---
title: "Server settings"
summary: "Settings for the listener that serves the browser, API, chat, MCP and both OTLP transports."
description: "The shared HTTP and OTLP listener, the public URL, TLS, and proxy trust."
status: preview
generated: true
read_when:
  - "You are putting Fanout behind a reverse proxy."
  - "Browser sessions are not getting Secure cookies."
---

Every setting below is read once at startup and requires a restart to change.
Built-in defaults are overridden by nonempty environment values.
Unknown `FANOUT_` names fail startup; platform-injected service names are tolerated.
Vendor credentials and endpoints keep the vendor's documented names.

| Environment variable | Type | Default |
|---|---|---|
| `FANOUT_ADDR` | string | `127.0.0.1:7520` |
| `FANOUT_PPROF_ENABLED` | boolean | `false` |
| `FANOUT_PUBLIC_URL` | string | — |
| `FANOUT_TLS_CERT_FILE` | string | — |
| `FANOUT_TLS_KEY_FILE` | string | — |
| `FANOUT_TRUSTED_PROXY_CIDRS` | string | — |

## Notes

### `FANOUT_ADDR`

Binds the browser, API, MCP, OTLP/gRPC and OTLP/HTTP listener.

### `FANOUT_PPROF_ENABLED`

Exposes Go's net/http/pprof handlers at /debug/pprof/* for CPU/heap/mutex/goroutine profiling under load. Off by default; the routes require an admin browser session with operations:read.

### `FANOUT_PUBLIC_URL`

Sets the external browser origin, MCP token audience, and trusted MCP request origin. Required for OIDC; HTTPS is required with MCP.

### `FANOUT_TLS_CERT_FILE`

Selects the TLS certificate file; requires FANOUT_TLS_KEY_FILE.

### `FANOUT_TLS_KEY_FILE`

Selects the TLS private key file; requires FANOUT_TLS_CERT_FILE.

### `FANOUT_TRUSTED_PROXY_CIDRS`

Lists trusted proxy networks, separated by commas; empty trusts no forwarded client addresses.