config.example.ini

# LAN Orangutan Configuration
# Copy this file to your config directory:
#   Linux: ~/.config/lan-orangutan/config.ini (or /etc/lan-orangutan/config.ini as root)
#   macOS: ~/Library/Application Support/lan-orangutan/config.ini
#   Windows: %APPDATA%\lan-orangutan\config.ini

[server]
# Port to listen on (default: 291)
port = 291

# Address to bind to (default: 0.0.0.0 = reachable from your network).
#
# The default lets you open the dashboard from another machine, which is how
# most people use it. The first time you visit, LAN Orangutan asks you to
# create a password, and nothing else is reachable until you do.
#
# Set this to 127.0.0.1 to keep the dashboard private to the machine it runs
# on. In that case no password is asked for, since nobody else can reach it.
bind_address = 0.0.0.0

# 0.0.0.0 listens on IPv4 only. Use :: if you also want IPv6, but note that
# IPv6 addresses are often reachable from the internet directly, because there
# is usually no NAT in the way.

# Password for the dashboard and API.
#
# You do not need to set this. Leave it empty and you will be asked to create
# a password the first time you open the dashboard, which is stored separately
# so this file is never rewritten.
#
# Setting it here overrides that. Plain text or a bcrypt hash both work.
# password =

# How long a login stays valid, in hours (default: 168 = one week)
session_hours = 168

# Skip password protection entirely, even when reachable from the network.
# Only turn this on if something else already controls who can reach this
# machine, such as a reverse proxy that handles authentication.
allow_insecure = false

# Enable REST API endpoints
enable_api = true

[scanning]
# Keep the device list current by re-scanning the detected networks on a timer,
# with no need to click Scan or keep a browser open (default: true). Set false
# to scan only on demand.
continuous_scan = true

# How often continuous scanning re-scans, in seconds (default: 300 = 5 minutes).
scan_interval = 300

# Minimum time between manual scans to prevent abuse (default: 30 seconds)
min_scan_interval = 30

# Enable port scanning (slower, more detailed)
enable_port_scan = false

# Port range to scan when port scanning is enabled
port_scan_range = 1-1024

# Identify devices more precisely with a light service probe (default: false).
#
# A normal scan is a quiet ping sweep that names devices from their vendor and
# hostname. Turn this on and each discovered device is also checked on a short
# list of well-known ports (web, printer, NAS, and so on) to sharpen its type
# and flag a web interface. It sends a little more traffic and takes a little
# longer, so it is off by default.
enable_service_detection = false

# Networks to scan, in addition to the ones detected automatically.
#
# Detection reads this machine's own network interfaces, which is not always
# what you want: a subnet reachable through a router, or a VLAN, has no local
# interface and so is never offered. List those here.
#
#   networks = 192.168.10.0/24, 10.0.5.0/24
#
# This does NOT make Docker work on macOS or Windows. There the container runs
# inside a virtual machine whose NAT answers probes itself, so a scan reports
# devices that do not exist. Run LAN Orangutan natively on those platforms.
# networks =

# Networks to hide from the automatically detected list (a blocklist).
#
# Detection offers every real interface it finds. If some of those are networks
# you never want scanned, a guest VLAN, an overlay, or a large slow subnet, list
# them here and they are dropped while everything else stays. Excluding a wide
# block also drops the smaller subnets inside it. A network you name in the
# "networks" setting above is always kept, even if it also appears here.
#
#   exclude_networks = 10.99.0.0/16, 192.168.50.0/24
# exclude_networks =

# Scan only the networks declared in "networks", ignoring auto-detection
# entirely (default: false). Useful on a host with many Docker bridges, VLANs
# or routed interfaces where the automatic list is noisy. When true, set
# "networks" to the ones you actually want.
only_configured_networks = false

[storage]
# Maximum number of devices to track.
# NOTE: reserved for a future release, not enforced yet. The device list is not
# currently capped. The value is accepted and preserved.
max_devices = 1000

# Days to keep offline device history.
# NOTE: reserved for a future release, not enforced yet. Offline devices are
# currently kept until you delete them. The value is accepted and preserved.
retention_days = 90

# Data storage directory (default varies by OS)
# Linux: ~/.local/share/lan-orangutan or /var/lib/lan-orangutan (as root)
# macOS: ~/Library/Application Support/lan-orangutan
# Windows: %APPDATA%\lan-orangutan
# Uncomment to override:
# data_dir = /var/lib/lan-orangutan

[tailscale]
# Enable Tailscale integration
enable = true

# Auto-detect Tailscale peers
auto_detect = true

[ui]
# Theme: light, dark, or auto (follows system preference)
theme = auto

# ---------------------------------------------------------------------------
# Environment variables
#
# Every setting above can also be supplied through the environment, which is
# usually easier in Docker. Environment variables override this file.
#
#   ORANGUTAN_PORT              ORANGUTAN_PASSWORD
#   ORANGUTAN_BIND_ADDRESS      ORANGUTAN_PASSWORD_FILE
#   ORANGUTAN_SESSION_HOURS     ORANGUTAN_ALLOW_INSECURE
#   ORANGUTAN_DATA_DIR          ORANGUTAN_SCAN_INTERVAL
#   ORANGUTAN_THEME
#
#   ORANGUTAN_NETWORKS                    (comma-separated CIDRs to add)
#   ORANGUTAN_EXCLUDE_NETWORKS            (comma-separated CIDRs to hide)
#   ORANGUTAN_ONLY_CONFIGURED_NETWORKS    (true to ignore auto-detection)
#   ORANGUTAN_ENABLE_SERVICE_DETECTION    (true for deeper device typing)
#
# ORANGUTAN_PASSWORD_FILE points at a file containing the password, so the
# secret never appears in the process environment. It wins over
# ORANGUTAN_PASSWORD if both are set.
# ---------------------------------------------------------------------------