Configuration

The server, goned, is configured only through environment variables. There are no command-line flags and no config files. An invalid value stops it at startup with an error that names the variable.

Server variables

Expiry format

GONE_TTL_OPTIONS takes Go durations with s, m or h, such as 30s,5m,90m,2h. Day and week units (d, w) are not accepted; write 24h or 168h.

The smallest and largest options set the accepted range. The API accepts any duration inside it, not just the listed ones; the web form offers only the listed ones and preselects the shortest, so a longer lifetime is always a deliberate choice. There is no setting for the preselected option.

Policies

Two settings let an operator narrow what people may send. Clients read them from GET /api/policy before they encrypt anything.

Replies to requests never need a passphrase. A reply link carries no decryption key, only the requester’s public key, so a leaked reply link can’t open a reply; see Technical decisions for the full reasoning. Replies do follow GONE_MAX_FILES.

Branding

The six branding settings put your name, logo and accent colour on an unmodified copy of Gone and link your contact, imprint and privacy pages from the footer. Each is optional and works alone; unbranded instances look exactly as before. Branding your instance shows each setting with screenshots of the result.

In short:

• Header: the logo and name replace the Gone wordmark. An accent alone recolours the page but keeps the wordmark, and footer links alone don’t change it.
• Accent: your two colours replace Gone’s violet in heading highlights, focus rings and progress bars. Each must reach 4.5:1 contrast on its theme’s background, or the server won’t start.
• Footer: your links come first. The version line reads “Powered by Gone”, and it, the copyright notice and the project links can’t be removed.
• Everything else stays Gone: page titles, the favicon, the About page and the page text.

Sign-in

GONE_AUTH makes creating secrets and requests require sign-in through your proxy, for a private instance. Opening, replying and the manage links stay open, so recipients never need an account. Sign-in for private instances covers every provider, the paths to leave open, and recipes.

In short:

• Signed providers (cloudflare, google-iap, pomerium, teleport, oidc) verify the token’s signature, issuer, audience and expiry. They start without GONE_TRUSTED_PROXIES but warn.
• Plain-header providers (authelia, authentik, tailscale, custom) refuse to start without GONE_TRUSTED_PROXIES, and believe the header only from those addresses. In a Kubernetes pod they log a warning, and the Helm chart refuses them; see Kubernetes.
• A setting that doesn’t apply to the chosen provider stops the server.
• Gone never stores or logs who signed in.
• cloudflare, google-iap, pomerium, teleport, authentik and tailscale are built from vendor documentation but not yet tested against the live products; see Providers.

Derived settings

• The database is <GONE_DATA_DIR>/gone.db. It runs in WAL mode with synchronous=FULL, so a confirmed claim survives a power cut.
• Blobs are stored in <GONE_DATA_DIR>/blobs/.

CLI variables

The gone command-line client reads one variable:

See the CLI reference for the full precedence and every flag.

Example

GONE_ADDR=127.0.0.1:8080 \
GONE_DATA_DIR=/srv/gone \
GONE_TTL_OPTIONS=5m,30m,1h \
GONE_MAX_BYTES=$((1024*1024)) \
GONE_TRUSTED_PROXIES=127.0.0.1 \
goned