Skip to content

Configuration

Eight.ly OS is a single Go binary plus a React dashboard — there's no config file you hand-edit and no docker compose env-var file. Almost everything is a live setting in Settings in the dashboard, backed by the running box. Changes take effect immediately; most take effect without a restart.

Settings in the Dashboard

The Settings sidebar covers, roughly:

Tab Covers
General System name, timezone, language, and the setup wizard ("Show Quick Start Wizard")
Appearance Theme selection and the Theme Marketplace
License Activation, license key, update channel
Storage Arrays, pools, and cache
Network Domain, reverse proxy (Traefik or none), SSL provider
VPN VPN client/server configuration
Security Authentication provider (Authelia), 2FA, access policy, API keys, TLS cert pins, the authorization audit log, SSH access
Dashboard Users Accounts that can sign in to this box
Roles & Permissions Per-role access (admin-only)
Backup Local backups and the Eight.ly Backup Server (EBS), schedule, retention
Monitoring Prometheus/Grafana stack, alerting
UPS Connected UPS hardware
System System-level settings and diagnostics
Advanced Cluster/HA and other in-development features, off by default

Settings persist to /etc/eightly (users, API keys, secrets) and /var/lib/eightly (state, Nova chats, audit log, SQLite database). Both paths are what you back up to preserve the box's own configuration — see Where does my data go? below.

Login Is Never Optional

Unlike some self-hosted tools, there's no environment variable that disables the login screen. Authentication is always on. If you want a specific role to skip 2FA or use a shorter session timeout, that's a per-role setting under Settings > Roles & Permissions, not a global bypass.

Where Does My Data Go?

App data goes wherever each app's Compose template points its volumes — commonly /opt/appdata/<app>/ or a storage pool path you chose in the deploy wizard. See Storage for how pools and the cache mover work.

Eight.ly's own data:

  • /etc/eightly — users, API keys, secrets, cert fingerprints
  • /var/lib/eightly — SQLite state (eightly.db), Nova chats, audit log, templates cache

Both are what you back up to preserve the box's own configuration.

Credential Security

  • Passwords are hashed before writing to disk — never stored in plain text.
  • Sessions use HMAC-SHA256 signed cookies (not JWT), signed with a 32-byte crypto/rand session secret generated on first boot and stored 0600.
  • API keys are generated with crypto/rand (32 bytes), prefixed eos_, and stored as a SHA-256 hash — the full key is shown once, at creation, and never again.

Docker Socket Access

Eight.ly manages Docker directly (not through a proxy), which means it has full control over Docker on your server. This is the standard appliance model — the same trust boundary as Unraid, TrueNAS, or Portainer. See Security for the full model.

App Network Modes

Each app you deploy picks its own network mode in the deploy wizard:

  • Bridge — Docker's default bridge network, each app gets a published port. Start here if you're not sure.
  • Traefik — the app joins the proxy network so Traefik can route to it with a domain name and SSL.
  • Host, macvlan, and Custom network are also available for cases that need them.

See Traefik & Domain Setup for the full walkthrough.