# Configuration

VibeSonic is configured entirely through environment variables. There is
no separate config file — everything needed to run the server is
available via `VIBESONIC_*` variables, with sane defaults for everything
except the session secret.

| Variable | Default | Description |
|---|---|---|
| `VIBESONIC_LISTEN_ADDR` | `:8080` | HTTP listen address |
| `VIBESONIC_DATA_DIR` | `/var/lib/vibesonic` | Directory for the database, resized cover-art cache, etc. |
| `VIBESONIC_DB` | `<DATA_DIR>/vibesonic.db` | Path to the SQLite database file |
| `VIBESONIC_MUSIC_DIRS` | *(none)* | Colon-separated list of music folders to import on startup, e.g. `/music:/music-lossless:/audiobooks`. Additional folders can also be added later from the admin UI. |
| `VIBESONIC_FFMPEG_PATH` | `ffmpeg` (from `PATH`) | Path to the `ffmpeg` binary |
| `VIBESONIC_FFPROBE_PATH` | `ffprobe` (from `PATH`) | Path to the `ffprobe` binary |
| `VIBESONIC_SCAN_INTERVAL` | `1h` | How often to rescan enabled music folders, as a Go duration (`30m`, `6h`, ...). A startup scan always runs regardless of this value. |
| `VIBESONIC_SESSION_SECRET` | *(none)* | Reserved for future use hardening session cookies beyond their database-backed random IDs. Not required to run, but recommended to set (e.g. `openssl rand -hex 32`) — VibeSonic logs a warning at startup if it's empty. |
| `VIBESONIC_COOKIE_SECURE` | `true` | Whether session/CSRF cookies get the `Secure` attribute. Set to `false` only for local development over plain HTTP. |

## External authentication

See [`docs/external-auth.md`](external-auth.md) for the full
`VIBESONIC_EXTAUTH_*` reference.

## First run

On a database with no users yet, every request redirects to `/setup`,
which walks you through creating the administrator account and your
first music folder, detects `ffmpeg`/`ffprobe`, and kicks off the first
scan. VibeSonic never ships default credentials — the administrator
account only exists once you create it through this wizard.

## Migrations

Schema migrations are embedded in the binary (`migrations/*.sql`) and
applied automatically on startup, tracked in a `schema_migrations` table.
There is nothing to run manually.