Configuration

Krywerk Server

The server reads an optional TOML file (--config <file> or KRYWERK_SERVER_CONFIG); environment variables override it. The server refuses unknown options at startup, and invalid values as well – with a message saying which option is wrong. To check without starting: krywerk-server check.

# krywerk-server.toml – example with the most important options
listen = "127.0.0.1:8380"
public_url = "https://schluessel.example.org"
db_path = "/var/lib/krywerk/krywerk-server.sqlite3"
trust_proxy = true

[oidc]
issuer = "https://login.example.org/realms/krywerk"
client_id = "cryptomator"

[web]
enabled = true
client_id = "krywerk-verwaltung"
client_secret_file = "/run/secrets/krywerk-verwaltung"

[audit]
retention_days = 365
record_ip = false

All options

TOML	Environment variable	Default	Meaning
listen	KRYWERK_SERVER_LISTEN	127.0.0.1:8380	Address and port
public_url	KRYWERK_SERVER_PUBLIC_URL	http://localhost:8380	Public base URL without /api (pages, hub header of new vaults)
db_path	KRYWERK_SERVER_DB	krywerk-server.sqlite3	SQLite file (schema version in PRAGMA user_version)
trust_proxy	KRYWERK_SERVER_TRUST_PROXY	false	Use X-Forwarded-For as the client IP
source_url	KRYWERK_SERVER_SOURCE_URL	https://github.com/mzilinski/krywerk	"Source code" link in the web administration (AGPL § 13); point it to your own source code if you made changes
–	KRYWERK_SERVER_QUIET	off	Turn off the access log on the console
–	KRYWERK_SERVER_LOG	info	Log level or filter (syntax like RUST_LOG), e.g. warn or info,kw_server::access=off
–	KRYWERK_SERVER_LOG_FORMAT	text	json: one JSON line per event (time, level, message, fields such as method, path, status, ms) for Loki, Elasticsearch & co.
oidc.issuer	KRYWERK_SERVER_OIDC_ISSUER	– (required)	Issuer exactly as in the iss of the tokens
oidc.internal_url	KRYWERK_SERVER_OIDC_INTERNAL_URL	–	Internal URL for discovery/JWKS (replaces the issuer prefix when fetching)
oidc.client_id	KRYWERK_SERVER_OIDC_CLIENT_ID	cryptomator	Client ID of the apps (public client, PKCE S256, redirect http://127.0.0.1/*)
oidc.auth_endpoint / oidc.token_endpoint	KRYWERK_SERVER_OIDC_AUTH_ENDPOINT / …_TOKEN_ENDPOINT	from discovery	Public endpoints for /api/config
oidc.audience	KRYWERK_SERVER_OIDC_AUDIENCE	–	Required aud; if not set, the server checks azp/appid instead (stricter than the reference Hub)
oidc.allowed_clients	KRYWERK_SERVER_OIDC_ALLOWED_CLIENTS	–	Additional clients (comma-separated list) besides client_id whose access tokens the API accepts; ID tokens are always rejected
oidc.roles_claim	KRYWERK_SERVER_ROLES_CLAIM	realm_access.roles	Path of the roles claim (Entra ID: roles)
oidc.user_role	KRYWERK_SERVER_ROLE_USER	user	Role for all endpoints; empty = any valid token
oidc.create_vaults_role	KRYWERK_SERVER_ROLE_CREATE_VAULTS	create-vaults	Role for creating vaults
oidc.admin_role	KRYWERK_SERVER_ROLE_ADMIN	admin	Administration role
oidc.groups_claim	KRYWERK_SERVER_GROUPS_CLAIM	groups	Path of the groups claim (dot-separated); empty = no groups from tokens
oidc.groups_strip_slash	KRYWERK_SERVER_GROUPS_STRIP_SLASH	true	Drop a leading "/" from group names
oidc.groups_nested	KRYWERK_SERVER_GROUPS_NESTED	true	Create paths /a/b as nested groups
rate_limit.api_per_minute	KRYWERK_SERVER_RATE_LIMIT_API	6000	Requests to /api per minute and client IP (up to half of them in a burst), then 429; 0 = off. Generous because of NAT in schools
rate_limit.login_per_minute	KRYWERK_SERVER_RATE_LIMIT_LOGIN	10	Sign-ins to the web administration per minute and client IP; 0 = off
emergency.min_required_shares	KRYWERK_SERVER_EMERGENCY_MIN_SHARES	2	Minimum threshold k of the emergency council (values < 2 count as 2, at most 32)
emergency.process_max_age_days	KRYWERK_SERVER_EMERGENCY_MAX_AGE_DAYS	14	Open emergency requests expire after this (EXPIRED)
web.enabled	KRYWERK_SERVER_WEB	false	Web administration at /verwaltung (Web administration)
web.client_id	KRYWERK_SERVER_WEB_CLIENT_ID	krywerk-verwaltung	Separate client (code + PKCE, redirect <public_url>/verwaltung/anmeldung)
web.client_secret_file	KRYWERK_SERVER_WEB_CLIENT_SECRET_FILE / KRYWERK_SERVER_WEB_CLIENT_SECRET	–	Only for a confidential client; never put the secret itself in the TOML file
web.session_hours / web.idle_minutes	KRYWERK_SERVER_WEB_SESSION_HOURS / …_IDLE_MINUTES	8 / 30	Maximum duration and idle time of a session
web.admin_manage_all	KRYWERK_SERVER_WEB_ADMIN_MANAGE_ALL	true	IT administration may change all team folders (otherwise only view them)
audit.retention_days	KRYWERK_SERVER_AUDIT_RETENTION_DAYS	365	Keep the audit log (krywerk_event) this long; 0 = never delete
audit.record_ip	KRYWERK_SERVER_AUDIT_RECORD_IP	false	Write IP addresses to the audit log
wot.max_depth	KRYWERK_SERVER_WOT_MAX_DEPTH	3	Web of trust: at most this many additional links in a chain of trust (0 = direct confirmations only), 0–9
wot.id_verify_len	KRYWERK_SERVER_WOT_ID_VERIFY_LEN	2	Web of trust: this many characters of the fingerprint must be typed in when verifying an identity, 0–64 (Krywerk apps require at least 8 regardless)

Secrets (only the client secret of the web administration) belong in a file (web.client_secret_file) or in KRYWERK_SERVER_WEB_CLIENT_SECRET, never in the TOML file in the repository.

Desktop app

The app is set up through its interface (Settings › General, Organization account, Boxcryptor (legacy)). It stores everything in config.json (location: see Backup); you don't need to edit the file by hand.

Field in config.json	Setting in the app	Default
version	– (file format)	1
language	General › Sprache / Language: auto (system language: German for de*, otherwise English), de, en	auto
vaults	List of drives with folder, name, format, drive letter, mount automatically	empty
hubServer	Settings › Organization account › Key server address	empty
teamFolders	Team folder locations found on this device	empty
autostart	General › Start automatically when signing in to the computer	off
cache	General › Advanced › Use cache	on
keyfile	Boxcryptor (legacy) › Key file	–
rememberPassword	Boxcryptor (legacy) › Remember password	off
encryptNames	Boxcryptor (legacy) › Encrypt file names of new files	on
contextMenu	Boxcryptor (legacy) › Context menu in Explorer/Finder/file manager	on

Environment variables (desktop app and command line)

Variable	Effect
KRYWERK_CONFIG_DIR	Different folder for settings and log – a separate, independent instance (tests, second profile)
KRYWERK_SYNC_ROOTS	Folders (separated like PATH) in which "Find folder …" searches for team folders; replaces the automatically detected sync folders (OneDrive, Nextcloud, Dropbox …)
KRYWERK_LANG	Language of the desktop app (takes precedence over the setting, which is then disabled in the app) and of krywerk-hub, krywerk-mount and krywerk-recover: de or en; if unset, the tools use German when LC_ALL, LC_MESSAGES or LANG (the first one set) starts with de, otherwise English
KRYWERK_PASSWORD	Password for krywerk-mount/krywerk-recover (vault or Boxcryptor account) instead of hidden input
KRYWERK_VAULT_PASSWORD	Password of the new vault with krywerk-mount --upgrade-to
KRYWERK_HUB_SETUP_CODE	Unlock code for krywerk-hub/krywerk-mount instead of hidden input
KRYWERK_RECOVERY_KEY	Recovery key for krywerk-mount --recovery-key instead of hidden input
WEBKIT_DISABLE_DMABUF_RENDERER	Linux: Krywerk sets 1 if not specified (prevents crashes with NVIDIA under Wayland)
KRYWERK_MOUNT_STATS=1	Runtime statistics of drive operations every 5 s on stderr (without names or contents)

Never pass passwords as command-line arguments – they would show up in the process list and in the shell history.

App log

System	File
Windows	%APPDATA%\Krywerk\log.txt
macOS	~/Library/Logs/Krywerk/log.txt
Linux	~/.local/state/Krywerk/log.txt (or $XDG_STATE_HOME/Krywerk)

The log contains error messages but no passwords, keys or file contents. It starts over after 1 MB. When started from a terminal, the app writes there instead.