Settings - TasmoFleet

Log level

Error Warn Info Debug

How much the server logs. debug is verbose; changes apply at once.

Audit retention How long audit events and finished update transactions (with their logs) are kept, at least 24h; a running transaction is never removed. Hours: 720h is 30 days, 8760h is 365 days.

Device networks CIDRs the devices live in, one per line or comma separated. Nothing outside is ever contacted. Reset Device networks to the default on save

Health checks

HTTP poll interval Health check by HTTP for devices without MQTT, at least 1s. Reset HTTP poll interval to the default on savePolicy check read interval How often each device is read for the policy view (jittered, side-effect-free queries), e.g. 1h. 0 = no background reads; MQTT updates and the on-demand check stay. Expected telemetry period A device is stale after twice this period plus a minute.

Broker host Port User Leave empty if the broker needs no login. Password Write-only. Leave empty to keep the stored password. Full topic pattern Must contain %prefix% and %topic% once each.

Use TLS

Tries one connection with the values above and saves nothing. A password typed above is the one tested; otherwise the stored one, only for the broker it was entered for.

MQTT discovery is listening Topic tasmota/discovery/+/config · 5 new devices waiting

Open Discovered

Discover devices from MQTT Needs MQTT. Finds are proposals; an admin accepts them.

Network scan

Scheduled network scan Off by default. Probes the CIDRs below on a schedule.

Scan interval At least 1h. Scan networks CIDRs inside the device networks, at most 1024 addresses (/22) each.

Default device credentials

Prefilled when you add a device or accept a discovered one. You can still change them per device.

Web user Tasmota’s web user is always admin. Default device password Write-only. Prefills the web password when a device is added or a discovered device is accepted (user admin); each device keeps its own copy. Reset Default device password to the default on save

Schedule and retention

Backups kept per device Lowering it can delete restore points. Never prune backups younger than Protects restore points from repeated manual runs, e.g. 720h. Scheduled backup interval How often all devices are backed up, e.g. 24h. 0 = manual only.

Firmware base URL Plain http:// URL devices use to fetch firmware, e.g. http://203.0.113.61 (the container address). Required for updates; needs a restart. Applies after a restart. Reset Firmware base URL to the default on saveUpstream sources Where firmware is fetched from. Two sources allow the cross-check. Applies after a restart.

Accept single-source files Off (recommended): a file must be offered by two sources (cross-check). Applies after a restart.

Index refresh interval How often the upstream index is refreshed in the background, e.g. 6h. 0 = only at start. Applies after a restart.

Expose Prometheus metrics Off: /metrics answers 404. On: token and local-scraper rules apply.

Device names in metric labels Off by default: metrics then carry counts only.

How people sign in

One method is active. The local admin account always works as a fallback.

Sign-in mode Set by environment (AUTH_MODE); edit the container configuration to change it.

Issuer URL e.g. https://auth.example/application/o/tasmofleet/ (with the trailing slash). Applies after a restart. Client ID The client ID registered for tasmofleet at your identity provider. Applies after a restart. Client secret Write-only. Sent only to the issuer it was entered for; change the issuer and it must be entered again. Applies after a restart. Scopes Comma separated, default openid,profile,email. Applies after a restart. Groups claim Claim in the ID token that lists the user's groups. Default: groups. Applies after a restart. User name claim Claim shown as the user name. Default: preferred_username. Applies after a restart. Button name Name of your identity provider on the login page: the button reads "Sign in with <name>". Default: Single sign-on. Applies after a restart. Admin groups Set by environment (ADMIN_GROUPS); edit the container configuration to change it.Operator groups Set by environment (OPERATOR_GROUPS); edit the container configuration to change it.

Checks that the issuer answers OIDC discovery. Nothing is saved and no secret is sent.

Updates (OTA)

Updates in parallel Fleet-wide number of devices updated at the same time.

Restore original OtaUrl After an update the device gets its own previous update address back, not the address of this server.

Relay state maximum age A relay state read before an update may switch relays back on only while it is younger than this.

Set by the container (27 settings)

Bootstrap settings (listeners, TLS, keys) come from the container configuration only and are never editable here.

Key	Value
`DATA_DIR`	`/data`
`LISTEN`	`192.0.2.70`
`FIRMWARE_LISTEN`	`192.0.2.71`
`PUBLIC_URL`	empty
`BASE_PATH`	empty
`LOG_FORMAT`	`text`
`TRUSTED_PROXIES`	`127.0.0.1/32`
`OIDC_POST_LOGOUT_URL`	empty
`HEADER_USER`	`X-authentik-username`
`HEADER_NAME`	`X-authentik-name`
`HEADER_EMAIL`	`X-authentik-email`
`HEADER_GROUPS`	`X-authentik-groups`
`HEADER_GROUPS_SEPARATOR`	`\|`
`HEADER_LOGOUT_URL`	empty
`LOCAL_LOGIN`	`true`
`SESSION_IDLE`	`2h`
`SESSION_MAX`	`12h`
`OIDC_RECHECK`	`15m`
`INITIAL_ADMIN_PASSWORD`	empty
`TLS_CERT_FILE`	empty
`TLS_KEY_FILE`	empty
`TLS_SELF_SIGNED`	`false`
`TLS_SANS`	empty
`ALLOW_INSECURE_HTTP`	`false`
`FIRMWARE_UPSTREAM_OVERRIDE`	`http://192.0.2.73/github`
`DECODER_PATH`	empty
`METRICS_TOKEN`	empty

Reset all settings

Devices, backups and users are kept.

Reset settings…