Configuration

Nexo Share is configured through the web interface and environment variables.

Setup Wizard (First Time)

On first login, the setup wizard guides you through:

  1. Branding: Application name, website domain: (sub)domain or ip/localhost
  2. SMTP: Email server configuration
  3. Admin Account: Create your first admin user

You can re-run the wizard from Settings → General → Restart Setup.

The default credentials are: Email: [email protected] Password: admin123 Change these immediately after first login.

Environment Variables

Configure in docker-compose.yml before starting:

Required

DB_PASSWORD: "your-secure-password"  # Database password
JWT_SECRET: "your-64-char-hex-secret" # Session token secret

Application

PORT: "3000"                    # Internal port (don't change unless needed)
NODE_ENV: "production"          # Always "production" for Docker
UPLOAD_DIR: "/app/backend/uploads"  # Internal path (don't change)

Security

ALLOWED_ORIGINS: "https://share.company.com,https://share.company.nl"
RP_ID: "share.company.com"      # Domain for passkeys (no https://)
ORIGIN: "https://share.company.com"  # Full URL with protocol

Note: ALLOWED_ORIGINS can be comma-separated for multiple domains.

Localization

TZ: "Europe/Amsterdam"          # Server timezone
APP_LOCALE: "nl-NL"            # UI language (en-GB, nl-NL, de-DE, etc.)

Web Interface Settings

Access via Settings tab (admin only).

General Settings

  • Application Name: Shown in emails and UI
  • App URL: Public domain (e.g., https://share.company.com)
  • Logo/Favicon: Upload custom branding images (max 5MB)

System Limits

  • Max File Size: Per-upload limit (default: 10 GB)
  • Chunk Size: Upload chunk size (default: 50 MB, affects Cloudflare compatibility).

    [!TIP] While the technical limit is 100 MB (especially for Cloudflare), choosing a very large chunk size can actually slow down the upload due to processing overhead. A size of 25-50 MB is usually optimal for a balance between speed and reliability.

  • Share ID Length: Random ID length (8-32 characters, default: 12)
  • Default Expiration: New shares expire after (default: 1 week)
  • Max Expiration: Users cannot exceed this (0 = unlimited)

Security

  • Secure Cookies: Enable if using HTTPS (required for production)
  • Session Duration: How long users stay logged in (default: 7 days)
  • Require 2FA: Force all users to enable two-factor authentication
  • Allow Passkeys: Enable biometric/hardware key login
  • Allow Password Reset: Enable email-based password recovery
  • Enforce Virus Scan: Reject uploads if ClamAV is offline (fail-closed security)
  • File Type Restrictions: Block specific file extensions for users and guests

Compression

  • ZIP Compression Level: 0-9 (5 = balanced, 9 = maximum compression)
  • No Compression for Media: Don’t compress images/videos (saves CPU)

SMTP (Email)

Required for notifications and password resets. Note: Enable “Allow Local/Private IP addresses” if your mail server is on a private network (e.g., Exchange on-premise).

Example: Office 365

Host: smtp.office365.com
Port: 587
Secure: false
STARTTLS: true
Username: [email protected]
Password: your-app-password
From: [email protected]

Example: Gmail

Host: smtp.gmail.com
Port: 587
Secure: false
STARTTLS: true
Username: [email protected]
Password: app-specific-password
From: [email protected]

Testing: Use the Test Connection button to verify settings before saving.

SSO (Single Sign-On)

Nexo Share supports OIDC providers (Authentik, Keycloak, Okta, etc.).

Configuration:

1. Create OIDC application in your provider

2. Set callback URL: https://your-domain.com/api/auth/callback

3. Enter Issuer URL, Client ID, and Client Secret

4. Enable Auto-Redirect to skip login form (optional)

5. Logout URL: If your provider has a custom logout endpoint, enter it here. (optional)

User Management

Admins can manage users from Settings → Users:

  • Create new users (manual or via SSO auto-provisioning)
  • Reset user passwords
  • Force 2FA reset if user loses access
  • Grant/revoke admin privileges
  • Delete user accounts (also deletes their shares)

Password Requirements:

  • Minimum 8 characters
  • At least 1 uppercase letter
  • At least 1 lowercase letter
  • At least 1 number

Applying Changes

Most settings take effect immediately. Changes requiring restart:

  • Environment variables (requires docker compose restart)
  • Port mappings (requires docker compose up -d)

Backup Configuration

Your configuration is stored in the PostgreSQL database. To backup:

docker compose exec postgres pg_dump -U nexoshare nexoshare > backup.sql

See Backup & Restore section for complete instructions.