The configuration file

All configuration is done in one YAML file, eurion-config.yml. The template eurion-config.example.yml ships with the kit. This page goes through the template section by section.

The Default column shows what applies if the key is missing from your file. The template sometimes has a different value filled in; that is shown in the In template column when it differs.

Keys not used in 1.6.4

The template contains some keys that the installation in version 1.6.4 does not read. They are marked not used below. Changing them has no effect.

Deployment

Key	Default	What it does
deploy_mode	docker	Installation method. Use docker. The other values (kubernetes, airgapped) are not covered by this documentation.
eurion_version	latest	The version to install. Must be the version number in the installation file, for example "1.6.4". Updates write the new version in themselves.

organization

Key	Default	What it does
organization.name	Eurion	The organisation's name. The first organisation is created with this name.
organization.domain	localhost	Your domain. Every address is built from it: app.<domain>, api.<domain> and so on.
organization.admin_email	admin@<domain>	E-mail for the first administrator account (super administrator). Also used as the contact for Let's Encrypt and as the recipient of alerts unless something else is set.
organization.country_code	SE	Country code (ISO 3166-1 alpha-2).

server

Key	Default	What it does
server.host	127.0.0.1	The server's own IP address (the private one if the server is behind NAT). The TURN server relays traffic through it. Give an IP address, not a host name.
server.public_ip	same as server.host	The public IP address. The meeting server and the TURN server announce it to clients.
server.private_ip	–	Not used. The private address is taken from server.host.
server.ssh_user, ssh_port, ssh_key, sudo	–	Not used. The installation runs locally on the server.

routing

Key	Default	What it does
routing	multi	multi: one name per part (app., api., admin., meet., office., turn. under your domain). single: everything on the name in hostname.
hostname	–	Only with routing: single. The single name, for example eurion.example.se. The app is at /, the API at /api and /v1, the admin portal at /admin, document editing at /office, Grafana at /grafana and TURN on the same name, port 3478.
mail.hostname	–	Only with routing: single and features.mail. The mail server's own name, for example mail.example.se. Webmail (mail.webmail) is not available with a single name.

subdomains

Only applies to routing: multi.

Key	Default	What it does
subdomains.app	app	The app's name: app.<domain>.
subdomains.api	api	The API's name.
subdomains.admin	admin	The admin portal's name.
subdomains.meet	meet	The meetings name.
subdomains.mail	–	Not used.
subdomains.office	office	Not in the template. The name for document editing.
subdomains.grafana	grafana	Not in the template. Only used with monitoring.grafana_public: true.

WARNING

Keep app, api and admin. The admin portal and sign-in rely on those names.

tls

Key	Default	In template	What it does
tls.method	selfsigned	letsencrypt	letsencrypt: Traefik obtains and renews certificates automatically (HTTP validation on port 80). selfsigned: a self-signed certificate is created, and browsers show a warning.
tls.acme_email	organization.admin_email		Contact address for Let's Encrypt.
tls.resolver	letsencrypt		The name of Traefik's certificate resolver. Do not change.
tls.cert_path, tls.key_path	–		Not used. Your own certificates (method: custom) cannot be set through the configuration file in 1.6.4.

Don't forget tls.method

If the key is missing, the certificate is self-signed. Use letsencrypt for a real installation.

features

Key	Default	In template	What it does
features.video	true		Audio and video calls (meeting server and TURN server). Requires turn.<domain> and the ports for calls.
features.ai	false	true	AI meeting minutes and summaries with a local language model (Ollama). Needs a lot of RAM, see requirements.
features.transcription	false		Call transcription (Whisper).
features.bridge	false		Starts the bridge service to Microsoft 365/Teams. Not covered by this documentation.
features.search	true		Full-text search (Meilisearch).
features.monitoring	true		Prometheus, Grafana and Loki, see Monitoring.
features.mail	false		Integrated mail server. Not covered by this documentation; contact support before you switch it on.
features.coturn	–	true	Not used. The TURN server follows features.video.
features.virus_scan	true		ClamAV scans every uploaded file (about 1.5 GB RAM). Switched off: files are served without virus scanning.
features.office	false		Edit Office documents in the browser (Collabora, 1–2 GB RAM). Requires office.<domain>.

sizing

Key	Default	What it does
sizing.profile	–	Not used. The values below apply regardless of profile.
sizing.pg_shared_buffers	256MB	PostgreSQL shared_buffers.
sizing.pg_max_connections	200	PostgreSQL max_connections.
sizing.pg_work_mem	16MB	PostgreSQL work_mem.
sizing.pg_effective_cache_size	1GB	Not in the template. PostgreSQL effective_cache_size.
sizing.redis_maxmemory	128mb	Redis memory limit.
sizing.kafka_heap	256m	Kafka's Java heap.
sizing.pgbouncer_pool_size	20	Fallback value for database.pool_size.
sizing.pgbouncer_max_clients	500	Fallback value for database.max_clients.

The template's commented-out examples (512MB, 32MB, 256mb, 512m) suit a server with 16 GB RAM.

Optional tuning

These sections are commented out in the template. Everything has working defaults.

cors

Key	Default	What it does
cors.extra_origins	[]	More origins allowed to call the API, in addition to https://app., https://admin. and https://meet.<domain>. The desktop app needs http://tauri.localhost and https://tauri.localhost.

storage

Key	Default	What it does
storage.s3_region	eu-west-1	The region name the services use towards the local MinIO storage.
storage.preview_bucket	eurion-previews	Bucket for document previews.

identity

Key	Default	What it does
identity.registration_open	false	true lets anyone create an account in the app.
identity.registration_allowed_domains	[]	E-mail domains that may create accounts themselves, for example ["example.se"]. If the list is filled in, it applies even when registration_open is false.
identity.jwt_access_expiry	15m	How long an access token is valid.
identity.jwt_refresh_expiry	7d	How long a session can be renewed without signing in again.

ai

Applies when features.ai is on.

Key	Default	What it does
ai.ollama	container	container: Ollama runs in a container. host: Ollama is installed on the server (port 11434). A URL: Ollama on another machine, for example http://10.0.0.5:11434.
ai.models	["mistral:7b-instruct", "nomic-embed-text"]	Models downloaded after the installation (only with ollama: container).
ai.model	mistral:7b-instruct	The model for summaries.
ai.minutes_model	empty	A larger model used only for meeting minutes, for example mistral-small3.2. Empty: ai.model is used. Add it to ai.models as well.
ai.num_ctx	8192	Context length for the model.

transcription

Applies when features.transcription is on.

Key	Default	What it does
transcription.whisper	container	container, host (Whisper server on the server, port 9300) or a URL.
transcription.model	ggml-small.bin	Model file in /opt/eurion/data/whisper-models.
transcription.model_url	The Hugging Face address of ggml-small.bin	Where the model is downloaded from if the file is missing.
transcription.vad_model, vad_model_url	empty	Optional voice activity model, which removes silence before transcription.
transcription.threads	4	CPU threads for Whisper.
transcription.language	auto	Language, for example sv or en. auto guesses.

database

Key	Default	What it does
database.pgbouncer	false	Puts PgBouncer (connection pool) in front of PostgreSQL for every service except the gateway. Recommended from about 150 users.
database.pool_size	20	PgBouncer's pool size.
database.max_clients	500	Maximum number of client connections to PgBouncer.
database.max_db_connections	50	Maximum number of connections from PgBouncer to PostgreSQL.
database.pool	{}	Connection pool per service, for example { messaging-service: { max: 20, min: 4 } }.
database.postgres_settings	{}	Extra PostgreSQL settings, for example { statement_timeout: 30000 }.
database.shm_size	empty	Shared memory for the PostgreSQL container, for example 512mb.

resources

Memory and CPU limit per container, for example:

resources:
  gateway: { memory: 2g, cpus: 4 }
  collabora: { memory: 8g, cpus: 8 }
  ollama: { memory: 48g, cpus: 16 }

The names are the service names: gateway, identity-service, messaging-service and the other services, plus postgres, redis, kafka, pgbouncer, gotenberg, ollama, whisper, collabora and clamav. Collabora and ClamAV have a 4 GB limit by default. Without limits a single container can take all the memory. The high-memory alert only applies to containers that have a limit.

service_env

Extra environment variables (not secret) per service. They take precedence over the kit's own values. Only use this if Eurion support asks you to.

service_env:
  gateway: { CLUSTER_WORKERS: "4" }

mail

Only applies to features.mail, which is not covered here (impersonator_user, webmail, mailgun_inbound, mailgun, timezone).

monitoring

Applies when features.monitoring is on. See Monitoring and alerts.

Key	Default	What it does
monitoring.alerting	true	Alertmanager, exporters, health checks and alert rules.
monitoring.alert_email	organization.admin_email	Where alerts are sent. Requires smtp to be filled in.
monitoring.grafana_public	false	true: Grafana also at grafana.<domain>. Grafana is always available at admin.<domain>/grafana.

credentials

Not used. In 1.6.4 all passwords and keys are always generated by gen-config.py and stored in /opt/eurion/deploy/generated/group_vars/secrets.yml (readable by root only). This includes initial_admin_password. Values you write here are ignored.

The passwords are kept when the script runs again and during updates. Get a password like this:

sudo grep -E '^(initial_admin_password|grafana_password):' /opt/eurion/deploy/generated/group_vars/secrets.yml

smtp

Outgoing e-mail for invitations, password resets, calendar invitations, notifications and alerts. See Outgoing e-mail.

Key	Default	What it does
smtp.host	empty	SMTP server. Empty: no e-mail is sent.
smtp.port	587	Port.
smtp.secure	false	Not in the template. false: STARTTLS (port 587). true: TLS straight away (port 465).
smtp.user	empty	User name.
smtp.password	empty	Password. Stored in secrets.yml; if you remove it from the configuration file, the stored one is kept.
smtp.from	empty	Sender, for example Eurion <no-reply@example.se>. Always fill it in.

updates

See Updates.

Key	Default	What it does
updates.channel_url	https://updates.eurion.se/stable/	Where the server looks for signed versions. "": the server is offline and updates are uploaded as a file.
updates.auto_check	true	Look for new versions automatically.
updates.check_interval_hours	24	How often, in hours.

backup

Not used in 1.6.4: enabled, schedule, retention_days, s3_upload, s3_bucket and s3_endpoint. Backups are always taken every night at 02:00 and kept for 30 days, see Backups.

kubernetes

Only applies to deploy_mode: kubernetes, which is not covered by this documentation.

Changing the configuration after installation

After the installation, the copy in generated/ is the one that applies. It is also used for every update.

1. Edit the file:

   sudo nano /opt/eurion/deploy/generated/eurion-config.yml

2. Regenerate the settings (existing passwords are kept):

   cd /opt/eurion/deploy
   sudo python3 scripts/gen-config.py generated/eurion-config.yml generated

3. Run the kit again:

   sudo ansible-playbook -i generated/inventory/hosts.yml ansible/site.yml \
     -e @generated/group_vars/all.yml -e @generated/group_vars/secrets.yml

Containers whose settings changed are restarted. Expect a short interruption.

Switch on a feature at the next update

If you only change generated/eurion-config.yml and do not run steps 2–3, the change takes effect at the next update.