
XIQUE_SESSION_COOKIE_NAME xique_session session cookie name
XIQUE_SESSION_TTL_DAYS 30 session lifetime, in days
XIQUE_POLL_INTERVAL_SECONDS 5.0 seconds the worker sleeps between cycles
XIQUE_IMPORT_DIR <tempdir>/xique-imports directory uploaded Trakt export zips stream into
XIQUE_LOG_LEVEL INFO minimum level for the log file (DEBUG–CRITICAL, case-insensitive)
XIQUE_LOG_FILE unset log file path; unset logs errors to stdout only
XIQUE_COOKIE_SECURE true add the Secure flag to session and CSRF cookies — set false only for plain-HTTP deployments without TLS
XIQUE_TRUSTED_PROXIES unset comma-separated proxy addresses whose X-Forwarded-For is honored for login throttling — set only when the app sits directly behind those proxies
XIQUE_LOGIN_ATTEMPT_LIMIT 5 failed logins per username+address pair before throttling
XIQUE_LOGIN_WINDOW_SECONDS 900 window, in seconds, over which failed logins are counted

Notes on specific settings

  • XIQUE_SECRET_KEY — the deployment's root secret. Sessions and CSRF tokens are signed with it, and Jellyfin access tokens are encrypted at rest with a key derived from it. Rotating it signs everyone out; losing it means users reconnect Jellyfin (the encrypted tokens cannot be recovered).
  • XIQUE_TRUSTED_PROXIES — the stock Tailscale sidecar proxies to the web process over loopback, so the shipped quadlet sets XIQUE_TRUSTED_PROXIES=127.0.0.1. Leave it unset if nothing stands in front of the app; login throttling then keys on the socket address.
  • XIQUE_COOKIE_SECURE — the Tailscale serve path is HTTPS, so the default true is correct there. Only a plain-HTTP deployment (no TLS anywhere) needs false.
  • XIQUE_IMPORT_DIR — in the container deployment this must point into the shared imports volume (/data/imports-temp) so web can hand uploaded zips to the worker; the shipped units and env file already do this.