Configuration
All settings of an installation are in the .env file in the installation folder. After a change, apply it with:
docker compose up -d
Settings that concern individual companies (break rules, leave, features, retention periods …) are maintained in the app under Company.
Required
| Variable |
Meaning |
PUNCHIFY_DOMAIN |
Address under which Punchify is reachable, e.g. time.yourcompany.com. The DNS record must point to the server. |
ACME_EMAIL |
Email address for notices from Let's Encrypt (e.g. about expiring certificates). |
PUNCHIFY_LICENSE_KEY |
Your licence key (starts with PUNCHIFY1.). See Licence. |
PUNCHIFY_DB_PASSWORD |
Database password – a long random value. Do not change it after the first start. |
PUNCHIFY_SECRET_KEY |
Secret key (at least 16 characters, better 64 hex characters). Encrypts the backups and – if enabled – sensitive fields. Keep it safe. |
PUNCHIFY_ADMIN_EMAIL |
Email of the first admin. Only created on the very first start. |
PUNCHIFY_ADMIN_PASSWORD |
First password of this admin (at least 8 characters). Change it in the app afterwards and remove it here. |
Instance
| Variable |
Default |
Meaning |
PUNCHIFY_COMPANY_NAME |
Meine Firma |
Name of the first company. The super admin creates further companies in the app. |
PUNCHIFY_INSTANCE_NAME |
Punchify |
Name shown at the top of the app and as the sender of emails. |
PUNCHIFY_TIMEZONE |
Europe/Berlin |
Time zone for day boundaries, display and nightly jobs. |
PUNCHIFY_SESSION_DAYS |
30 |
How long a sign-in stays valid (days). |
PUNCHIFY_VERSION |
latest |
Which version Docker pulls – latest or a fixed number such as 0.10.0. |
Email (optional)
Without these settings Punchify sends no emails; everything else works. Notifications are then only sent as push messages to installed apps.
| Variable |
Meaning |
PUNCHIFY_SMTP_HOST |
SMTP server of your email provider. |
PUNCHIFY_SMTP_PORT |
587 (STARTTLS) or 465 (SSL). |
PUNCHIFY_SMTP_USER / PUNCHIFY_SMTP_PASSWORD |
Mailbox credentials. |
PUNCHIFY_MAIL_FROM |
Sender address, e.g. time@yourcompany.com. |
Privacy and security (optional)
| Variable |
Default |
Meaning |
PUNCHIFY_FIELD_ENCRYPTION |
0 |
1 = additionally store sensitive fields (notes, protection rules, history, log) encrypted. The key is PUNCHIFY_SECRET_KEY. Switched over on the next start. |
PUNCHIFY_IP_ALLOWLIST_OFF |
0 |
Emergency switch: 1 ignores the IP allowlists of all companies – in case a company locked itself out. Set back to 0 afterwards. |
PUNCHIFY_TRUSTED_PROXIES |
private networks |
Addresses whose X-Forwarded-For is trusted. Only change if another proxy sits in front of Caddy. |
PUNCHIFY_WEBHOOK_ALLOW_PRIVATE |
0 |
1 allows webhooks to internal addresses (only sensible in your own networks). |
Kiosk (optional)
| Variable |
Meaning |
PUNCHIFY_KIOSK_HOST |
Separate address for kiosk devices, e.g. kiosk.time.yourcompany.com. Under this address only the kiosk is reachable. Uncomment the prepared kiosk block in the Caddyfile. See Kiosk. |
Backups and more (optional)
| Variable |
Default |
Meaning |
PUNCHIFY_BACKUPS |
1 |
0 switches the nightly backup off (not recommended). |
PUNCHIFY_BACKUP_KEEP |
14 |
How many backups are kept. |
PUNCHIFY_PUSH |
1 |
0 switches push notifications off. |
PUNCHIFY_DOCS_URL |
https://wiki.punchify.app |
Target of the help links in the interface, e.g. for your own copy of the documentation on an intranet. |
Further variables (PUNCHIFY_DATABASE_URL, PUNCHIFY_DATA_DIR, PUNCHIFY_DEMO_MODE, PUNCHIFY_SECURE_COOKIES, PUNCHIFY_LICENSE_SERVER) are meant for development and special cases and need not be set in a normal installation.