Repository navigation
[BUG] Inconsistent Configuration Prefix breaks ACLs #667
Description
Describe the bug
Need some clarity on what syntax is needed for configuration. Prefix with "TINYAUTH_" or not?
To Reproduce
Steps to reproduce the behavior:
The container expects "APP_URL" and the current docs say "APP_URL" also, but the example compose and env file suggest "TINYAUTH_APP_URL".
Maybe it changed at some point and not updated in some places?
Along with all configs in the env example:
https://github.com/steveiliop56/tinyauth/blob/36b1594fb8e9ebaaf6ff5cff29983d9ac87bdc0e/.env.example#L4
Also uses the prefix in the Docker file: https://github.com/steveiliop56/tinyauth/blob/36b1594fb8e9ebaaf6ff5cff29983d9ac87bdc0e/Dockerfile#L60
This applies to all configs, APP_URL is an easy example.
More importantly, this may also apply to the not documented non-label ACL config approach (could we also add docs for this on the config docs page?). The PR 422 suggests ACL's can be set by environment vars with the "TINYAUTH_" prefix but maybe they don't need this prefix? (I can't get them to work with labels/socket disabled).
Expected behavior
A clear and concise description of what you expected to happen.
Either the docs and app are looking for the wrong environment vars or the example configuration files are wrong or outdated? Maybe some parts of the app like the env based ACL's need to be updated also?
Device (please complete the following information):
- OS: Linux Debian (via podman or docker in a container)
- Tinyauth v4 / latest
Activity
hozza commentedon Feb 24, 2026
I may have found some clarity on the confusion. If seems that "main" branch is being used for development (i.e. v5) rather than being the current code for latest (that's under the v4 tag on main).
Is the non-label ACL from PR 422 only in v5?
Perhaps a note could be added to the README and/or the docs, that the main is actually the dev branch and code/examples/docs refer to a tag?
Regardless of this version confusion, if you could shed some light on the ENV vars that would be so helpful! 😅
steveiliop56 commentedon Feb 25, 2026
Yes, the main branch is the development one and it should not be treated as the stable one. For a tagged version of the source code please use the tag selector and your current release. Also, always refer to the documentation for the most up-to-date and stable reference. Non-docker ACLs are indeed a v5 feature. I may consider using a new development branch going forward but for now, I will keep main.