Environment Variables

Memos maps runtime flags to environment variables with the MEMOS_ prefix. In production, environment variables are usually the cleanest way to keep deployment config explicit and repeatable.

Reference

All flags and their corresponding environment variables:

Data directory defaults

MEMOS_DATA resolves automatically when not set:

• Windows: %ProgramData%\memos
• Docker: /var/opt/memos (when writable)
• Linux / macOS: current directory (.)

DSN defaults

When MEMOS_DRIVER=sqlite and MEMOS_DSN is empty, the database file defaults to {MEMOS_DATA}/memos_prod.db. For MySQL and PostgreSQL, MEMOS_DSN is required.

Public and private mode

In Memos 0.31, access is controlled by the ACCESS instance setting, through accessSetting.accessMode:

• INSTANCE_ACCESS_MODE_PRIVATE: anonymous visitors are sent to sign-in; anonymous API access is limited to endpoints such as setup, authentication, registration when allowed, and explicit shared memos.
• INSTANCE_ACCESS_MODE_PUBLIC: eligible public memos, profiles, and Explore can be read anonymously.

Configure access in instance settings or with a deployment-managed JSON file. It is not a runtime flag or environment variable.

MEMOS_INSTANCE_URL supplies the canonical external address, including for a private instance behind a proxy. It must be an absolute HTTP(S) URL without credentials, a query, or a fragment, such as https://memos.example.com.

When the access setting is first initialized, Memos preserves the earlier behavior: a configured URL initializes public access; an empty URL initializes private access. Once the setting exists, changing the URL never changes the access policy. See Upgrading to 0.31.

Priority order

1. Command-line flags (highest)
2. Environment variables
3. Default values (lowest)

An explicit flag always wins over the environment variable for the same setting.

Practical guidance

• select private or public access explicitly in the ACCESS instance setting
• set MEMOS_INSTANCE_URL to the canonical external URL when the app sits behind a proxy
• prefer explicit MEMOS_DRIVER and MEMOS_DSN when you are not using SQLite defaults
• allow only required private webhook destinations with MEMOS_WEBHOOK_PRIVATE_NETWORK_ALLOWLIST; leave the deprecated blanket option disabled
• keep secrets such as database credentials outside committed compose files
• treat these values as part of deployment config and back them up accordingly

Common patterns

SQLite with explicit data directory:

export MEMOS_DRIVER=sqlite
export MEMOS_DATA=/var/opt/memos
./memos

External PostgreSQL:

export MEMOS_DRIVER=postgres
export MEMOS_DSN="postgres://user:password@db:5432/memos?sslmode=disable"
export MEMOS_INSTANCE_URL=https://memos.example.com
./memos

Unix socket with Nginx (useful for local reverse proxy):

export MEMOS_UNIX_SOCK=/var/run/memos.sock
export MEMOS_DATA=/var/lib/memos
export MEMOS_INSTANCE_URL=https://memos.example.com
./memos

Nginx upstream for the socket:

upstream memos {
    server unix:/var/run/memos.sock;
}