# Server

`geoffrey-server` takes no CLI flags. It binds `0.0.0.0:{port}` (default 3000). Config has been file-and-environment based since version 0.4.0. Client keys are `[[clients]]` entries, not database rows.

Config layers, in increasing priority:

1. Built-in defaults.
2. Image file `/etc/geoffrey.toml`, copied from `config/geoffrey.toml` at image build. It is not on the `/data` volume.
3. Optional `/data/config.toml`, or `{data_dir}/config.toml` when `/data/config.toml` is absent. A missing file is skipped. A present file that does not parse stops startup.
4. `GEOFFREY_`-prefixed environment variables.

A later file that sets only scalars leaves the earlier `[[clients]]` list in place. To change clients, put the full list in the file mounted at `/etc/geoffrey.toml`, or in the data-dir config when no image file supplies clients. Unprefixed names such as `MAX_DISK_BYTES` are ignored. Trailing slashes on `public_url` are stripped. `RUST_LOG` is read by `env_logger`, not this config.

| Setting | Env var | Default | Description |
|---|---|---|---|
| `port` | `GEOFFREY_PORT` | `3000` | Listen port |
| `data_dir` | `GEOFFREY_DATA_DIR` | `/data` | Data directory (`geoffrey.db`, `rentals/`) |
| `public_url` | `GEOFFREY_PUBLIC_URL` | `https://localhost` | Full public base URL used in generated links |
| `max_disk_bytes` | `GEOFFREY_MAX_DISK_BYTES` | `10737418240` (10 GiB) | Host cap on uploaded bytes across every rental until purge |

Every `[[clients]]` table requires `id`, `key`, `max_disk_bytes`, and `max_duration_seconds`. The host cap is the sum of `uploaded_bytes` on every rental row until purge. A client key's cap is that same sum for rentals with that key. Creating a rental does not spend either budget. A `PUT` that would pass the key cap returns 413. A `PUT` that fits the key but would pass the host cap returns 507.

The built-in host default is 10 GiB. A deployment that sets `GEOFFREY_MAX_DISK_BYTES` keeps that value. The variable overrides only the host scalar, not a client's `max_disk_bytes`. The image copies `config/geoffrey.toml` to `/etc/geoffrey.toml`. That file is an example `local` client (`replace-me`, 100 MiB, one hour). Mount a real client file, or change the key, before anyone else can reach the server.

SQLite is `{data_dir}/geoffrey.db`. Files live under `{data_dir}/rentals/{directory}/`. Migrations run at startup.

`GET /health` returns `{"status":"ok","http_requests_served":N}`. The counter increments on public file downloads, not on `/health`, `/openapi.json`, or `/docs`.

The image publish and the local compose file are described on the [install](/install/) page. The [changelog](/changelog/) records the move to config keys in 0.4.0 and later changes to the client packaged in the image.