Docs menu
Configuration reference
On this page
Most everyday settings are changed under Settings in the console and stored in the database. This page covers the configuration Rerinku View reads at startup: the config file config.yaml and environment variables. Changes take effect after you restart Rerinku View.
Config file and precedence
- On first start, Rerinku View creates
config.yaml(permissions 0600) in the current working directory. That’s the directory it was started from, not the directory the program file is in. - The
RERINKU_CONFIGenvironment variable points Rerinku View to a different path. In that case, the file must already exist. - Precedence: environment variables > config file > built-in defaults. An environment variable with an empty value counts as unset.
- If the config file has a key Rerinku View doesn’t recognize, Rerinku View refuses to start, so a misspelled setting isn’t silently ignored.
- Relative paths in the config file are resolved against the working directory.
The config file as first generated:
http:
addr: "0.0.0.0:8080"
# The database, keys and recordings are all stored in this directory.
data_dir: "./data"
gb28181:
enabled: true
addr: ":5060"
server_id: "34020000002000000001"
realm: "3402000000"
password: "change-me" # Change this before connecting devices
media: "auto"
rerinku_device:
enabled: true
broker_addr: "0.0.0.0:1883"The generated config file opens three ports to the LAN: the console on 8080, MQTT for device access on 1883, and GB28181 SIP on 5060. GB28181 is on by default, with the password
change-me. If you don’t use GB28181, setgb28181.enabledtofalse; if you do, change the password first.
Settings you change in the console, such as recording capacity and retention days, are stored in the database, and the database wins; the values in the config file are only initial values. The Settings → GB28181 page writes its changes back to the gb28181 section of config.yaml. If GB28181_* environment variables are also set, they override the page’s changes after a restart.
Listening and access control
| Environment variable | Config file | Default | Description |
|---|---|---|---|
HTTP_ADDR |
http.addr |
0.0.0.0:8080 (generated config file) |
The console, API, live video signaling, playback, device registration and streaming all share this one port. The built-in default is 127.0.0.1:8080 |
REQUIRE_API_AUTH |
— | Derived from the listen address | No token is required when listening only on loopback; a token is required when listening on any other address. Set 1 or 0 to force it |
ALLOWED_ORIGINS |
server.allowed_origins |
Empty | Listed website origins are treated as same-origin: when no access password is set, pages from these websites can call the API without a token. Only list addresses you trust |
TRUST_PROXY_HEADERS |
server.trust_proxy_headers |
false |
Set to true behind a reverse proxy: headers such as X-Forwarded-* are trusted to identify the real client address and HTTPS |
SHUTDOWN_TIMEOUT |
server.shutdown_timeout |
10s |
The longest time to wait for requests to finish when stopping |
RESET_ACCESS_PASSWORD |
— | Empty | Set to 1 and start once to clear the access password and every browser sign-in. Be sure to remove it afterward |
DEMO_MODE |
demo_mode |
false |
Demo mode: visitors can only look, not change anything, and passwords, LAN addresses and visitor IPs are never shown |
The access password itself is set under Settings → Sessions in the console. See Remote access.
Data and recordings
| Environment variable | Config file | Default | Description |
|---|---|---|---|
| — | data_dir |
./data |
Data directory. The database is <data_dir>/rerinkuview.db, and recordings are in <data_dir>/recordings |
DATABASE_PATH |
— | ./data/rerinkuview.db |
The database path when you configure with environment variables only (note that the file name differs from the config-file setup) |
RECORDINGS_PATH |
— | ./data/recordings |
The recordings directory when you configure with environment variables only |
SECRET_KEY_PATH |
— | secret.key in the same directory as the database |
Encryption key; see Backup |
RECORDINGS_MAX_BYTES |
recordings.max_bytes |
100 GiB | Cap on total recordings; 0 means no limit |
RECORDINGS_MIN_FREE_BYTES |
recordings.min_free_bytes |
2 GiB | Minimum disk space to keep free; 0 means no limit |
RECORDINGS_RETENTION_DAYS |
recordings.retention_days |
0 (no deletion by age) |
Maximum number of days to keep recordings, 0–3650 |
RECORDINGS_FILE_DURATION |
recordings.file_duration |
10m |
Length of each recording file, 1 minute to 4 hours |
AUDIT_RETENTION |
audit.retention |
2160h (90 days) |
How long to keep the audit log; 0 means never prune |
MODELS_PATH |
— | models/ in the same directory as the database |
AI recognition models |
FACES_PATH |
— | faces/ in the same directory as the database |
Face library photos |
RERINKU_BIN_DIR |
bin_dir |
~/.rerinku/bin |
The built-in FFmpeg, recognition component and so on are unpacked here at startup |
LOG_LEVEL |
log.level |
info |
How much the console log shows: info only the essentials (where to open the console, stopping, warnings and errors); set debug for every detail when troubleshooting; warn and error also work |
For recording capacity and cleanup rules, see Recording and playback.
Live video (WebRTC)
| Environment variable | Config file | Default | Description |
|---|---|---|---|
STREAM_STUN_SERVERS |
stream.stun_servers |
Empty | STUN servers; there’s no built-in default. With Quick Connect on, the TURN servers issued by Rerinku Cloud are used instead, and this setting no longer applies |
STREAM_ICE_LISTEN |
— | Empty | By default, each connection uses a random UDP port. Set it to something like :8189 and all connections share that one UDP port, which makes firewall setup easier |
STREAM_ICE_CANDIDATES |
— | Empty | The IPs to announce, for cloud servers or 1:1 NAT |
STREAM_ICE_INTERFACES, STREAM_ICE_IPS |
— | Empty | Use only these network interfaces or IPs. Virtual interfaces such as docker, veth and tailscale are already skipped by default |
STREAM_ICE_NETWORKS |
— | udp4,tcp4 |
IPv4 only by default |
Device access
Devices that use the Rerinku View SDK, and the Rerinku Cam phone app, register over HTTP and receive commands through the built-in MQTT service.
| Environment variable | Config file | Default | Description |
|---|---|---|---|
DEVICE_GATEWAY_ENABLED |
rerinku_device.enabled |
true |
When off, only ONVIF, RTSP, GB28181 and USB cameras can be connected |
DEVICE_BROKER_ADDR |
rerinku_device.broker_addr |
0.0.0.0:1883 (generated config file) |
Listen address of the built-in MQTT service. Devices log in with a device token and can only use their own topics |
DEVICE_PUBLIC_URL |
rerinku_device.public_url |
Derived from HTTP_ADDR |
The Rerinku View address given to devices. It must be a LAN IP or domain name the devices can reach |
DEVICE_MQTT_BROKER |
rerinku_device.public_mqtt_broker |
tcp://<host IP>:<port> |
The MQTT address given to devices |
DEVICE_KEY |
rerinku_device.key |
Empty (any device can register) | When set, devices must provide secret = base64(HMAC-SHA256(DEVICE_KEY, sn)) when they register |
Derived addresses use this machine’s outbound IP. If the machine has several network interfaces, or its IP changes, set public_url and public_mqtt_broker explicitly.
GB28181
| Environment variable | Config file | Default | Description |
|---|---|---|---|
GB28181_ENABLED |
gb28181.enabled |
true (generated config file) |
Whether to enable the GB28181 SIP service. The built-in default is off |
GB28181_ADDR |
gb28181.addr |
:5060 |
SIP listen address; listens on both UDP and TCP |
GB28181_SERVER_ID |
gb28181.server_id |
34020000002000000001 |
The platform’s SIP server ID. Enter this on the device |
GB28181_REALM |
gb28181.realm |
First 10 digits of the server ID | SIP realm |
GB28181_PASSWORD |
gb28181.password |
change-me (generated config file) |
Device registration password; leave it empty for no authentication |
GB28181_MEDIA |
gb28181.media |
auto |
Media transport: auto, udp or tcp |
Quick Connect and Rerinku Cloud
| Environment variable | Config file | Default | Description |
|---|---|---|---|
CLOUD_API_URL |
cloud.api_url |
https://rerinku.com |
Rerinku Cloud’s address |
CLOUD_REPORT |
cloud.report |
true |
Reports installation info to Rerinku Cloud every 10 minutes (instance ID, version, operating system and a hardware summary; no devices or recordings). false turns it off |
Quick Connect credentials are obtained when you turn it on in the console, and are stored in the database. See Remote access.
Video decoding and debugging
| Environment variable | Config file | Default | Description |
|---|---|---|---|
VIDEO_HW_DECODE |
video.hw_decode |
true |
Set to false to force software decoding only; see AI recognition |
APP_ENV |
app_env |
development |
When it’s development, a debug interface (pprof) is opened on 127.0.0.1:6060. For production use, we recommend setting it to production |
DEBUG_ADDR |
debug.addr |
127.0.0.1:6060 |
Debug interface address; only loopback addresses are allowed |
Ports
| Port | Use | Open it? |
|---|---|---|
| 8080/TCP | Console, API, live video signaling, playback, device registration and streaming | Yes |
| 1883/TCP | Built-in MQTT service (device access) | When you have devices that use the Rerinku View SDK, or Rerinku Cam |
| 5060/UDP, TCP | GB28181 SIP | When you use GB28181 |
| GB28181 media | One random port per stream | When you use GB28181 |
| WebRTC/UDP | Random system ports by default | We recommend setting STREAM_ICE_LISTEN=:8189 and opening only that one |
| 127.0.0.1:6060 | Debug interface, local only | No |
ONVIF auto-discovery relies on LAN multicast (port 3702), and the host firewall may block discovery replies. See Adding cameras.