Configuration

Presswerk is configured via environment variables in the .env file.

Core

Variable	Required	Default	Description
`APP_DOMAIN`	Yes	—	Public domain for the application
`APP_VERSION`	No	`latest`	Docker image tag
`APP_PORT`	No	`8080`	Host port for the application
`DOCKER_REGISTRY`	No	`ghcr.io/fs2-software`	Docker image registry (for private mirrors)

Database

Variable	Required	Default	Description
`DB_PASSWORD`	Yes	—	PostgreSQL password
`DB_USER`	No	`presswerk`	PostgreSQL username
`DB_NAME`	No	`presswerk`	PostgreSQL database name

Keycloak

Variable	Required	Default	Description
`KEYCLOAK_HOSTNAME`	Yes	—	Public domain for Keycloak (e.g. `auth-reports.acme.com`)
`KEYCLOAK_PUBLIC_URL`	Yes	—	Full public URL (e.g. `https://auth-reports.acme.com`)
`KEYCLOAK_ADMIN_PASSWORD`	Yes	—	Keycloak admin console password
`KEYCLOAK_ADMIN_USER`	No	`admin`	Keycloak admin username
`KEYCLOAK_PORT`	No	`8081`	Host port for Keycloak

Initial Admin

The installer sets these automatically. They are only used on first startup to create the initial admin user.

Variable	Required	Default	Description
`INITIAL_ADMIN_EMAIL`	No	—	Email for the auto-provisioned admin user
`INITIAL_ADMIN_PASSWORD`	No	—	Temporary password (user must change on first login)

SMTP

Email is required for scheduled report delivery.

Variable	Required	Default	Description
`SMTP_HOST`	No	—	SMTP server hostname
`SMTP_PORT`	No	`587`	SMTP port (587 for STARTTLS)
`SMTP_USERNAME`	No	—	SMTP authentication username
`SMTP_PASSWORD`	No	—	SMTP authentication password
`SMTP_FROM`	No	`noreply@presswerk.app`	Sender email address

Tested Providers

Provider	Host	Port	Notes
Resend	`smtp.resend.com`	587	API key as password
Microsoft 365	`smtp.office365.com`	587	Requires app password or OAuth
Google Workspace	`smtp.gmail.com`	587	Requires app password
Custom	any	587	Any server supporting STARTTLS

Corporate Proxy

If Presswerk runs behind a corporate proxy and your data sources need to reach external APIs through it, configure the JVM proxy settings via JAVA_OPTS in your .env or docker-compose.yml:

app:
  environment:
    JAVA_OPTS: >-
      -Dhttps.proxyHost=proxy.corp.com
      -Dhttps.proxyPort=8080
      -Dhttp.proxyHost=proxy.corp.com
      -Dhttp.proxyPort=8080
      -Dhttp.nonProxyHosts=localhost|keycloak|postgres

This applies to all outbound HTTP connections: REST and GraphQL data sources, Keycloak admin calls, and health checks. Use http.nonProxyHosts to exclude internal services.

For authenticated proxies, add -Dhttps.proxyUser=user -Dhttps.proxyPassword=pass.

License

Without a license, Presswerk runs in the Free tier (1 user, 5 reports, 1 data source, no schedules).

Activation Methods

Via UI: Log in as admin → License in the sidebar → paste license key → Activate

Via API:

curl -X POST https://your-domain.com/api/license/activate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"licenseKey":"<your-license-key>"}'

The license key is stored in the database and persists across container restarts.

License Tiers

Without a license, Presswerk runs in the Free tier:

Limit	Free Tier
Users	1
Reports	5
Data Sources	1
Schedules	No
Groups	No
Environments	No

Paid licenses unlock higher limits and additional features. The exact limits are defined in the license key and depend on your Self-Hosted plan. After activation, the current limits and features are shown in Settings → License.

Keycloak Roles

Role	Description
`admin`	Tenant administrator — manages users, environments, permissions
(none)	Regular user — access controlled by folder permissions