Configuration

All of NuRoute's settings live in one file, .env, in the folder you installed into (nuroute/ if you used the one-line install). The installer creates it from .env.example and fills in the secrets. Most installs never change anything after that.

To change a setting: edit .env (for example nano .env), save, then apply it from the same folder:

docker compose up -d

Only the services whose settings changed restart; this takes a few seconds.

Keep .env private and backed up

It holds the database password and the keys that encrypt your provider API keys. Only the server's admins should be able to read it (the installer makes it readable by its owner only), and a copy belongs in your password manager or secrets vault.

The settings

Setting	What it is	Change it?
NUROUTE_DOMAIN	The address your team opens, without https://, e.g. nuroute.acme.com. Set by install.sh --domain	Yes, if you move to a new domain: point its DNS at the server first, then docker compose up -d obtains a certificate for it
NUROUTE_VERSION	The NuRoute release running, e.g. 1.0.0	No: ./upgrade.sh changes it for you (see Backups and upgrades)
CADDY_SITE	Unset normally. :80 when NuRoute sits behind your own HTTPS proxy	See Behind your own HTTPS proxy
POSTGRES_PASSWORD	The database password. Generated	No. The database is not reachable from outside the server anyway
JWT_SECRET	Signs dashboard sessions. Generated	Only if you believe it leaked: everyone is signed out, nothing else is affected
AUTH_ENCRYPTION_KEY	Encrypts the licence key and your mail server password in the database. Generated	Never. Data encrypted with the old key could no longer be read
PROVIDER_ENCRYPTION_KEY	Encrypts your AI providers' API keys in the database. Generated	Never, for the same reason
NUROUTE_REGISTRY	Where images are downloaded from, ghcr.io/nuroute-ai	Only for a private mirror of NuRoute's images

The installer never overwrites a value you already have, so running ./install.sh again is safe.

Behind your own HTTPS proxy

By default NuRoute's built-in proxy (Caddy) answers on ports 80 and 443 and obtains the HTTPS certificate itself. If your company already has a reverse proxy or load balancer that terminates HTTPS (nginx, Traefik, F5, an AWS or Azure load balancer), let it do that instead:

1. In .env, add:

   CADDY_SITE=:80

2. Apply it: docker compose up -d. NuRoute now serves plain HTTP on port 80 and obtains no certificate.

3. Point your proxy at http://<server>:80 for your domain, and have it pass the original Host header and X-Forwarded-For (most do by default). Allow request bodies of at least 10 MB and response timeouts of at least 5 minutes, since long AI answers stream for a while.

4. Make sure only your proxy can reach port 80 on the server (a firewall rule), since that traffic is no longer encrypted.

Email

NuRoute itself sends no email from your install. Until you connect your own mail server:

• Invitations work: Members shows the invitation link, which you send yourself.

• Password resets cannot be emailed. Someone with access to the server prints a reset link instead, from the install folder:

  ./reset-password.sh someone@acme.com

  It prints a link that works once, within an hour; send it to the person directly.

To have NuRoute send these emails, an owner or admin opens Settings → Email (SMTP) and enters your mail server's host, port, username, password and sender address, for example your Microsoft 365 or Google Workspace relay, or an SMTP service such as Amazon SES. The password is stored encrypted.

Resources and data

NuRoute keeps its data in Docker volumes on the server (docker volume ls shows them, prefixed with the folder name):

Volume	Holds
postgres_data	Users, organization, projects, API keys (hashed), provider keys (encrypted), policies, routing history
clickhouse_data	Request logs and usage charts
redis_data	Sessions and short-lived caches
updates	The routing model and model catalog received with the licence check-in
caddy_data	The HTTPS certificate

Backups cover PostgreSQL and .env, which is everything needed to restore the install. Request logs and usage charts are not backed up.