Settings

Manage server settings at Server Settings (/dashboard/admin/settings). Only super administrators can view or change them.

You can also set the environment variables below in .env or your Compose configuration. Environment variables override dashboard values and make those fields read-only. The tables show types and examples; example values aren't necessarily defaults.

Core and datasource options are configured only through the environment. Some dashboard settings also require a restart after saving.

Core

Controls generated URLs, temporary storage, and trusted proxy headers. Most core settings require a restart.

For a reverse proxy, enable Trust Proxies and set Trusted Proxies to its IP addresses or CIDRs. With an empty list, forwarded headers are ignored and clients behind the proxy share rate limits. See Reverse Proxy for examples.

Temporary files default to ./uploads/.tmp. Moving them to another filesystem, including tmpfs, can reduce local upload performance.

See the other core settings.

Return HTTPS URLs

Enable this when your instance uses HTTPS, including when TLS terminates at a reverse proxy. Generated URLs use https://, and cookies are marked Secure. Leave it disabled for an HTTP-only instance, where secure cookies wouldn't be sent by the browser.

Chunks

Controls chunked uploads. Dashboard uploads larger than Max Chunk Size are split into requests of Chunk Size, allowing large files to pass through proxies with per-request size limits.

Tasks

Background task intervals default to 30 minutes, except thumbnail cleanup, which defaults to one day. Changes require a restart. Use relative time values, such as 30m.

Multi-Factor Authentication

Configure passwordless passkey login and time-based one-time passwords (TOTP):

• Passkeys use a device, phone, or security key. Configure the relying party ID and origin before users register a passkey.
• TOTP adds an authenticator code after a username and password login. Issuer is the account label shown in the authenticator app.

The passkey prompt depends on the user's operating system and browser:

Features

Enable or disable instance features. Some changes require a restart.

For video thumbnails, Zipline uses ffmpeg. Thumbnails Number Threads controls worker concurrency; reduce it if generation puts too much load on your server. Instantaneous Thumbnails generates a thumbnail after each upload rather than waiting for the scheduled task.

Files

Controls file uploads, naming, and serving. Route can be / to serve files from the domain root. Remove GPS Metadata attempts to remove EXIF GPS data from uploaded images.

• Assume Mimetypes detects file types from their contents rather than trusting the browser. Enable it when restricting MIME types; see Hardening.
• Disabled Types lists MIME types to reject, such as text/html,application/javascript.
• Default MIME for Disabled Types serves those types with a replacement MIME type instead of rejecting them. For example, application/octet-stream makes the browser download them. Leave it blank to reject the upload.
• Extensionless URLs lets file links work without extensions. Upload responses still include extensions unless the user requests an extensionless URL through dashboard upload options or the x-zipline-extensionless header. If names overlap, the newest matching upload is used.

URL Shortener

Controls shortened URL routes and code length. Set Route to / to serve short links from the domain root.

Invites

Enable invite codes and links. For an invite-only instance, disable User Registration under Features and enable invites. See Hardening.

Domains

Domains users can select for upload and shortened URL links. Each must point to your Zipline instance.

Ratelimit

Limits uploads at /api/upload and URL creation at /api/user/urls. Each user has a separate limit for each route and HTTP method. For chunked uploads, only the first chunk counts toward this limit.

Max Requests is the number allowed per Window. Set the window in milliseconds: 60000 is one minute. Leaving it unset uses a one-minute default. Admin Bypass exempts administrators.

IP allow list entries aren't applied in the current release.

Website

Controls instance branding and default appearance. See Dashboard customization for setup instructions.

• Default Avatar is a server-side image path.
• Terms of Service is a server-side Markdown path. New users must agree to it when registering.
• External Links is a JSON array of objects with name and url fields. Use the External Links Builder.
• Theme settings apply when the user hasn't selected their own theme, including on public pages.

OAuth

Configure Google, GitHub, Discord, or an OpenID Connect provider. Enable OAuth Registration under Features to show the login buttons.

Provider setup guides: Google, GitHub, Discord, and OIDC.

See the OAuth guide for Bypass Local Login and Login Only, and OIDC logout for the optional End Session URL.

HTTP Webhooks

Send a JSON POST request after uploads or URL shortening. See HTTP Webhooks for headers, payloads, and receiver examples.

Discord Webhook

Send notifications to Discord after uploads or URL shortening. Event-specific webhook URLs, usernames, and avatars override the shared values when provided.

Message content and embed fields support variables. Follow the Discord Webhooks guide for setup.

PWA

Provides a web app manifest so users can install Zipline from their browser.

Make the required favicon files available in public/. For Docker, mount them into the container; the files are available in the Zipline repository.