Configuration and Multi-Device Access

The default .env gets you running in minutes. This lesson covers the optional configuration — ports, CORS, multi-device access, and version pinning.

Environment variables reference

Already set in compose (no action needed)

Variable	Default	Purpose
INSTANCE_ID	self_hosted	Single-user gating — do not change
DEPLOYMENT_LOCALITY	local	Hides the cloud-limitation banner in Obsidian settings
OBSIDIAN_HOST_OVERRIDE	host.docker.internal	Rewrites 127.0.0.1 to the Docker host gateway
OBSIDIAN_NETWORK_ALLOWLIST	—	Additional comma-separated hostnames/IPs for Obsidian connections
ENABLE_MCP_SERVER	true	MCP server and Second Brain
ENABLE_AGENT_GATEWAY	true	Agent Gateway (OpenClaw / Hermes)

Optional (set in .env if needed)

Variable	Default	Purpose
GLASSY_TAG	latest	Image tag from GHCR. Pin for reproducibility.
APP_PORT	3000	Host port. Change if 3000 is in use.
APP_URL	http://localhost:3000	Base URL. Set this for Tailscale/domain access.
CORS_ORIGINS	http://localhost:3000	Must include every origin you use.
OLLAMA_BASE_URL	http://host.docker.internal:11434	Ollama on the host
OLLAMA_MODEL	llama3.2	Default Ollama model
BACKUP_ENCRYPTION_KEY	—	Encrypt on-demand backups (AES-256-GCM)
CLUSTER_WORKERS	min(2, CPUs−1)	Worker processes. Set to 1 on a small box.

Changing the port

If port 3000 is in use:

APP_PORT=3001
APP_URL=http://localhost:3001
CORS_ORIGINS=http://localhost:3001

Then docker compose up -d. The container always listens on 8080 internally; APP_PORT only changes the host-side mapping.

Multi-device access

To use Glassy from another device (phone, laptop, tablet), set APP_URL and CORS_ORIGINS to your network URL and choose an access method:

Option 1: Tailscale (recommended)

Tailscale is a WireGuard mesh VPN — no port forwarding, no public exposure.

APP_URL=http://<machine>.tail-net.ts.net:3000
CORS_ORIGINS=http://<machine>.tail-net.ts.net:3000

Install Tailscale on both your server and your phone/laptop. They’ll see each other as if on the same LAN.

Option 2: Cloudflare Tunnel

A Cloudflare Tunnel gives you a public HTTPS URL through Cloudflare’s edge — no open ports on your server.

APP_URL=https://glassy.example.com

Set up the tunnel with cloudflared and point your domain at it.

Option 3: Caddy HTTPS overlay

If you own a domain, the bundled Caddy overlay gives you auto-renewing Let’s Encrypt TLS:

docker compose -f docker-compose.yml -f docker-compose.https.yml up -d

Version pinning

For reproducibility, pin a specific version:

GLASSY_TAG=v2.35.0-beta.7

Then docker compose up -d. The :latest tag always points to the most recent release, which is fine for most users but means updates arrive automatically when you pull.

Obsidian network allowlist

If Obsidian runs on a different machine than Glassy (not localhost), add its address to the allowlist:

OBSIDIAN_NETWORK_ALLOWLIST=192.168.1.10,glassy.tail-net.ts.net

You’ll also need to configure the Obsidian Local REST API plugin to bind to 0.0.0.0 instead of 127.0.0.1.

What’s next?

Learn about backups and data management — automated daily backups, encryption, and restore.