Configuration¶
This page shows where AnythingLLM's configuration lives and how to make the
common changes. Most settings, such as providers, workspaces and users, are
made in the AnythingLLM UI and stored under /var/lib/anythingllm. The few
server settings below are made as root, followed by a restart.
Where things live¶
| Path | What it is |
|---|---|
/etc/anythingllm/server.env |
Server environment passed to the container: port, password and signing secrets. Created on first boot and not overwritten afterwards. Root only. |
/etc/anythingllm/admin.password |
The admin password created on first boot. Root only. |
/var/lib/anythingllm/ |
Storage mounted into the container: documents, settings, database and vectors. |
/opt/sushi/bin/anythingllm-run.sh |
Starts the container. |
The container runs with the storage directory mounted at
/app/server/storage and publishes port 3001 on 127.0.0.1 only.
The server environment¶
First boot writes these settings to server.env:
| Setting | Value |
|---|---|
STORAGE_DIR |
/app/server/storage (inside the container) |
SERVER_PORT |
3001 |
AUTH_TOKEN |
The admin password |
JWT_SECRET, SIG_KEY, SIG_SALT |
Random per-instance secrets |
DISABLE_TELEMETRY |
true |
PASSWORDMINCHAR |
8 |
To change a setting, edit the file and restart. The container is created fresh on every start, so it always reads the current file:
Keep the file owned by root:root with mode 0600. The service refuses to
start otherwise. See the
AnythingLLM documentation for other settings.
Change the admin password¶
The password is the AUTH_TOKEN value. Change it in both files, so they stay
in step, then restart:
sudo bash -euo pipefail <<'ROTATE'
umask 077
new=$(openssl rand -hex 24)
sed -i "s/^AUTH_TOKEN=.*/AUTH_TOKEN=${new}/" /etc/anythingllm/server.env
printf '%s\n' "$new" > /etc/anythingllm/admin.password
chown root:root /etc/anythingllm/server.env /etc/anythingllm/admin.password
chmod 0600 /etc/anythingllm/server.env /etc/anythingllm/admin.password
systemctl restart anythingllm
ROTATE
Read the new password with sudo cat /etc/anythingllm/admin.password. Keep it
free of spaces if you choose your own.
Change providers¶
Change the LLM and the embedding provider in the UI under Settings.
Provider keys you enter there are stored on the instance under
/var/lib/anythingllm.
Reach the UI from other machines¶
AnythingLLM listens on 127.0.0.1:3001 only, over plain HTTP. Choose one of
these:
- Session Manager port forwarding for each user, see Open the UI.
- A TLS reverse proxy on the instance that you install and manage, which
forwards to
127.0.0.1:3001. Bind it to the instance's private address, use a certificate your users trust, and in the security group allow its port only from your own address ranges.
Keep it private
Do not open port 3001 to the internet, and do not change the port
publishing to 0.0.0.0. The UI holds your documents and provider keys.
Things to leave alone¶
- Do not change
JWT_SECRET,SIG_KEYorSIG_SALTonce the instance is in use. Sessions and stored data rely on them. - Do not change
STORAGE_DIR, or the ownership of/var/lib/anythingllm(UID and GID 1000, mode 0700). The container runs as that user. - Do not pull or replace the container image. A new AnythingLLM version comes as a new version of the image.
Last updated October 13, 2026 · Suggest an improvement