Configuration
Configure self-hosted PDF Redaction Studio through .env: license, secrets, database, public URLs for your domain, sign-in methods and the detection API endpoint.
All settings live in the .env file next to docker-compose.yaml. Every container reads it. After a change, apply it with:
docker compose up -dVariables
| Variable | Used by | Default in .env.example | What it does |
|---|---|---|---|
PDF_REDACTION_LICENSE | backend | empty | Your license key. Required, see License |
DATABASE_HOST | backend | db | Database host. Keep db to use the bundled Postgres container |
DATABASE_PASSWORD | db, backend | sample value | Postgres password. Change it before first start |
SIGNING_KEY | backend | sample value | Signs sign-in tokens. Change it to a long random value |
ALLOWED_HOSTS | backend | localhost,backend,0.0.0.0,127.0.0.1 | Host names the backend answers to. Add your backend's domain |
CORS_ALLOWED_ORIGINS | backend | http://localhost:3000 | Address of the Studio web app. Set it to your Studio URL |
API_URL | studio | http://backend:8000 | How the Studio server reaches the backend inside Docker. Usually unchanged |
NEXT_PUBLIC_API_URL | studio | http://127.0.0.1:8000 | How users' browsers reach the backend |
NEXT_PUBLIC_PII_API_URL | studio | http://127.0.0.1:8002/api/deidentify/ner/text | How users' browsers reach the detection API |
NEXTAUTH_URL | studio | http://localhost:3000/api/auth | Public Studio URL followed by /api/auth |
NEXTAUTH_SECRET | studio | sample value | Encrypts sign-in sessions. Change it to a long random value |
NEXT_PUBLIC_AUTH_METHODS | studio | userpass | Sign-in methods on the login page, see below |
PDF_REDACTION_API_LICENSE, PDF_REDACTION_API_OPENMETER_SOURCE | api | provided | Settings for the detection API. Keep the values from .env.example unless support tells you otherwise |
Generate random secrets with:
openssl rand -base64 32Run Studio on your own domain
The default values only work on the machine where Docker runs. The Studio page in the browser talks directly to the backend and to the detection API, so both must be reachable from your users' computers.
A typical setup puts a reverse proxy with HTTPS (nginx, Caddy or Traefik) in front of the three public ports:
| Public address | Forwards to |
|---|---|
https://studio.example.com | studio:3000 |
https://studio-api.example.com | backend:8000 |
https://studio-pii.example.com | api:8002 |
Then set:
NEXTAUTH_URL=https://studio.example.com/api/auth
CORS_ALLOWED_ORIGINS=https://studio.example.com
NEXT_PUBLIC_API_URL=https://studio-api.example.com
NEXT_PUBLIC_PII_API_URL=https://studio-pii.example.com/api/deidentify/ner/text
ALLOWED_HOSTS=studio-api.example.com,backend,localhostDon't expose the database
docker-compose.yaml publishes Postgres on port 5432 for convenience. On a server, remove that ports entry, or block the port in your firewall, so the database is reachable only from the other containers.
Sign-in methods
NEXT_PUBLIC_AUTH_METHODS is a comma-separated list:
| Value | Sign-in method |
|---|---|
userpass | Username and password, stored on your server (default) |
google | Google account. Needs your own Google OAuth client |
microsoft | Microsoft account. Needs your own Microsoft Entra ID app |
For Google or Microsoft sign-in, create the OAuth app with the redirect URL https://studio.example.com/api/auth/callback/google (or /microsoft) and contact support for the variables to add.
Where the detection runs
In self-hosted Studio, Cloud PII in the editor's detection settings sends page text to the api container on your server, the address in NEXT_PUBLIC_PII_API_URL. Local NER, rule-based detection, OCR and face detection run in each user's browser, as in every product.
Next steps
Install with Docker
Install self-hosted PDF Redaction Studio with Docker Compose: one-line installer or manual setup, license key, first sign-in and the containers it runs.
License
How the self-hosted PDF Redaction Studio license works: get a trial or commercial key, add it to .env, what happens when it expires and how to replace it.