Configuration¶

Gotify reads its settings from /etc/gotify/server.env. Users, applications and clients are managed in the web UI or the REST API. This page covers both.

Where things live¶

Path	What it is
`/etc/gotify/server.env`	Gotify settings (mode 0644; do not put secrets here)
`/etc/gotify/admin.password`	The first-boot `admin` password (root and `gotify` only, mode 0640)
`/etc/gotify/tls/cert.pem`	This instance's certificate, for clients
`/etc/gotify/tls/key.pem`	Its private key (root and `gotify` only, mode 0640)
`/var/lib/gotify/data/gotify.db`	SQLite message store
`/var/lib/gotify/images/`	Uploaded application images
`/usr/local/bin/gotify`	The Gotify server binary

First boot writes server.env only if it does not exist yet, so your edits are kept across reboots.

Default settings¶

Setting	Value
`GOTIFY_SERVER_LISTENADDR`, `GOTIFY_SERVER_PORT`	`127.0.0.1`, `8080`
`GOTIFY_SERVER_SSL_LISTENADDR`, `GOTIFY_SERVER_SSL_PORT`	`127.0.0.1`, `8443`
`GOTIFY_SERVER_SSL_REDIRECTTOHTTPS`	`true`
`GOTIFY_SERVER_SSL_LETSENCRYPT_ENABLED`	`false`
`GOTIFY_DATABASE_DIALECT`	`sqlite3`
`GOTIFY_DEFAULTUSER_NAME`	`admin`
`GOTIFY_REGISTRATION`	`false`
`GOTIFY_PLUGINSDIR`	empty, so plugins are off
`GOTIFY_LOCALAUTH_ENABLED`	`true`
`GOTIFY_OIDC_ENABLED`	`false`

Apply changes¶

sudo nano /etc/gotify/server.env
sudo systemctl restart gotify
systemctl is-active gotify

Applications and clients¶

Gotify has two kinds of token:

An application token sends messages with POST /message. It cannot read message history.
A client token reads messages with GET /message and receives them live over the WebSocket at /stream.

Create them in the web UI. Keep each token in a file only you can read, and send it in the X-Gotify-Key header. See Getting started for an example.

The admin password¶

Gotify uses /etc/gotify/admin.password only once, to create the admin user when the database is first created. Editing the file afterwards does not change the password. Change it in the web UI. The file keeps the original value until you replace it, so keep it private.

Reach Gotify from other hosts¶

Gotify listens on 127.0.0.1 only. A phone app or another host cannot reach it until you change that. Either leave Gotify on loopback and put a proxy you control in front of it, or change the listen addresses in server.env and allow only your own network in the security group. You then also need a certificate your clients trust.

Keep registration off

Do not turn on GOTIFY_REGISTRATION, and do not open Gotify to the internet on 0.0.0.0 without a reviewed security group.

The walkthrough checks the defaults

demo.sh and the self-test it runs check the image's default settings. After you change the configuration, they can report a failure even when your setup works. Run them on a fresh instance, before you make changes.

Next: Operations.