Configuration

All settings live in one file, /opt/tadbir/.env, created by the installer from the bundle's .env.template. Keep one KEY=value per line, without quotes or spaces around =. The file holds passwords: it is readable by root only, and the daily backup includes it.

To apply a change, edit the file and restart:

sudo /opt/tadbir/current/compose/onprem/compose.sh up -d --pull never

Required

Variable	Example	What it controls
DOMAIN	tadbir.acme.lan	The hostname users type. Web interface, sign-in and maps are all served at https://<DOMAIN>. Changing it later also requires a matching certificate.
TADBIR_BOOTSTRAP_ADMIN_EMAIL	it-admin@acme.com	The first administrator's sign-in email, created once at the first start. Changing it later creates nobody: once an administrator exists, this setting is ignored.

Generated by the installer

Leave these blank before the first install. The installer fills them with random values and never changes an existing value. Do not change them after installation: the database and sign-in service keep the first values, and a restore uses the values saved with the backup.

Variable	What it is
POSTGRES_PASSWORD	Database password
KEYCLOAK_ADMIN_PASSWORD	Password of the sign-in service's own administrator (admin). That console is not reachable from the network; Tadbir uses this account internally to create users.
TADBIR_BOOTSTRAP_ADMIN_PASSWORD	Temporary password of the first administrator. It must be changed at first sign-in and is not used afterwards.
KEYCLOAK_UNUSED_CLIENT_SECRET	Locks sign-in clients that only the cloud version uses.

Optional

Variable	Default	What it controls
DATA_ROOT	/srv/tadbir	Where all data is kept: database, uploaded files, license, maps, backups. Choose before installing; moving it later means moving all data.
TLS_DIR	/opt/tadbir/tls	Directory with cert.pem (full chain) and key.pem. See Replace the certificate.
BACKUP_RETENTION_DAYS	30	Number of days of daily backups kept in DATA_ROOT/backups.

Email

Sign-in emails (staff invitations, resent invitations, password resets) use these settings. Your mail server must accept STARTTLS with a username and password.

Variable	Example	What it controls
KC_SMTP_HOST	smtp.acme.lan	Mail server. Blank = no sign-in emails.
KC_SMTP_PORT	587	Mail server port
KC_SMTP_FROM	tadbir@acme.com	Sender address
KC_SMTP_FROM_DISPLAY	Tadbir	Sender name
KC_SMTP_USER	tadbir@acme.com	Mail server login
KC_SMTP_PASS		Mail server password

Tadbir's own notification emails are configured in the application, in the organization's email settings.

The server must also be allowed to reach the mail server. For security, Tadbir's containers have no outbound network access. To open access to your mail server only:

1. Copy compose/onprem/smtp.override.example.yml from the installed release to /opt/tadbir/docker-compose.override.yml. It gives the sign-in service and the application a separate mail network, 172.31.250.0/24.

2. Limit that network to your mail server with the host firewall (use the mail server's IP address; if you use its name, also allow your DNS server on UDP port 53):

   sudo iptables -I DOCKER-USER -s 172.31.250.0/24 -j DROP
   sudo iptables -I DOCKER-USER -s 172.31.250.0/24 -d <mail-server-ip> -p tcp --dport 587 -j ACCEPT

   Make the rules permanent with your distribution's firewall tooling.

3. Restart with the command at the top of this page.

If that subnet is already used on your network, set another one with MAIL_SUBNET=<subnet> in .env and use it in the firewall rules.

Local overrides

/opt/tadbir/docker-compose.override.yml, when present, is applied on top of Tadbir's own files at every start, upgrade and restore. Use it only for site-specific needs such as the email network above, and keep a copy: Oloom support may ask for it.

Settings you do not need

The installation always runs in offline license mode, with public signup and online payment turned off, local maps and address search, and no ACME/Let's Encrypt. Those are fixed by the installation files; they are not .env settings.