misskey/.config/example.yml

#━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
# Misskey configuration
#━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

#   ┌──────────────────────────────┐
#───┘ a boring but important thing └────────────────────────────

#
# First of all, let me tell you a story that may possibly be
# boring to you and possibly important to you.
#
# Misskey is licensed under the AGPLv3 license. This license is
# known to be often misunderstood.  Please read the following
# instructions carefully and select the appropriate option so
# that you do not negligently cause a license violation.
#

# --------
# Option 1: If you host Misskey AS-IS (without any changes to
#           the source code. forks are not included).
#
# Step 1: Congratulations! You don't need to do anything.

# --------
# Option 2: If you have made changes to the source code (forks
#           are included) and publish a Git repository of source
#           code.  There should be no access restrictions on
#           this repository.  Strictly speaking, it doesn't have
#           to be a Git repository, but you'll probably use Git!
#
# Step 1: Build and run the Misskey server first.
# Step 2: Open <https://your.misskey.example/admin/settings> in
#         your browser with the administrator account.
# Step 3: Enter the URL of your Git repository in the
#         "Repository URL" field.

# --------
# Option 3: If neither of the above applies to you.
#           (In this case, the source code should be published
#           on the Misskey interface.  IT IS NOT ENOUGH TO
#           DISCLOSE THE SOURCE CODE WHEN A USER REQUESTS IT BY
#           E-MAIL OR OTHER MEANS.  If you are not satisfied
#           with this, it is recommended that you read the
#           license again carefully.  Anyway, enabling this
#           option will automatically generate and publish a
#           tarball at build time, protecting you from
#           inadvertent license violations. (There is no legal
#           guarantee, of course.)  The tarball will generated
#           from the root directory of your codebase.  So it is
#           also recommended to check <built/tarball> directory
#           once after building and before activating the server
#           to avoid ACCIDENTAL LEAKING OF SENSITIVE INFORMATION.
#           To prevent certain files from being included in the
#           tarball, add a glob pattern after line 15 in
#           <scripts/tarball.mjs>.  DO NOT FORGET TO BUILD AFTER
#           ENABLING THIS OPTION!)
#
# Step 1: Uncomment the following line.
#
# publishTarballInsteadOfProvideRepositoryUrl: true

#   ┌────────────────────────┐
#───┘ Initial Setup Password └─────────────────────────────────────────────────────

# Password to initiate setting up admin account.
# It will not be used after the initial setup is complete.
#
# Be sure to change this when you set up Misskey via the Internet.
#
# The provider of the service who sets up Misskey on behalf of the customer should
# set this value to something unique when generating the Misskey config file,
# and provide it to the customer.
#
# setupPassword: example_password_please_change_this_or_you_will_get_hacked

#   ┌─────┐
#───┘ URL └─────────────────────────────────────────────────────

# Final accessible URL seen by a user.
url: https://example.tld/

# ONCE YOU HAVE STARTED THE INSTANCE, DO NOT CHANGE THE
# URL SETTINGS AFTER THAT!

#   ┌───────────────────────┐
#───┘ Port and TLS settings └───────────────────────────────────

#
# Misskey requires a reverse proxy to support HTTPS connections.
#
#                 +----- https://example.tld/ ------------+
#   +------+      |+-------------+      +----------------+|
#   | User | ---> || Proxy (443) | ---> | Misskey (3000) ||
#   +------+      |+-------------+      +----------------+|
#                 +---------------------------------------+
#
#   You need to set up a reverse proxy. (e.g. nginx)
#   An encrypted connection with HTTPS is highly recommended
#   because tokens may be transferred in GET requests.

# The port that your Misskey server should listen on.
port: 3000

# You can also use UNIX domain socket.
# socket: /path/to/misskey.sock
# chmodSocket: '777'

# Proxy trust settings
#
# Specifies the IP addresses that Misskey will use as trusted
# reverse proxies (e.g., nginx, Cloudflare). This affects how
# Misskey determines the source IP for each request and is used
# for important rate limiting and security features. If the value
# is not set correctly, Misskey may use the IP address of the
# reverse proxy instead of the actual source IP, which may lead to
# unintended rate limiting or security vulnerabilities.
# By default, the loopback network and private network address
# ranges shown below are trusted.
# If you are using a single reverse proxy and it is on the same
# machine or the same private network as Misskey, it is unlikely you
# need to change this setting, and the default setting is fine.
# Also, if you are using multiple reverse proxy servers and they are
# all on the same private network as Misskey, the default setting
# is fine.
# However, if you are using a reverse proxy server that accesses
# Misskey web servers and streaming servers via public IP addresses
# (for example, Cloudflare), you must set this variable.
# When changing this setting, you can use one of the following values:
#
# - true: Trust all proxies
# - false: Do not trust any proxies
# - IP address, IP address range, or array of them: Trust hops that
#   match the specified criteria.
# - Integer: Trust the nth hop from the front-facing proxy server as
#   the client.
# For more information on how to configure this setting, please refer
# to the Fastify documentation:
# https://fastify.dev/docs/latest/Reference/Server/#trustproxy
#
# Note that if this variable is set, it overrides the default range,
# so if you have both an external reverse proxy and a proxy on the
# local host, you must include both IPs (or IP ranges).
#
#trustProxy:
#  - '10.0.0.0/8'
#  - '172.16.0.0/12'
#  - '192.168.0.0/16'
#  - '127.0.0.1/32'
#  - '::1/128'
#  - 'fc00::/7'
#  # Example: If you are using some external reverse proxies like CDNs,
#  # you may need to add the CDN IP ranges here.
#  # If you're using Cloudflare, you can find IP Ranges at:
#  # https://www.cloudflare.com/ips/

#   ┌──────────────────────────┐
#───┘ PostgreSQL configuration └────────────────────────────────

db:
  host: localhost
  port: 5432

  # Database name
  db: misskey

  # Auth
  user: example-misskey-user
  pass: example-misskey-pass

  # Whether disable Caching queries
  #disableCache: true

  # Extra Connection options
  #extra:
  #  ssl: true

dbReplications: false

# You can configure any number of replicas here
#dbSlaves:
#  -
#    host:
#    port:
#    db:
#    user:
#    pass:
#  -
#    host:
#    port:
#    db:
#    user:
#    pass:

#   ┌─────────────────────┐
#───┘ Redis configuration └─────────────────────────────────────

redis:
  host: localhost
  port: 6379
  #family: 0  # 0=Both, 4=IPv4, 6=IPv6
  #pass: example-pass
  #prefix: example-prefix
  #db: 1
  # You can specify more ioredis options...
  #username: example-username

#redisForPubsub:
#  host: localhost
#  port: 6379
#  #family: 0  # 0=Both, 4=IPv4, 6=IPv6
#  #pass: example-pass
#  #prefix: example-prefix
#  #db: 1
#  # You can specify more ioredis options...
#  #username: example-username

#redisForJobQueue:
#  host: localhost
#  port: 6379
#  #family: 0  # 0=Both, 4=IPv4, 6=IPv6
#  #pass: example-pass
#  #prefix: example-prefix
#  #db: 1
#  # You can specify more ioredis options...
#  #username: example-username

#redisForTimelines:
#  host: localhost
#  port: 6379
#  #family: 0  # 0=Both, 4=IPv4, 6=IPv6
#  #pass: example-pass
#  #prefix: example-prefix
#  #db: 1
#  # You can specify more ioredis options...
#  #username: example-username

#redisForReactions:
#  host: localhost
#  port: 6379
#  #family: 0  # 0=Both, 4=IPv4, 6=IPv6
#  #pass: example-pass
#  #prefix: example-prefix
#  #db: 1
#  # You can specify more ioredis options...
#  #username: example-username

#   ┌───────────────────────────────┐
#───┘ Fulltext search configuration └─────────────────────────────

# These are the setting items for the full-text search provider.
fulltextSearch:
  # You can select the ID generation method.
  # - sqlLike (default)
  #   Use SQL-like search.
  #   This is a standard feature of PostgreSQL, so no special extensions are required.
  # - sqlPgroonga
  #   Use pgroonga.
  #   You need to install pgroonga and configure it as a PostgreSQL extension.
  #   In addition to the above, you need to create a pgroonga index on the text column of the note table.
  #   see: https://pgroonga.github.io/tutorial/
  # - meilisearch
  #   Use Meilisearch.
  #   You need to install Meilisearch and configure.
  provider: sqlLike

# For Meilisearch settings.
# If you select "meilisearch" for "fulltextSearch.provider", it must be set.
# You can set scope to local (default value) or global
# (include notes from remote).

#meilisearch:
#  host: localhost
#  port: 7700
#  apiKey: ''
#  ssl: true
#  index: ''
#  scope: local

#   ┌───────────────┐
#───┘ ID generation └───────────────────────────────────────────

# You can select the ID generation method.
# You don't usually need to change this setting, but you can
# change it according to your preferences.

# Available methods:
# aid ... Short, Millisecond accuracy
# aidx ... Millisecond accuracy
# meid ... Similar to ObjectID, Millisecond accuracy
# ulid ... Millisecond accuracy
# objectid ... This is left for backward compatibility

# ONCE YOU HAVE STARTED THE INSTANCE, DO NOT CHANGE THE
# ID SETTINGS AFTER THAT!

id: 'aidx'

#   ┌────────────────┐
#───┘ Error tracking └──────────────────────────────────────────

# Sentry is available for error tracking.
# See the Sentry documentation for more details on options.

#sentryForBackend:
#  enableNodeProfiling: true
#  # Specify Sentry integration names to disable individual auto-instrumentation.
#  # The names are integration .name values, not factory function names.
#  # To check enabled names, set `options.debug: true` and see
#  # "Integration installed: <name>" in the Sentry logs.
#  #
#  # As of 2026-07-07 / @sentry/node 10.62.0, useful names for Misskey include:
#  #   Postgres  ... DB queries (when pg is externalized)
#  #   Redis     ... ioredis commands
#  #   Fastify   ... inbound HTTP routes
#  #   Http      ... inbound/outbound HTTP; disabling this can also affect request isolation
#  #   NodeFetch ... fetch/undici requests
#  disabledIntegrations: ['Postgres']
#  options:
#    dsn: 'https://examplePublicKey@o0.ingest.sentry.io/0'
#    # By default, Misskey prevents Sentry trace headers (`sentry-trace` and
#    # `baggage`) from being sent to remote ActivityPub/Webhook/etc. hosts.
#    # To intentionally propagate distributed traces to trusted internal services,
#    # list only those internal URL patterns here.
#    # Avoid broad patterns that match remote servers unless you intentionally
#    # want to restore Sentry's legacy behavior of propagating traces to all
#    # outbound HTTP requests.
#    #tracePropagationTargets: []
#    # Internal allowlist example:
#    #tracePropagationTargets:
#    #  - 'internal-service.example'

#   ┌─────────┐
#───┘ Tracing └────────────────────────────────────────────────
# OpenTelemetry distributed tracing (Traces only, opt-in).
# Existing API and Queue spans are exported to an OTLP http/protobuf endpoint.
#
# Standard OTEL_* environment variables are honored for values omitted below:
# OTEL_EXPORTER_OTLP_TRACES_ENDPOINT, OTEL_EXPORTER_OTLP_ENDPOINT,
# OTEL_EXPORTER_OTLP_HEADERS, OTEL_TRACES_SAMPLER, OTEL_TRACES_SAMPLER_ARG, etc.
#
# When this is enabled together with sentryForBackend, Misskey shares Sentry's
# TracerProvider and adds an OTLP SpanProcessor to it. In that mode:
# - sampleRate below is ignored; sampling follows sentryForBackend.options
#   tracesSampleRate / tracesSampler.
# - resourceAttributes below is ignored; set OTEL_SERVICE_NAME and
#   OTEL_RESOURCE_ATTRIBUTES in the environment if you need to override them.
# - spans produced by Sentry integrations are exported to both Sentry and OTLP.
# - sentry-trace / baggage propagation to outbound remote requests is disabled
#   by default while OTel is enabled. Set propagateTraceToRemote: true only if
#   you intentionally want Sentry trace propagation for your deployment.

#otelForBackend:
#  endpoint: 'http://localhost:4318/v1/traces'
#  #headers:
#  #  authorization: 'Bearer xxxxx'
#  #sampleRate: 1.0
#  # Record PostgreSQL query spans. Disabled by default to avoid instrumentation
#  # overhead when database-level diagnostics are not needed.
#  #capturePgSpans: false
#  # Include raw SQL text in PostgreSQL spans. Requires capturePgSpans and is
#  # disabled by default because non-parameterized queries can expose values to
#  # the OTLP Collector.
#  #capturePgStatement: false
#  # Include PostgreSQL connection-pool spans with an existing parent span.
#  # Requires capturePgSpans and is disabled by default to avoid noisy spans
#  # from connection churn.
#  #capturePgConnectionSpans: false
#  # Record Redis command spans. Disabled by default because subscribing to the
#  # ioredis diagnostics channel adds work to every Redis command, including
#  # commands without a parent span. Enable for development diagnostics or when
#  # the added overhead is acceptable in production.
#  #captureRedisCommandSpans: false
#  # Include Redis startup/reconnect spans. Disabled by default to avoid noisy
#  # connection churn; these spans are recorded even without an HTTP or job
#  # parent span.
#  #captureRedisConnectionSpans: false
#  # Record Redis commands without an HTTP or job parent span. Disabled by
#  # default because queue polling and background work can produce many root
#  # traces; only applies when captureRedisCommandSpans is enabled.
#  #captureRedisRootSpans: false
#  #resourceAttributes:
#  #  deployment.environment: 'production'
#  #propagateTraceToRemote: false
#  # Queue worker spans are independent traces linked to their enqueuer by default.
#  # Set to 'parent' to make them child spans instead. This can create very large
#  # traces for high-fan-out queues such as federation delivery.
#  #jobTraceContextMode: 'link'

#sentryForFrontend:
#  vueIntegration:
#    tracingOptions:
#      trackComponents: true
#  browserTracingIntegration:
#  replayIntegration:
#  options:
#    dsn: 'https://examplePublicKey@o0.ingest.sentry.io/0'

#   ┌─────────────────────┐
#───┘ Other configuration └─────────────────────────────────────

# Whether disable HSTS
#disableHsts: true

# Enable internal IP-based rate limiting (default: true)
# To configure them in reverse proxy instead, set this to false.
#enableIpRateLimit: true

# Number of worker processes
#clusterLimit: 1

# Number of threads of extra thread pool for CPU-intensive tasks (per worker)
#threadPoolSize: 1

# Job concurrency per worker
#deliverJobConcurrency: 128
#inboxJobConcurrency: 16
#relationshipJobConcurrency: 16
# What's relationshipJob?:
#  Follow, unfollow, block and unblock(ings) while following-imports, etc. or account migrations.

# Job rate limiter
#deliverJobPerSec: 128
#inboxJobPerSec: 32
#relationshipJobPerSec: 64

# Job attempts
#deliverJobMaxAttempts: 12
#inboxJobMaxAttempts: 8

# Local address used for outgoing requests
#outgoingAddress: 127.0.0.1

# IP address family used for outgoing request (ipv4, ipv6 or dual)
#outgoingAddressFamily: ipv4

# Proxy for HTTP/HTTPS
#proxy: http://127.0.0.1:3128

proxyBypassHosts:
  - api.deepl.com
  - api-free.deepl.com
  - www.recaptcha.net
  - hcaptcha.com
  - challenges.cloudflare.com

# Proxy for SMTP/SMTPS
#proxySmtp: http://127.0.0.1:3128   # use HTTP/1.1 CONNECT
#proxySmtp: socks4://127.0.0.1:1080 # use SOCKS4
#proxySmtp: socks5://127.0.0.1:1080 # use SOCKS5

# Media Proxy
# Reference Implementation: https://github.com/misskey-dev/media-proxy
# * Deliver a common cache between instances
# * Perform image compression (on a different server resource than the main process)
#mediaProxy: https://example.com/proxy

# Movie Thumbnail Generation URL
# There is no reference implementation.
# For example, Misskey will point to the following URL:
#   https://example.com/thumbnail.webp?thumbnail=1&url=https%3A%2F%2Fstorage.example.com%2Fpath%2Fto%2Fvideo.mp4
#videoThumbnailGenerator: https://example.com

# For security reasons, uploading attachments from the intranet is prohibited,
# but exceptions can be made from the following settings. Default value is "undefined".
# Read changelog to learn more (Improvements of 12.90.0 (2021/09/04)).
#allowedPrivateNetworks:
#  - '127.0.0.1/32'

# Upload or download file size limits (bytes)
#maxFileSize: 262144000

# PID File of master process
#pidFile: /tmp/misskey.pid

# Log settings
# logging:
#   # ログの出力形式。「json」で1行JSON、未指定時は「pretty」です。
#   format: pretty
#   # Minimum level for all loggers. Defaults to info in production and debug otherwise.
#   level: info
#   # The longest matching logger domain takes precedence over the global level.
#   domains:
#     core.boot: info
#     queue: error
#     queue.deliver: debug
#     db.sql: off
#   sql:
#     # Outputs query parameters during SQL execution to the log.
#     # default: false
#     enableQueryParamLogging: false
#     # Disable query truncation. If set to true, the full text of the query will be output to the log.
#     # default: false
#     disableQueryTruncation: false