Skip to content
Warden
DashboardGet started

Configuration

The settings in Warden's .env file - email, GitHub sign-in, the GitHub App and backup storage.

Warden’s settings live in infra/production/.env on the server. Edit them there, then apply:

Terminal window
cd ~/warden/infra/production
nano .env
sudo docker compose up -d

up -d recreates only the containers whose settings changed.

Keep .env off chats, tickets and screenshots. If a value leaks, replace it at its source (Resend, GitHub, your storage provider) and update the file.

Email

Section titled “Email”

Sign-in links, invitations, password-reset codes and alerts.

RESEND_API_KEY=re_...
MAIL_FROM=Warden <noreply@example.com>
MAIL_SUPPORT=support@example.com

Warden sends through Resend. MAIL_FROM must use a domain you’ve verified in Resend: add the DNS records Resend lists for the domain (DKIM, SPF and MX on a send subdomain), plus a DMARC record such as v=DMARC1; p=none. MAIL_SUPPORT is the reply-to address.

Without RESEND_API_KEY, nothing is sent and links appear in the API’s log instead.

Sign in with GitHub

Section titled “Sign in with GitHub”
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=

These can come from the Warden GitHub App (below) or from a separate GitHub OAuth App. Either way:

  • Its callback URL is https://<your domain>/api/auth/github/callback.
  • Warden reads the user’s verified email address. If you use the GitHub App, give it the Account permissions → Email addresses: Read-only permission.

Leave both empty to offer email sign-in only.

The Warden GitHub App

Section titled “The Warden GitHub App”

Needed for private repositories and for deploying on every push. Public repositories work without it.

GITHUB_APP_ID=
GITHUB_APP_SLUG=
GITHUB_APP_WEBHOOK_SECRET=
GITHUB_APP_PRIVATE_KEY=

Create it at GitHub → Settings → Developer settings → GitHub Apps → New GitHub App:

Field Value
Homepage URL https://<your domain>
Setup URL https://<your domain>/api/github/callback, with Redirect on update ticked
Request user authorization during installation Off (it would disable the Setup URL)
Webhook URL https://<your domain>/api/github/webhook
Webhook secret A random value (openssl rand -hex 32); the same value goes in GITHUB_APP_WEBHOOK_SECRET
Repository permissions Contents: Read-only (Metadata: Read-only is added by GitHub)
Events Push

Then:

  • GITHUB_APP_ID is the App ID on the App’s page, and GITHUB_APP_SLUG is the name in its public link (github.com/apps/<slug>).

  • Under Private keys, generate a key. It downloads as a .pem file. GITHUB_APP_PRIVATE_KEY needs it on one line, with \n for the line breaks. On a Mac this copies it in that form:

    Terminal window
    awk 'NF {sub(/\r/, ""); printf "%s\\n",$0;}' ~/Downloads/<app>.private-key.pem | pbcopy

After docker compose up -d, connect it from the dashboard: Settings → GitHub.

Backup storage

Section titled “Backup storage”

Warden’s own bucket for database backups, and for backups of Warden’s own database (see Updates and backups). Any S3-compatible store works; Cloudflare R2 is a good fit.

BACKUP_S3_ENDPOINT=https://<account id>.r2.cloudflarestorage.com
BACKUP_S3_BUCKET=warden-backups
BACKUP_S3_ACCESS_KEY_ID=
BACKUP_S3_SECRET_ACCESS_KEY=

Use a bucket of its own (not one shared with a development copy of Warden) and an API token limited to that bucket. Organizations can also bring their own bucket from Settings → Backup storage, which takes priority for their databases.

Other settings

Section titled “Other settings”
Setting Default Meaning
WARDEN_HOST Your dashboard’s domain
WARDEN_VERSION latest The image tag to run; a commit’s SHA pins a version