Configuration

Faxart is configured through a .env file read by Docker Compose. The guiding principle: every integration is off by default and becomes active only when its credentials are present. An unconfigured subsystem no-ops rather than erroring, so you can bring the stack up with almost nothing set and light features up one at a time.

The keys below use placeholder values. Replace them with your own; never commit real secrets.

Core

Key	Purpose
COMPOSE_PROJECT_NAME	Compose project namespace. Keep it unique per host.
POSTGRES_USER / POSTGRES_PASSWORD / POSTGRES_DB	Database credentials.
APP_DOMAIN / MARKETING_DOMAIN / DOCS_DOMAIN	Public hostnames for the app, marketing site, and docs.

Active Directory (read)

A single read-only service account resolves who owns which fax number.

Key	Purpose
AD_LDAP_URL	e.g. ldaps://dc.example.com:636
AD_BIND_DN	The read-only service account DN.
AD_BIND_PASSWORD	Its password (move to a secret at go-live).
AD_BASE_DN	Search base, e.g. DC=example,DC=com.

Leaving AD_BIND_PASSWORD empty makes the directory inert: the dialplan builder writes an empty include, so nothing errors and no numbers are answered.

Single sign-on (SAML)

Key	Purpose
SAML_IDP_METADATA_URL	Your identity provider’s metadata URL.
SAML_SP_ENTITY_ID / SAML_SP_ACS_URL / SAML_SP_SLS_URL	The service-provider URLs, derived from APP_DOMAIN.
SAML_ADMIN_GROUP	Group whose members are admins.
SAML_AUTO_APPROVER_GROUP	Group whose members may engage auto-mode.

Caution

The SP URLs must match exactly what your identity provider is told. If you change APP_DOMAIN, re-register the service provider with your IdP.

On-prem reading (GPU gateway)

OCR, classification, transcription, and rule evaluation run against an on-prem inference gateway. No page image ever leaves your network.

Key	Purpose
GPU_GATEWAY_URL	Your on-prem inference endpoint.
GPU_API_KEY	Bearer key. Empty means classification no-ops; faxes are held.
GPU_VISION_MODEL / GPU_TEXT_MODEL / GPU_TRANSCRIBE_MODEL	Model names.

Email

Key	Purpose
FAXART_SMTP_DOMAIN	Accept-domain for inbound email-to-fax.
FAXART_SMTP_ALLOWED_IPS	Source-IP allowlist for the intake. Set before exposing it.
FAXART_SMTP_RELAY_HOST / _PORT	Outbound relay for receipts and fax-to-email.
FAXART_EMAIL_INTERNAL_DOMAINS	Internal-only delivery; PHI does not leave the tenant.

MEDITECH filing

Key	Purpose
MEDITECH_SFTP_KEY	Path to the SFTP private key (a mounted secret).

Host, user, path, host key, and processing ID are set in the app’s MEDITECH settings, not the environment.

Auto-mode thresholds

Key	Purpose
AUTO_WINDOW	Size of the trailing decision window.
AUTO_N_MIN	Minimum samples before a rule can be eligible.
AUTO_AGREE_MIN	Minimum agreement rate with human reviewers.
AUTO_CLEAN_STREAK	Required clean recent streak.
AUTO_CONFIDENCE_FLOOR	Per-fax confidence floor for an auto-route.

Optional subsystems

Printing (SAMBA_PRINT_*), the LDAP directory (FAXART_LDAP_*), self-service DID provisioning (AD_WRITE_*), web push (VAPID_*), and archive search (GPU_EMBED_*) follow the same off-until-configured pattern.

See also

• Architecture
• Compose services