Configuration Matrix
July 31, 2026 · View on GitHub
| Plugin | Config key | Env var | Title | Sensitive | Consumed by | Description |
|---|---|---|---|---|---|---|
adguard | adguard_password | ADGUARD_PASSWORD | Password | yes | plugins/adguard/scripts/setup.sh | AdGuard Home password used for HTTP Basic authentication. |
adguard | adguard_url | ADGUARD_URL | AdGuard URL | no | plugins/adguard/scripts/setup.sh | Base URL of the AdGuard Home instance, including scheme. Do not include a trailing slash or /control. |
adguard | adguard_username | ADGUARD_USERNAME | Username | no | plugins/adguard/scripts/setup.sh | AdGuard Home username used for HTTP Basic authentication. |
agent-os | agent_os_autostart | AGENT_OS_AUTOSTART | Auto-start the VM if down | no | plugins/agent-os/scripts/setup.sh, plugins/agent-os/skills/agent-os/SKILL.md | Set to "true" to let the SessionStart hook SSH to the Docker host and docker compose up -d the VM when the Windows-MCP endpoint is unreachable. Requires agent_os_vm_host + agent_os_compose_file. It only starts (never stops) the VM and does not block on the multi-minute Windows boot. Leave "false" to only warn. Note: this starts an already-provisioned server; it does not install Windows-MCP from scratch. |
agent-os | agent_os_compose_file | AGENT_OS_COMPOSE_FILE | docker-compose.yml path | no | plugins/agent-os/commands/agent-os.md, plugins/agent-os/scripts/setup.sh, plugins/agent-os/skills/agent-os/SKILL.md, plugins/agent-os/skills/agent-os/references/troubleshooting.md | Absolute path to the agent-os compose file ON the Docker host, used to bring the VM back up. Example: /mnt/cache/compose/windows/docker-compose.yml. |
agent-os | agent_os_container_name | AGENT_OS_CONTAINER_NAME | Container name | no | plugins/agent-os/commands/agent-os.md, plugins/agent-os/scripts/setup.sh, plugins/agent-os/skills/agent-os/SKILL.md, plugins/agent-os/skills/agent-os/references/troubleshooting.md | Name of the dockur/windows container running the VM. Example: agent-os-win11. |
agent-os | agent_os_host_forward_port | AGENT_OS_HOST_FORWARD_PORT | Host-forward SSH port | no | plugins/agent-os/commands/agent-os.md, plugins/agent-os/skills/agent-os/references/tailscale.md, plugins/agent-os/skills/agent-os/references/troubleshooting.md | Port the Docker host forwards to the guest's sshd (host:PORT -> guest:22). Example: 2222. |
agent-os | agent_os_host_forward_ssh | AGENT_OS_HOST_FORWARD_SSH | Host-forward SSH target | no | plugins/agent-os/commands/agent-os.md, plugins/agent-os/skills/agent-os/SKILL.md, plugins/agent-os/skills/agent-os/references/tailscale.md, plugins/agent-os/skills/agent-os/references/troubleshooting.md | SSH user@host of the Docker host's port-forward into the guest (user@ssh agent-os — for Tailscale maintenance inside the guest, since it survives tailscale down. Example: docker@100.120.242.29. |
agent-os | agent_os_mcp_token | AGENT_OS_MCP_TOKEN | Windows-MCP bearer token | yes | plugins/agent-os/.mcp.json, plugins/agent-os/commands/agent-os.md, plugins/agent-os/scripts/setup.sh, plugins/agent-os/skills/agent-os/SKILL.md | Bearer token the Windows-MCP server expects (sent as 'Authorization: Bearer |
agent-os | agent_os_mcp_url | AGENT_OS_MCP_URL | Windows-MCP URL | no | plugins/agent-os/.mcp.json, plugins/agent-os/commands/agent-os.md, plugins/agent-os/scripts/setup.sh, plugins/agent-os/skills/agent-os/SKILL.md | Full HTTP(S) URL of the Windows-MCP endpoint inside the agent-os VM, including the /mcp path. This is what the plugin registers as the windows-mcp MCP server. Example: https://agent-os.example.ts.net/mcp. Prefer the VM's own stable Tailscale/MagicDNS name so it follows the VM across Docker hosts. |
agent-os | agent_os_novnc_url | AGENT_OS_NOVNC_URL | noVNC URL | no | plugins/agent-os/commands/agent-os.md, plugins/agent-os/skills/agent-os/SKILL.md | Base URL of the dockur/windows web (noVNC) UI on the Docker host, for visual debugging. Example: http://tootie:8006. |
agent-os | agent_os_vm_host | AGENT_OS_VM_HOST | Docker host running the VM | no | plugins/agent-os/commands/agent-os.md, plugins/agent-os/scripts/setup.sh, plugins/agent-os/skills/agent-os/SKILL.md, plugins/agent-os/skills/agent-os/references/troubleshooting.md | SSH alias/host of the Docker host that runs the agent-os-win11 container (for docker ps, compose up, etc.). Example: tootie. |
agent-os | agent_os_vm_tailscale_ip | AGENT_OS_VM_TAILSCALE_IP | VM Tailscale IP / SSH host | no | plugins/agent-os/commands/agent-os.md, plugins/agent-os/skills/agent-os/SKILL.md | The agent-os guest's own Tailscale IP (or MagicDNS name) used by ssh agent-os for in-guest commands on port 22. Example: 100.109.125.128. |
bytestash | bytestash_api_key | BYTESTASH_API_KEY | API Key | yes | plugins/bytestash/scripts/setup.sh | Optional ByteStash API key for public/read-only endpoints. Snippet writes still require JWT on current ByteStash. |
bytestash | bytestash_password | BYTESTASH_PASSWORD | Password | yes | plugins/bytestash/scripts/setup.sh | ByteStash password used by the hook to mint a JWT for snippet API calls. |
bytestash | bytestash_token | BYTESTASH_TOKEN | JWT Token | yes | plugins/bytestash/scripts/setup.sh | Optional pre-minted ByteStash JWT. Used when username/password are not configured. |
bytestash | bytestash_url | BYTESTASH_URL | ByteStash URL | no | plugins/bytestash/scripts/setup.sh | Base URL of the ByteStash instance, including scheme. Do not include a trailing slash. |
bytestash | bytestash_username | BYTESTASH_USERNAME | Username | no | plugins/bytestash/scripts/setup.sh | ByteStash username. Recommended because current ByteStash snippet CRUD requires a JWT session token. |
dozzle | dozzle_mcp_url | DOZZLE_MCP_URL | Dozzle MCP URL | no | plugins/dozzle/.mcp.json, plugins/dozzle/skills/dozzle/references/auth-mcp.md | Dozzle's native Streamable HTTP MCP endpoint. Enable Dozzle with DOZZLE_ENABLE_MCP=true or --enable-mcp, then point this at the reachable /api/mcp URL. Include any configured base path before /api/mcp. |
immich | immich_api_key | IMMICH_API_KEY | API Key | yes | plugins/immich/scripts/setup.sh | Immich API key for authenticated requests. |
immich | immich_url | IMMICH_URL | Immich URL | no | plugins/immich/scripts/setup.sh | Base URL of the Immich API, including scheme. Do not include a trailing slash. |
linkding | linkding_api_key | LINKDING_API_KEY | API Key | yes | plugins/linkding/scripts/setup.sh | Linkding API token used in the Authorization: Token header. |
linkding | linkding_url | LINKDING_URL | Linkding URL | no | plugins/linkding/scripts/setup.sh | Base URL of the Linkding instance, including scheme. Do not include a trailing slash. |
memos | memos_api_token | MEMOS_API_TOKEN | API Token | yes | plugins/memos/scripts/setup.sh | Memos API token used for authenticated API requests. |
memos | memos_url | MEMOS_URL | Memos URL | no | plugins/memos/scripts/setup.sh | Base URL of the Memos instance, including scheme. Do not include a trailing slash. |
navidrome | navidrome_password | NAVIDROME_PASSWORD | Password | yes | plugins/navidrome/scripts/setup.sh | Navidrome account password. Used only to derive the per-request Subsonic token = md5(password + salt); the raw password is never sent over the wire. Stored in secure OS storage, not settings.json. |
navidrome | navidrome_url | NAVIDROME_URL | Navidrome URL | no | plugins/navidrome/scripts/setup.sh | Base URL of your Navidrome server, including scheme and (if non-default) port. Example: https://music.example.com or http://localhost:4533. Do NOT include a trailing /rest path — the skill appends Subsonic endpoints. |
navidrome | navidrome_username | NAVIDROME_USERNAME | Username | no | plugins/navidrome/scripts/setup.sh | Navidrome account username used for Subsonic API authentication. |
neo4j | neo4j_db | NEO4J_DB | Database | no | plugins/neo4j/scripts/setup.sh | Neo4j database name for transactional API calls. |
neo4j | neo4j_http_url | NEO4J_HTTP_URL | HTTP URL | no | plugins/neo4j/scripts/setup.sh | Neo4j HTTP transactional API base URL, usually http://host:7474. Recommended for curl-based workflows. |
neo4j | neo4j_password | NEO4J_PASSWORD | Password | yes | plugins/neo4j/scripts/setup.sh | Neo4j password used for HTTP Basic authentication and cypher-shell. |
neo4j | neo4j_url | NEO4J_URL | Bolt URL | no | plugins/neo4j/scripts/setup.sh | Optional Neo4j Bolt URL, usually bolt://host:7687. Used by cypher-shell and as a fallback to derive the default HTTP URL. |
neo4j | neo4j_user | NEO4J_USER | Username | no | plugins/neo4j/scripts/setup.sh | Neo4j username used for HTTP Basic authentication and cypher-shell. |
qdrant | qdrant_api_key | QDRANT_API_KEY | API Key | yes | plugins/qdrant/scripts/setup.sh | Optional Qdrant API key. Leave blank for unauthenticated local deployments. |
qdrant | qdrant_url | QDRANT_URL | Qdrant URL | no | plugins/qdrant/scripts/setup.sh | Base URL of the Qdrant REST API, including scheme and port. Do not include a trailing slash. |
radicale | radicale_password | RADICALE_PASSWORD | Password | yes | plugins/radicale/scripts/setup.sh | Radicale password. |
radicale | radicale_url | RADICALE_URL | Radicale URL | no | plugins/radicale/scripts/setup.sh | Base URL of the Radicale CalDAV/CardDAV server, including scheme. |
radicale | radicale_username | RADICALE_USERNAME | Username | no | plugins/radicale/scripts/setup.sh | Radicale username. |
scrutiny | scrutiny_url | SCRUTINY_URL | Scrutiny URL | no | plugins/scrutiny/scripts/setup.sh | Base URL of the Scrutiny web UI/API, including scheme. Do not include a trailing /api path. |
swag | swag_mcp_token | SWAG_MCP_TOKEN | Remote SWAG MCP bearer token | yes | plugins/swag/.mcp.json | Optional bearer token for the remote swag-mcp endpoint. |
swag | swag_mcp_url | SWAG_MCP_URL | Remote SWAG MCP URL | no | plugins/swag/.mcp.json | Optional remote Streamable HTTP MCP endpoint for swag-mcp, used by the swag-mcp-remote server entry. |
swag | swag_proxy_confs_path | SWAG_PROXY_CONFS_PATH | SWAG proxy configs path | no | plugins/swag/.mcp.json | Local filesystem path to the SWAG nginx proxy-confs directory. Leave empty when using an SSH URI instead. |
swag | swag_proxy_confs_uri | SWAG_PROXY_CONFS_URI | SWAG proxy configs SSH URI | no | plugins/swag/.mcp.json | Optional SSH URI for the remote SWAG proxy-confs directory, such as user@host:/mnt/appdata/swag/nginx/proxy-confs. Takes precedence over the local path when set. |
tei | tei_auth_header | TEI_AUTH_HEADER | Auth Header | yes | plugins/tei/scripts/setup.sh | Optional full HTTP auth header for protected deployments, for example: Authorization: Bearer |
tei | tei_url | TEI_URL | TEI URL | no | plugins/tei/scripts/setup.sh | Base URL of the Text Embeddings Inference server, including scheme and port. Do not include a trailing slash. |
uptime-kuma | uptime_kuma_metrics_api_key | UPTIME_KUMA_METRICS_API_KEY | Metrics API key | yes | plugins/uptime-kuma/scripts/setup.sh | Uptime Kuma API key used to read the Prometheus /metrics endpoint via HTTP Basic auth (username blank, key as password). Create one under Settings → API Keys in the Uptime Kuma UI. Stored in secure OS storage, not settings.json. |
uptime-kuma | uptime_kuma_status_slug | UPTIME_KUMA_STATUS_SLUG | Status page slug | no | plugins/uptime-kuma/scripts/setup.sh | Optional slug of a published status page (the part after /status/ in its URL). Enables reading public status + heartbeat JSON without auth. Leave empty if you only use /metrics. |
uptime-kuma | uptime_kuma_url | UPTIME_KUMA_URL | Uptime Kuma URL | no | plugins/uptime-kuma/scripts/setup.sh | Base URL of your Uptime Kuma instance, including scheme and (if non-default) port. Example: https://status.example.com or http://localhost:3001. No trailing slash needed. |
vibin | paperless_api_token | PAPERLESS_API_TOKEN | Paperless API Token | yes | plugins/vibin/scripts/setup-paperless.sh | Paperless-ngx API token used in the Authorization: Token header. |
vibin | paperless_url | PAPERLESS_URL | Paperless URL | no | plugins/vibin/scripts/setup-paperless.sh | Base URL of the Paperless-ngx instance, including scheme. Do not include a trailing slash. |
vibin | swag_container_name | SWAG_CONTAINER_NAME | SWAG container name | no | plugins/vibin/scripts/setup-swag.sh | Container name used for nginx validation and logs. |
vibin | swag_default_auth_method | SWAG_DEFAULT_AUTH_METHOD | SWAG default auth method | no | plugins/vibin/scripts/setup-swag.sh | Default auth include set for new configs, such as authelia, authentik, tinyauth, ldap, or none. |
vibin | swag_default_enable_quic | SWAG_DEFAULT_ENABLE_QUIC | SWAG default QUIC setting | no | plugins/vibin/scripts/setup-swag.sh | Default QUIC/HTTP3 setting for new configs. |
vibin | swag_default_upstream_proto | SWAG_DEFAULT_UPSTREAM_PROTO | SWAG default upstream protocol | no | plugins/vibin/scripts/setup-swag.sh | Default upstream protocol for new configs. |
vibin | swag_edge_host | SWAG_EDGE_HOST | SWAG edge SSH host | no | plugins/vibin/scripts/setup-swag.sh | SSH host that owns the SWAG appdata/config directory. |
vibin | swag_proxy_confs_path | SWAG_PROXY_CONFS_PATH | SWAG proxy-confs path | no | plugins/vibin/scripts/setup-swag.sh | Host path to the SWAG nginx/proxy-confs directory. |
vibin | swag_public_base_domain | SWAG_PUBLIC_BASE_DOMAIN | SWAG public base domain | no | plugins/vibin/scripts/setup-swag.sh | Base domain used for generated subdomains, such as example.com. |
vibin | swag_reload_wait_seconds | SWAG_RELOAD_WAIT_SECONDS | SWAG reload wait seconds | no | plugins/vibin/scripts/setup-swag.sh | Seconds to wait for SWAG filewatch reload before health checks. |
zsnoop-mcp | zsnoop_config | ZSNOOP_CONFIG | Zsnoop Config | no | plugins/zsnoop-mcp/.mcp.json | Optional path to hosts.toml. If unset, zsnoop-mcp uses $XDG_CONFIG_HOME/zsnoop-mcp/hosts.toml or ~/.config/zsnoop-mcp/hosts.toml. |
zsnoop-mcp | zsnoop_log_level | ZSNOOP_LOG_LEVEL | Zsnoop Log Level | no | plugins/zsnoop-mcp/.mcp.json | Optional zsnoop-mcp stderr log level: DEBUG, INFO, WARNING, or ERROR. |