Configuration

Everything lives in config.lua, in the resource folder. Most servers change nothing.

Where a credential comes from

Every credential-shaped key in config.lua ships blank and should stay blank, so the file is safe to commit and safe to paste. Three places supply a real value, first one set wins:

The convar name is tdb_, then the option's path with dots as underscores, lowercased: Config.Superuser.Password is tdb_superuser_password, Config.Advanced.S3.SecretKey is tdb_advanced_s3_secretkey.

A convar overrides a password tDB generated earlier.

config.local.lua is where tDB stores the password it generates, and is also yours to edit. It uses config.lua syntax and needs only the keys you override:

Config = Config or {}

Config.Superuser = {
    Email = "admin@localhost.local",
    Password = "…",
}

Top level

The admin UI

On by default and needs no configuration. It is at http://<your server>:7777/db/, the panel itself at /db/_/; sign in with Config.Superuser. For a headless database, set Config.ExposeAdmin = false.

The panel answers on tLib's tlib_http_port (default 7777) and the address handed out is tlib_http_public_url — both in tLib's convar reference. That is the only port you ever set: PocketBase's own is internal, so do not open or forward it.

If the startup box says Waiting for tLib's HTTP listener, tLib's router is not up yet and tDB publishes the admin URL as soon as it is. The database itself works throughout.

Superuser

Config.Superuser = { Email = "", Password = "" }

Leave these blank. To pin a login you already have:

set tdb_superuser_email "admin@example.com"
set tdb_superuser_password "…"

With neither convar set, tDB generates both on first start and writes them into config.local.lua. The generated password prints in the console once, on the run that creates it, and is redacted on every start after.

Backups

Config.Backup = {
    Enabled = false,
    OnStartup = true,
    ScheduleSeconds = 0,
    KeepLast = 7,
    BackupPrefix = "auto_",
}

Backups land in the PocketBase data directory under backups.

SQL imports

Config.Sql = { Enabled = true, Dir = "sql", OnChanged = "warn" }

warn and error differ only in log level and neither re-runs the file. apply re-runs it, replaying every INSERT it contains, so it suits pure DDL dumps only. Full behaviour is on Importing .sql files.

Migrations

Config.Migrations = { AutoApply = true, Dir = ".runtime/pb_migrations" }

PocketBase's own collection migrations, not the .sql drop folder. A migration file is written whenever you change a collection in the admin UI, so schema changes travel with the resource.

Advanced

Config.Advanced = {
    RemoteHost = "",
    RemotePort = "",
    Dev = false,
    AutoMigrate = true,
    PublicDir = "pb_public",
    DataDir = ".runtime/pb_data",
}

Local or remote

By default tDB starts and manages its own PocketBase on 127.0.0.1. To point it at an instance you already run, set both keys:

Config.Advanced = { RemoteHost = "db.example.com", RemotePort = "8090" }

In remote mode no local process starts, and Migrations, Backup and S3 are ignored.

Mail

Mail is configured in the PocketBase admin UI, under Settings → Mail. There is no SMTP block in config.lua.

S3

Config.Advanced = {
    S3 = {
        Manage = false, Enabled = false,
        Bucket = "", Region = "", Endpoint = "",
        AccessKey = "", SecretKey = "", ForcePathStyle = false,
    },
}

Manage decides who owns the setting:

Hiding it from the hub

Config.ShowInHub = false   -- default: true