Runtime configuration

Lore uses command-line flags and matching LORE__ environment variables. The database URL is required for lore serve; it is not required for lore build.

Flag	Environment	Purpose
`--listen-address`	`LORE__LISTEN_ADDRESS`	HTTP listen address; defaults to `127.0.0.1:8080`.
`--database-url`	`LORE__DATABASE_URL`	PostgreSQL connection URL.
`--public-url`	`LORE__PUBLIC_URL`	Externally visible base URL; defaults to `http://localhost:8080`.
`--pdf-url`	`LORE__PDF_URL`	Optional runtime override for the configured HTML-to-PDF render endpoint.
`--local-login`	`LORE__LOCAL_LOGIN`	Exposes local recovery login alongside another configured authentication mode.
`--theme-directory`	`LORE__THEME_DIRECTORY`	Optional directory of TOML theme files that override or extend embedded themes.
`--auth-mode`	`LORE__AUTH_MODE`	Emergency authentication override.
`--oidc-issuer`	`LORE__OIDC_ISSUER`	OIDC issuer used with the runtime override.
`--oidc-client-id`	`LORE__OIDC_CLIENT_ID`	OIDC client ID used with the runtime override.
`--oidc-client-secret`	`LORE__OIDC_CLIENT_SECRET`	OIDC client secret used when OIDC is enabled.
`--oidc-session-secret`	`LORE__OIDC_SESSION_SECRET`	Signs OIDC login state/session cookies; when set it must be at least 32 characters.
`--encryption-key`	`LORE__ENCRYPTION_KEY`	Base64-encoded 32-byte key used to encrypt sensitive persisted application settings.
`--log-format`	`LORE__LOG_FORMAT`	`json` or `text`.
`--debug`	`LORE__DEBUG`	Enables verbose diagnostics.
`--access-log`	`LORE__ACCESS_LOG`	Enables HTTP access logging.

Trusted-proxy username, email, and display-name header lists also have deployment flags and environment-variable forms. Their built-in defaults cover common reverse-proxy headers.

The --auth-mode value is a recovery override, not the normal place to configure browser authentication. When it is set, the administration UI shows the effective authentication mode as Managed by deployment and does not allow the persisted mode to be changed. Remove the runtime setting and restart Lore to manage the mode in the UI again.

Runtime authentication settings override only their corresponding fields. With the OIDC runtime override, --oidc-issuer / LORE__OIDC_ISSUER and --oidc-client-id / LORE__OIDC_CLIENT_ID are also read-only and marked Managed by deployment; OIDC group settings remain database-managed. With the trusted-proxy runtime override, the runtime username, email, and display-name header lists are read-only while group-header and administrator-group settings remain database-managed.

The PDF service is also normally configured in Administration → Configuration. --pdf-url / LORE__PDF_URL overrides that persisted endpoint for deployments that want to manage the integration entirely outside Lore. Persisted PDF request headers still apply when the endpoint is overridden. Sensitive header values require LORE__ENCRYPTION_KEY; see the generation instructions below. See Authentication for authentication setup.

Generate deployment secrets

Run these commands once when setting up a new deployment. Each command generates a separate random value:

# Encrypts sensitive settings stored in PostgreSQL.
export LORE__ENCRYPTION_KEY="$(openssl rand -base64 32)"

# Signs OIDC session cookies; needed when using OIDC.
export LORE__OIDC_SESSION_SECRET="$(openssl rand -base64 32)"

These exports configure Lore when it is started from the same shell. Save the values in your deployment’s secret store so they are available after a restart; do not regenerate them in a startup script.

Secret	Required format	Generated by the command
`LORE__ENCRYPTION_KEY`	Base64 encoding of exactly 32 bytes	A 44-character Base64 string, including the trailing `=`
`LORE__OIDC_SESSION_SECRET`	At least 32 characters	A 44-character random string

Use the complete generated value. A 32-character string is too short for the encryption key: it must decode to 32 bytes.

For Kubernetes, run openssl rand -base64 32 separately for each secret and paste each output into the corresponding stringData field:

# In Secret lore-config:
stringData:
  LORE__ENCRYPTION_KEY: "<paste the first generated value here>"

# In the separate Secret lore-oidc:
stringData:
  LORE__OIDC_SESSION_SECRET: "<paste the second generated value here>"

The placeholders above must be replaced. Under stringData, paste the output exactly as generated; Kubernetes handles its own Secret encoding. Preserve any other fields already in these Secrets. For Flux deployments, update the Secret in your configured secret-management source.

Keep each secret consistent across all replicas and restarts:

Changing or losing the encryption key makes existing encrypted settings unreadable. Restore the original key when recovering an existing deployment.
Changing the OIDC session secret signs out users and invalidates pending logins.

LORE__OIDC_CLIENT_SECRET comes from your identity provider’s Lore client configuration. Copy that value from the provider; the commands above generate Lore’s own secrets.