Skip to content

help 2026.10.1-beta.1 Support

Beta This is the help for Nifty 2026.10.1-beta.1, which isn't released yet. Help for the current release

Configuration

Every setting nifty run takes, as a flag or an environment variable.

On this page

Server
HTTPS
Updates
Secrets (environment only)

Server

Flag	Environment	Default	What it does
`--data`	`NIFTY_DATA`		Data directory, default the OS's per-user data directory.
`--listen`	`NIFTY_LISTEN`	`127.0.0.1:4000`	Address to listen on.
`--origin`	`NIFTY_ORIGIN`		Public origin (scheme://host[:port]) clients use; default http://<listen>, required off loopback.
`--trusted-proxies`	`NIFTY_TRUSTED_PROXIES`		Proxies whose X-Forwarded-For is believed: CIDRs or addresses, comma separated.

HTTPS

Flag	Environment	Default	What it does
`--acme`	`NIFTY_ACME`	`off`	Serve https with a Let's Encrypt certificate for the origin's host: off, tls (the internet reaches ports 443 or 80) or cloudflare (DNS, with NIFTY_CLOUDFLARE_API_TOKEN).
`--acme-directory`	`NIFTY_ACME_DIRECTORY`	`https://acme-v02.api.letsencrypt.org/directory`	ACME directory URL, e.g. Let's Encrypt staging for trials: https://acme-staging-v02.api.letsencrypt.org/directory.
`--acme-email`	`NIFTY_ACME_EMAIL`		Contact address for the ACME account, optional.
`--redirect-http`	`NIFTY_REDIRECT_HTTP`		Address that redirects http to https (and answers HTTP-01); default port 80 on --listen's host when serving https on port 443, off turns it off.
`--tailscale-port`	`NIFTY_TAILSCALE_PORT`	`443`	The tailnet https port for --tailscale-serve.
`--tailscale-serve`	`NIFTY_TAILSCALE_SERVE`	`off`	On or off: on puts the loopback --listen on the tailnet with tailscale serve, and works out the origin.
`--tls-cert`	`NIFTY_TLS_CERT`		Serve https with this PEM certificate chain, re-read when it changes.
`--tls-key`	`NIFTY_TLS_KEY`		The --tls-cert certificate's PEM private key.

Updates

Flag	Environment	Default	What it does
`--update-checks`	`NIFTY_UPDATE_CHECKS`	`on`	On, or off when updates come from elsewhere (the desktop app, a package manager).
`--update-url`	`NIFTY_UPDATE_URL`		Where releases are published: https, or http on loopback; default https://releases.niftyware.io (a dry-run build's own local server).

Secrets (environment only)

Flag	Environment	Default	What it does
	`NIFTY_SECRET_KEY`		Seals stored secrets such as AI providers' API keys; default <data>/secret.key, made on first run.
	`NIFTY_CLOUDFLARE_API_TOKEN`		A Cloudflare API token with Zone → DNS → Edit, for --acme cloudflare.