Configuration & environment variables

Almost everything is configured comfortably in the web interface. Environment variables only cover what has to be fixed before startup: ports, data directory, certificate, logging and a few special cases.

All environment variables

Every variable starts with NODE64_. An empty value counts as “not set”, so the default applies.

Example

    environment:
      NODE64_LOG_LEVEL: info
      NODE64_LOG_FORMAT: json
      NODE64_HTTPS_PORT: 8443
      # NODE64_ADMIN_USER: admin               # very first start only
      # NODE64_ADMIN_PASSWORD: YOUR_PASSWORD   # very first start only

Volumes

Node64 needs exactly one volume: /data (or whatever you set in NODE64_DATA_DIR). Everything else in the container can be read-only with read_only: true. What's inside is listed in the table under Installation.

• Named volume (node64-data:/data) – the easiest option; Docker takes care of permissions.
• Host folder (./data:/data) – handy for your own backups. The process runs as user 65532, so the folder must belong to it: sudo chown -R 65532:65532 ./data.
• Your own certificate: put the files for NODE64_TLS_CERT/NODE64_TLS_KEY under /data, or mount them additionally as read-only.
• Docker socket (optional): /var/run/docker.sock:/var/run/docker.sock:ro for Docker checks, see below.

Ports

By default only 8080 is open. DNS64 (53, 853) and the shared entry point (80, 443) only open their ports while they are needed. The full table is in Installation → Ports.

• The DNS64 and shared entry point ports are set in the interface, not via environment variables.
• Settings → Ports shows all ports of the node in a table – web interface, common entrance with PROXY64 streams, DNS64 and Honeypot64 with syslog: module, purpose, protocol, bind address, configured or open, and whether a listener is really listening on Linux (via /proc/net, inside the container's network). Plus conflicts and module errors such as “address already in use” or “permission denied”. Whatever runs along on the entrance or the web port (proxy hosts, DoH, cluster, MCP, Prometheus) is listed as “shared” below, the CDN64 tunnel as an outgoing connection. Filters by module and state; below that, notes on ports below 1024 and Docker port forwarding. A binding to 0.0.0.0 only covers IPv4, not IPv6; ports below 1024 need cap_net_bind_service – root alone isn't enough.
• The API can also check whether a port is free on the host: GET /api/ports/probe?proto=tcp&port=443.

Network mode: bridge or host

Rule of thumb: only health checks, notifications and DynDNS? Bridge is fine. As soon as DNS64 or PROXY64 come into play, use the host network. Ready-made Compose files for both cases are in Installation.

Behind your own reverse proxy

If you already run a reverse proxy in front of Node64 (such as Traefik, Caddy or Nginx), just forward to http://node64:8080. So that Node64 sees the browser's real address (e.g. for rate limiting and the audit log) and knows which hostname was used and whether it was HTTPS, set:

    environment:
      NODE64_TRUST_PROXY: "true"

• Login via the proxy: with Authelia or Authentik as forward auth, the proxy can pass the user in the Remote-User header. Set this up under Login & security; only the proxy's real connection address counts there.
• Without an extra proxy: Node64 can also serve its own interface under a custom name on port 443 – via the shared entry point, with a certificate from certificate management.
• Passkeys need HTTPS with a hostname and only work for the name they were created under.

Docker host for container checks

Everything about Docker monitoring – including remote hosts via SSH or TLS – is under Monitoring Docker. This is only about the local socket. It is only monitored once you add it under Health checks → Docker with Add this machine (local socket).

Docker container checks query the Docker API – by default via unix:///var/run/docker.sock. Node64 only sends GET requests. Docker checks always run locally, never online.

Because the socket grants control over the host despite :ro, you can put a docker-socket-proxy in front that only allows reading containers:

services:
  socket-proxy:
    image: tecnativa/docker-socket-proxy
    restart: unless-stopped
    environment:
      CONTAINERS: 1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro

  node:
    image: ghcr.io/ipv64net/node64:latest
    container_name: node64
    restart: unless-stopped
    ports:
      - "8080:8080"
    volumes:
      - node64-data:/data
    environment:
      NODE64_DOCKER_HOST: tcp://socket-proxy:2375
    read_only: true
    tmpfs:
      - /tmp
volumes:
  node64-data:

You can also override the Docker host per check in the “Docker host” field. Without a proxy you need group_add with the socket's group instead – see Installation.

Log level and log format

• Initial value via NODE64_LOG_LEVEL (debug, info, warn, error) and NODE64_LOG_FORMAT (text or json, e.g. for a log collector).
• Switch at runtime under Settings → Logging – globally and per area (module). With “Reset after”, the level falls back automatically after the chosen time, so debug doesn't stay on forever.
• View under Logs in the interface (the last 2000 lines) with download, or as usual with docker logs node64.
• No secrets in the log: values that look like passwords, tokens or keys are always masked.

Via the API: GET /api/logs and GET|PUT /api/logging – see Local API.

Language, dark mode and appearance

The settings in the web interface are split into four pages: General (node, user, appearance, two-factor, reachability of this node with the UI certificate, ipv64 API key, AI interface, logging, about), Modules (per module version, status, short description, on/off switch with a confirmation when switching off, and a link to the module), Ports (see Ports) and Data & backup (data retention, backup, export and import, reset – see Update & backup).

These are set directly in the interface, not via environment variables:

• Language: English or German, per user under Settings → User (along with time zone and password). Notifications go out in the language of each channel.
• Color scheme: light, dark or automatic following your device's system setting.
• Font size: small, normal, large or extra large under Settings → Appearance. Applies immediately in this browser.
• Dashboard: tiles, order and width via Customize on the dashboard.
• Data retention: how long raw measurements, hourly values and the audit log are kept locally, under Settings → Data & backup – overview under Data retention.

Something unclear, missing, or a question about Node64? Ask in the official forum v64.tech.