Configuration Parameters

Miniflux can use a configuration file and environment variables.

The configuration file is loaded first if specified. Environment variables take precedence over the options defined in the configuration file.

Boolean options accept the following values (case-insensitive): 1/0, yes/no, true/false, on/off. For variables ending in _FILE, the value is a path to a file that contains the corresponding secret value.

Configuration Options

ADMIN_PASSWORD

Admin user password, used only if CREATE_ADMIN is enabled.

Default is empty.

ADMIN_PASSWORD_FILE

Path to a secret key exposed as a file, it should contain the ADMIN_PASSWORD value.

Default is empty.

ADMIN_USERNAME

Admin user login, used only if CREATE_ADMIN is enabled.

Default is empty.

ADMIN_USERNAME_FILE

Path to a secret key exposed as a file, it should contain the ADMIN_USERNAME value.

Default is empty.

AUTH_PROXY_HEADER

Proxy authentication HTTP header.

The option TRUSTED_REVERSE_PROXY_NETWORKS must be configured to allow the proxy to authenticate users.

Default is empty.

AUTH_PROXY_USER_CREATION

Set to 1 to create users based on proxy authentication information.

When disabled, users must already exist in Miniflux to sign in through the proxy.

Disabled by default.

BASE_URL

Base URL to generate HTML links and base path for cookies. The scheme must be http or https.

A path component sets the base path when Miniflux is served from a subfolder, for example https://example.org/miniflux/.

Default is http://localhost.

BATCH_SIZE

Number of feeds to send to the queue for each interval.

Default is 100 feeds.

CERT_DOMAIN

Use Let's Encrypt to get automatically a certificate for this domain. Miniflux also listens on port 80 to answer the ACME HTTP challenge. Certificates are cached in the database.

This option cannot be used with CERT_FILE and KEY_FILE.

Default is empty.

CERT_FILE

Path to SSL certificate. Must be used with KEY_FILE.

Default is empty.

CLEANUP_ARCHIVE_BATCH_SIZE

Number of entries to archive for each job interval.

Default is 10000 entries.

CLEANUP_ARCHIVE_READ_DAYS

Number of days before the cleanup job archives read entries.

Archiving deletes non-bookmarked, non-shared read entries from the database and records a tombstone to prevent the same entry from being imported again during a later feed refresh.

Set to -1 to disable automatic archiving of read entries.

Default is 60 days.

CLEANUP_ARCHIVE_UNREAD_DAYS

Number of days before the cleanup job archives unread entries.

Archiving deletes non-bookmarked, non-shared unread entries from the database and records a tombstone to prevent the same entry from being imported again during a later feed refresh.

Set to -1 to disable automatic archiving of unread entries.

Default is 180 days.

CLEANUP_FREQUENCY_HOURS

Interval in hours between cleanup jobs (remove old sessions and archive entries).

Default is 24 hours.

CLEANUP_REMOVE_SESSIONS_DAYS

Number of days after which sessions are removed from the database.

Default is 30 days.

CREATE_ADMIN

Set to 1 to create an admin user from environment variables.

Disabled by default.

DATABASE_CONNECTION_LIFETIME

Maximum amount of time in minutes a connection may be reused.

Default is 5 minutes.

DATABASE_MAX_CONNS

Maximum number of database connections.

Default is 20.

DATABASE_MIN_CONNS

Minimum number of database connections. Must be less than or equal to DATABASE_MAX_CONNS.

Default is 1.

DATABASE_URL

PostgreSQL connection parameters.

Default is "user=postgres password=postgres dbname=miniflux2 sslmode=disable".

DATABASE_URL_FILE

Path to a secret key exposed as a file, it should contain the DATABASE_URL value.

Default is empty.

DISABLE_API

Disable miniflux's API.

Default is false (the API is enabled).

DISABLE_HSTS

Disable HTTP Strict Transport Security header if HTTPS is set.

Default is false (HSTS is enabled).

DISABLE_HTTP_SERVICE

Set the value to 1 to disable the HTTP service.

Default is false (the HTTP service is enabled).

DISABLE_LOCAL_AUTH

Disable local authentication.

When set to true, the username/password form is hidden from the login screen, and the options to change username/password or unlink OAuth2 account are hidden from the settings page.

Password authentication is also rejected by the login form and by the REST API HTTP Basic Authentication, and passwords can no longer be changed. API clients must use an API key instead.

This option requires an alternative authentication source such as OAuth2, auth proxy, or WebAuthn/Passkeys. If remote user creation is disabled, only existing users can sign in.

To use WebAuthn as the only authentication method, register at least one Passkey while another authentication method is available, before enabling DISABLE_LOCAL_AUTH.

Default is false.

DISABLE_SCHEDULER_SERVICE

Set the value to 1 to disable the internal scheduler service.

Default is false (the internal scheduler service is enabled).

FETCHER_ALLOW_PRIVATE_FEED_PROXY

Set to 1 to allow feed proxy URLs to use private or loopback network addresses.

This option applies to all authenticated users and should only be enabled when the private proxy boundary is trusted.

Disabled by default.

FETCHER_ALLOW_PRIVATE_NETWORKS

Set to 1 to allow outgoing fetcher requests to private or loopback networks.

Disabled by default, private networks are refused.

FETCH_BILIBILI_WATCH_TIME

Set the value to 1 to scrape video duration from Bilibili website and use it as a reading time.

Disabled by default.

FETCH_NEBULA_WATCH_TIME

Set the value to 1 to scrape video duration from Nebula website and use it as a reading time.

Disabled by default.

FETCH_ODYSEE_WATCH_TIME

Set the value to 1 to scrape video duration from Odysee website and use it as a reading time.

Disabled by default.

FETCH_YOUTUBE_WATCH_TIME

Set the value to 1 to scrape video duration from YouTube website and use it as a reading time.

Disabled by default.

FORCE_REFRESH_INTERVAL

Minimum interval in minutes between two manual refreshes.

Default is 30 minutes.

HTTP_CLIENT_MAX_BODY_SIZE

Maximum body size for HTTP requests in Mebibyte (MiB).

Default is 15 MiB.

HTTP_CLIENT_PROXIES

Enable proxy rotation for outgoing requests by providing a comma-separated list of proxy URLs.

Default is empty.

HTTP_CLIENT_PROXY

Proxy URL to use when the "Fetch via proxy" feed option is enabled. For example: http://127.0.0.1:8888.

If you prefer to have a proxy for all outgoing requests, use the environment variables HTTP_PROXY or HTTPS_PROXY, look at the official Golang documentation for more details.

Default is empty.

HTTP_CLIENT_TIMEOUT

Time limit in seconds before the HTTP client cancels the request.

Default is 20 seconds.

HTTP_CLIENT_USER_AGENT

The default User-Agent header to use for the HTTP client. It can be overridden in per-feed settings.

When empty, Miniflux uses a default User-Agent that includes the Miniflux version.

Default is empty.

HTTP_SERVER_TIMEOUT

Read, write, and idle timeout in seconds for the HTTP server.

Default is 300 seconds.

HTTPS

Forces cookies to use secure flag and send HSTS header.

Default is disabled.

INTEGRATION_ALLOW_PRIVATE_NETWORKS

Set to 1 to allow outgoing integration requests to private or loopback networks.

Disabled by default, private networks are refused.

INVIDIOUS_INSTANCE

Set a custom invidious instance to use.

Default is yewtu.be.

KEY_FILE

Path to SSL private key. Must be used with CERT_FILE.

Default is empty.

LISTEN_ADDR

Address to listen on. Multiple addresses can be specified, separated by commas, for example 127.0.0.1:8080, 127.0.0.1:8081.

Use an absolute path to listen on a Unix socket (/var/run/miniflux.sock). When Miniflux creates the socket itself, it uses mode 0660. This mode is hardcoded and cannot be configured.

With systemd socket activation, Miniflux uses the socket passed by systemd and only the first address is taken into account.

Default is 127.0.0.1:8080.

LOG_DATE_TIME

Display the date and time in log messages.

Disabled by default.

LOG_FILE

Supported values are stderr, stdout, or a file name.

Default is stderr.

LOG_FORMAT

Supported log formats are text or json.

Default is text.

LOG_LEVEL

Supported values are debug, info, warning, or error.

Default is info.

MAINTENANCE_MESSAGE

Define a custom maintenance message.

Default is "Miniflux is currently under maintenance".

MAINTENANCE_MODE

Set to 1 to enable maintenance mode.

Disabled by default.

MEDIA_PROXY_CUSTOM_URL

Sets an external server to proxy media through.

Default is empty, Miniflux does the proxying.

MEDIA_PROXY_HTTP_CLIENT_TIMEOUT

Time limit in seconds before the media proxy HTTP client cancels the request.

Default is 120 seconds.

MEDIA_PROXY_MODE

Possible values are:

  • http-only: Proxy only media served over insecure HTTP.
  • all: Proxy all media.
  • none: Disable the media proxy.

Default is http-only.

MEDIA_PROXY_PRIVATE_KEY

Set a custom private key used to sign proxified media URLs.

By default, a secret key is randomly generated during startup. Proxified URLs are therefore invalidated on restart and are not shared between multiple instances. Set this option to keep them stable.

MEDIA_PROXY_RESOURCE_TYPES

A comma-separated list of media types to proxify. Supported values are: image, audio, video.

Default is image.

METRICS_ALLOWED_NETWORKS

List of networks allowed to access the /metrics endpoint (comma-separated values).

Default is 127.0.0.1/8.

METRICS_COLLECTOR

Set to 1 to enable the metrics collector and expose a /metrics endpoint for Prometheus.

Disabled by default.

METRICS_PASSWORD

Metrics endpoint password for basic HTTP authentication. Must be used with METRICS_USERNAME.

Default is empty.

METRICS_PASSWORD_FILE

Path to a file that contains the password for the metrics endpoint HTTP authentication.

Default is empty.

METRICS_REFRESH_INTERVAL

Interval in seconds between two collections of database metrics.

Default is 60 seconds.

METRICS_USERNAME

Metrics endpoint username for basic HTTP authentication. Must be used with METRICS_PASSWORD.

Default is empty.

METRICS_USERNAME_FILE

Path to a file that contains the username for the metrics endpoint HTTP authentication.

Default is empty.

OAUTH2_ADDITIONAL_SCOPES

Additional OAuth2 scopes to request.

Default is empty.

OAUTH2_ADMIN_GROUP

Group for administrators. When set, the admin role is mapped based on the specified group.

Default is empty.

OAUTH2_CLIENT_ID

OAuth2 client ID.

Default is empty.

OAUTH2_CLIENT_ID_FILE

Path to a secret key exposed as a file, it should contain the OAUTH2_CLIENT_ID value.

Default is empty.

OAUTH2_CLIENT_SECRET

OAuth2 client secret.

Default is empty.

OAUTH2_CLIENT_SECRET_FILE

Path to a secret key exposed as a file, it should contain the OAUTH2_CLIENT_SECRET value.

Default is empty.

OAUTH2_GROUP_CLAIM

Claim that contains user groups, which can be used for mapping the admin role.

The claim is read from the user info response, then from the ID token. Users without this claim are not administrators.

Default is empty.

OAUTH2_OIDC_DISCOVERY_ENDPOINT

OpenID Connect discovery endpoint. Required when OAUTH2_PROVIDER is set to oidc.

Note that the OIDC library automatically appends the .well-known/openid-configuration, this part has to be removed from the URL when setting OAUTH2_OIDC_DISCOVERY_ENDPOINT.

Default is empty.

OAUTH2_OIDC_PROVIDER_NAME

Name to display for the OIDC provider.

Default is "OpenID Connect".

OAUTH2_PROVIDER

OAuth2 provider. Possible values are google or oidc for a generic OpenID Connect provider.

Default is empty.

OAUTH2_REDIRECT_URL

OAuth2 redirect URL.

This URL must be registered with the provider and is something like https://miniflux.example.org/oauth2/oidc/callback.

Default is empty.

OAUTH2_USER_CREATION

Set to 1 to authorize OAuth2 user creation.

When disabled, users must already exist in Miniflux or have a linked OAuth2 account to sign in.

Disabled by default.

POLLING_FREQUENCY

Interval in minutes for the background job scheduler.

It determines how often a batch of feeds is selected for refresh, based on their last refresh time.

Default is 60 minutes.

POLLING_LIMIT_PER_HOST

Limits the number of concurrent requests to the same hostname when polling feeds.

This helps prevent overwhelming a single server during batch processing by the worker pool.

Default is 0 (disabled).

POLLING_PARSING_ERROR_LIMIT

The maximum number of parsing errors that the program will try before stopping polling a feed. Once the limit is reached, the user must refresh the feed manually. Set to 0 for unlimited.

Default is 3.

POLLING_SCHEDULER

Determines the strategy used to schedule feed polling. Supported values are:

  • round_robin: Feeds are polled in a fixed, rotating order.
  • entry_frequency: The polling interval for each feed is based on the average update frequency over the past week.

The number of feeds polled in a given period is limited by the POLLING_FREQUENCY and BATCH_SIZE settings. Regardless of the scheduler used, the total number of polled feeds will not exceed the maximum allowed per polling cycle.

Default is round_robin.

PORT

Override LISTEN_ADDR with :$PORT, which listens on all network interfaces (automatic configuration for PaaS). The value must be between 1 and 65535.

Default is empty.

RUN_MIGRATIONS

Set to 1 to run database migrations.

Disabled by default.

SCHEDULER_ENTRY_FREQUENCY_FACTOR

Factor to increase refresh frequency for the entry frequency scheduler.

Default is 1.

SCHEDULER_ENTRY_FREQUENCY_MAX_INTERVAL

Maximum interval in minutes for the entry frequency scheduler.

Default is 1440 minutes (24 hours).

SCHEDULER_ENTRY_FREQUENCY_MIN_INTERVAL

Minimum interval in minutes for the entry frequency scheduler. Must be less than or equal to SCHEDULER_ENTRY_FREQUENCY_MAX_INTERVAL.

Default is 5 minutes.

SCHEDULER_ROUND_ROBIN_MAX_INTERVAL

Maximum interval in minutes for the round robin scheduler. This option is used when the values of the Cache-Control max-age and Expires headers are excessively high.

Default is 1440 minutes (24 hours).

SCHEDULER_ROUND_ROBIN_MIN_INTERVAL

Minimum interval in minutes for the round robin scheduler. Must be less than or equal to SCHEDULER_ROUND_ROBIN_MAX_INTERVAL.

Default is 60 minutes.

TRUSTED_REVERSE_PROXY_NETWORKS

A comma-separated list of networks (CIDR notation) allowed to use the proxy authentication header, X-Forwarded-For, X-Forwarded-Proto, and X-Real-Ip headers.

Default is empty.

WATCHDOG

Enable or disable Systemd watchdog.

Enabled by default.

WEBAUTHN

Enable or disable WebAuthn/Passkey authentication.

You must provide a username on the login page if you are using non-discoverable (non-resident) credentials, such as some hardware security keys. This is not required for discoverable credentials (Passkeys).

Default is disabled.

WORKER_POOL_SIZE

Number of background workers.

Default is 16 workers.

YOUTUBE_API_KEY

YouTube API key for use with FETCH_YOUTUBE_WATCH_TIME. If nonempty, the duration will be fetched from the YouTube API. Otherwise, the duration will be fetched from the YouTube website.

Default is empty.

YOUTUBE_EMBED_URL_OVERRIDE

YouTube URL which will be used for embeds.

Default is https://www.youtube-nocookie.com/embed/.

Configuration File

The configuration file is optional. It’s a text file that follows these rules:

Keys are the same as the environment variables described above.

Example:

LOG_LEVEL=debug
WORKER_POOL_SIZE=20

Environment variables override the values defined in the config file.

To specify a configuration file, use the command line argument -config-file or -c.

You can also print the parsed values with the flag -config-dump for debugging. The output includes sensitive information like passwords.

The Debian and RPM packages install the configuration file /etc/miniflux.conf. The systemd service loads it as environment variables.