Configuration

Most of DockPod's day-to-day configuration happens in the UI under Settings, not in a config file.

Data Directory Layout

Everything DockPod persists lives under --data-dir (default ./data):

data/
├── dockpod.db          # SQLite — users, deploy apps, build logs, audit log, etc.
├── repos/              # git clones for Git Deployment apps, one folder per app ID
├── ssh-keys/           # per-app Ed25519 deploy keys (0600 permissions)
├── paste/              # saved compose files + env files for Paste & Deploy and 1-Click Deploy
├── local-ca/           # self-generated CA cert+key for .test/.local custom domains (see Custom Domains)
└── traefik-dynamic/    # per-domain Traefik routing config + certs, generated as domains are added

Back up dockpod.db (and ssh-keys/ if you use private repos) to preserve your install's state — and back up the secrets encryption key described below, which lives outside this directory.

Secrets Encryption at Rest

Reversible secrets in dockpod.db — provisioned-database passwords, git-provider tokens, webhook secrets, TOTP secrets, the SMTP password, the JWT signing secret — are encrypted with AES-256-GCM. (Login passwords, API keys, and 2FA backup codes aren't here: those are one-way bcrypt hashes, never decrypted.)

The encryption key is managed for you, no configuration required:

• On first start DockPod generates a random key and writes it to /etc/dockpod/data.key (permissions 0600), then reuses it on every restart. If /etc/dockpod isn't writable (e.g. running as a non-root dev process), it falls back to <data-dir>/data.key and logs a warning.
• The key lives outside the data directory on purpose: a leaked data-dir backup then can't decrypt anything without the separately-stored key. That separation is the whole point — so for disaster recovery you must back up both the data directory and /etc/dockpod/data.key.
• Losing the key after secrets are encrypted makes them unrecoverable — there is no recovery path. Treat data.key as critically as the data itself.

Existing installs upgrade transparently: the key is generated on the first start after upgrading, and a one-time backfill encrypts any secrets that were previously stored in plaintext.

Honest scope: this protects against the database file (or a data-dir backup) leaking without the key. It does not protect against someone who already has root/host access (the running process must read the key), and the same database password is independently visible via docker inspect on the running database container. Secure the host and restrict access to /etc/dockpod and the data directory accordingly.

License

DockPod ships fully functional on the Free tier — no license required. To unlock Pro features (rollback, unlimited Git Deployment/database provisioning, Telegram/Slack/Discord notifications, scheduled tasks, multi-user), go to Settings → General → License and paste your license key. See Pricing for the full Free vs Pro breakdown.

Licenses are Ed25519-signed, verified offline (no phone-home required after activation), and locked to a specific machine — Settings → General → License shows this server's Machine ID; send it to whoever issues your license before it can be minted for this install.

Panel Domain

Settings → General → Domain lets you access the panel itself at a custom domain over HTTPS instead of http://server-ip:8080. It reuses the exact same shared Traefik instance and Let's Encrypt account as your deployed apps' domains — see Custom Domains for how certificate issuance works (real domain vs. local .test/.local vs. plain HTTP), the same logic applies here. The first save takes a few seconds while the reverse proxy restarts to pick up the new route; existing app domains keep working throughout.

The same screen has a separate MCP Domain field. Give MCP its own hostname, such as mcp.example.com, and DockPod creates an HTTPS endpoint at https://mcp.example.com/sse on the standard port 443. Traefik terminates TLS and forwards the long-lived connection to the dedicated MCP listener with response buffering disabled. The MCP and panel domains must be different hostnames.

The direct MCP listener is not removed or redirected when an MCP domain is configured. http://localhost:8090/sse remains available to clients running on the DockPod host, while http://server-ip:8090/sse remains the direct fallback for remote clients. Removing the MCP Domain only removes its Traefik HTTPS route. Prefer the HTTPS hostname across the public internet because direct HTTP sends the Bearer API key without transport encryption.

Both fields accept hostnames only — no http:// or https://, path, port, wildcard, underscore, raw IP address, or trailing dot. DockPod lowercases the hostname and rejects it if the same hostname is already assigned to the panel, MCP, a Git Deployment, Paste & Deploy, or 1-Click Deploy.

Profile — Password & Two-Factor Authentication

Click your username (top right) → Profile for account-level settings that apply to you specifically, not the whole install — unlike Settings, this page has no admin gate, so it's where a non-admin team member's own account settings will live too.

Change Password updates the password you sign in with — requires your current password, not just an active session.

Two-Factor Authentication adds a TOTP second factor (Google Authenticator, 1Password, Authy, etc.) to your login. It's per-user, opt-in, and not Pro-gated — available on a Free-tier single-admin install too. Enrolling shows a QR code to scan and, once you confirm a code from your app, 10 backup codes — save them somewhere safe, each is single-use and meant for when you lose access to your authenticator device. Once enabled, logging in becomes a two-step flow: password first, then the 6-digit code (or a backup code). Disabling requires re-entering your password, not just being logged in.

Environment Variables Summary

See Installation for the full flag/env-var table.