Configuration

Every setting is read from the environment with the XIQUE_ prefix. The quadlet units read them from the EnvironmentFile (by default ~/docker/xique/xique.env); see Installation.

Variable	Default	Purpose
XIQUE_DATABASE_PATH	/data/db/xique.db	sqlite database file
XIQUE_SECRET_KEY	required	signs sessions and CSRF tokens; also encrypts stored Jellyfin access tokens
XIQUE_TMDB_TOKEN	unset	TMDB read access token; without it the worker cannot compute recommendations
XIQUE_HOST	127.0.0.1	web listen address
XIQUE_PORT	8000	web listen port
XIQUE_SESSION_COOKIE_NAME	xique_session	session cookie name
XIQUE_SESSION_TTL_DAYS	30	session lifetime, in days
XIQUE_POLL_INTERVAL_SECONDS	5.0	seconds the worker sleeps between cycles
XIQUE_IMPORT_DIR	<tempdir>/xique-imports	directory uploaded Trakt export zips stream into
XIQUE_LOG_LEVEL	INFO	minimum level for the log file (DEBUG–CRITICAL, case-insensitive)
XIQUE_LOG_FILE	unset	log file path; unset logs errors to stdout only
XIQUE_COOKIE_SECURE	true	add the Secure flag to session and CSRF cookies — set false only for plain-HTTP deployments without TLS
XIQUE_TRUSTED_PROXIES	unset	comma-separated proxy addresses whose X-Forwarded-For is honored for login throttling — set only when the app sits directly behind those proxies
XIQUE_LOGIN_ATTEMPT_LIMIT	5	failed logins per username+address pair before throttling
XIQUE_LOGIN_WINDOW_SECONDS	900	window, in seconds, over which failed logins are counted
XIQUE_SOURCE_URL	https://forge.marvin8.zone/marvin8/xique	source repository linked from the page footer
XIQUE_DOCS_BASE_URL	https://xique.marvin8.zone	base URL of the versioned docs; the footer links {docs_base_url}/{version}/

Notes on specific settings

• XIQUE_SECRET_KEY — the deployment's root secret. Sessions and CSRF tokens are signed with it, and Jellyfin access tokens are encrypted at rest with a key derived from it. Rotating it signs everyone out; losing it means users reconnect Jellyfin (the encrypted tokens cannot be recovered).
• XIQUE_TRUSTED_PROXIES — the stock Tailscale sidecar proxies to the web process over loopback, so the shipped quadlet sets XIQUE_TRUSTED_PROXIES=127.0.0.1. Leave it unset if nothing stands in front of the app; login throttling then keys on the socket address.
• XIQUE_COOKIE_SECURE — the Tailscale serve path is HTTPS, so the default true is correct there. Only a plain-HTTP deployment (no TLS anywhere) needs false.
• XIQUE_IMPORT_DIR — in the container deployment this must point into the shared imports volume (/data/imports-temp) so web can hand uploaded zips to the worker; the shipped units and env file already do this.