Parameters

Environment-first configuration

wallabag is configured with environment variables.

• For local development, put overrides in .env.local.
• For tests, put overrides in .env.test.local.
• For Docker-based local development, copy docker/php/env.example to docker/php/env for Docker-specific overrides.
• For production, export the variables through your web server, PHP-FPM pool, systemd unit, or container runtime.

Keep DATABASE_URL in .env.local and .env.test.local so development and test can choose different databases, even when you run wallabag in Docker.

Symfony runtime variables

Application variables

Compromised-password protection

Compromised-password checks are disabled by default. Set WALLABAG_COMPROMISED_PASSWORD_CHECK_ENABLED=1 to enable checks against Have I Been Pwned. Only a prefix of the password hash is sent. Temporary service failures do not block validation.

The check covers public registration, administrator and API user creation, password changes, and password resets through forms. The installation command and the fos:user:create and fos:user:change-password console commands are not covered.

Clear the production cache after changing this setting if needed.

CAPTCHA protection for user creation

Set WALLABAG_CAPTCHA_ENABLED=1 to require a CAPTCHA on public registration and administrator user-creation forms. The default value, 0, leaves both forms unchanged. Clear the production cache after changing the value:

bin/console cache:clear --env=prod

Each challenge is stored in the visitor’s session. Loading a new image or submitting the form invalidates the previous answer, including after an incorrect submission. The challenge has no clock-based expiry; its lifetime is defined by those refresh and submission events.

The CAPTCHA is image-only and has no audio alternative. For users who cannot complete it, an administrator should create the account through the protected administrator form. API user registration remains CAPTCHA-free and is outside this feature’s scope.

A CAPTCHA is only one abuse-prevention layer. It does not replace rate limits, reverse-proxy controls, or a web application firewall.

Production log verbosity

WALLABAG_LOG_LEVEL controls the minimum level written by the nested Monolog handler in production. Monolog accepts debug, info, notice, warning, error, critical, alert, and emergency.

The main fingers_crossed handler continues to activate only at error. Lowering WALLABAG_LOG_LEVEL therefore adds buffered context when a request ends in an error without logging successful requests. For example:

WALLABAG_LOG_LEVEL=debug

After changing the value, clear the production cache:

bin/console cache:clear --env=prod

Service variables

Redis password

If your Redis password contains characters that need URL encoding, pass it in the password query parameter of REDIS_URL. Predis decodes this parameter, but not an encoded password in redis://:password@host. For example, the password p@ss:word+&% can be configured as:

REDIS_URL="redis://localhost:6379/0?password=p%40ss%3Aword%2B%26%25"

REDIS_URL only configures the asynchronous imports. For Redis-backed PHP sessions, use a tcp:// save path, as in docker/php/env.example.

Article problem-reporting destination

WALLABAG_ARTICLE_REPORTING_URL accepts an absolute https: URL or a mailto: URI with one recipient. An unset or empty value uses the default address shown above. Invalid values stop the Symfony container from compiling.

Query names and values in the configured URL must use RFC 3986 percent encoding. wallabag preserves configured query parameters, including a custom subject, but always replaces body with the URL of the article being reported. Fragments are preserved.

WALLABAG_ARTICLE_REPORTING_URL="https://support.example.com/issues/new?template=article"
WALLABAG_ARTICLE_REPORTING_URL="mailto:support@example.com?subject=Article%20display%20problem"

Because the value is validated and stored while building the container, clear the application cache after changing it.

Legacy mapping for upgraded installs

If an upgraded installation still has app/config/parameters.yml, wallabag maps the legacy keys below to the new environment-variable interface at boot time.