penpot-aio.xml

<?xml version="1.0"?>
<Container version="2">
  <Name>penpot-aio</Name>
  <Repository>jsonbored/penpot-aio:latest</Repository>
  <Registry>https://hub.docker.com/r/jsonbored/penpot-aio</Registry>
  <Network>bridge</Network>
  <MyIP/>
  <Shell>sh</Shell>
  <Privileged>false</Privileged>
  <Support>https://github.com/JSONbored/penpot-aio/issues</Support>
  <Project>https://github.com/JSONbored/penpot-aio</Project>
  <Overview>Penpot is an open-source design and prototyping platform for product teams, designers, and developers.&#xD;
&#xD;
[b]All-In-One Unraid Edition[/b]&#xD;
`penpot-aio` packages Penpot frontend, backend, exporter, MCP server, PostgreSQL, Redis-compatible cache, Nginx, and Mailpit into one practical Unraid-first container.&#xD;
&#xD;
[b]Quick Install (Beginners)[/b]&#xD;
1. Install this template and leave [code]Web UI Port[/code] and [code]AppData[/code] at their defaults unless you have a port or path conflict.&#xD;
2. Set [code]Public URL[/code] to the URL users will actually visit, such as [code]http://tower.local:9001[/code] or your reverse-proxy HTTPS URL.&#xD;
3. Start the container and give first boot a few minutes. The wrapper initializes bundled PostgreSQL, Redis-compatible cache, filesystem assets, Mailpit, MCP, and generated secrets.&#xD;
4. Open the Web UI and create your first account. The default lab path disables email verification and uses local Mailpit; change the flags and SMTP settings before public production use.&#xD;
&#xD;
[b]Power Users (Advanced View)[/b]&#xD;
- Advanced View exposes upstream Penpot configuration, Penpot flags, external PostgreSQL, external Redis/Valkey, SMTP, S3-compatible object storage, OAuth/OIDC/LDAP, telemetry, MCP, SSRF controls, rate/limit/performance tuning, and AIO runtime controls.&#xD;
- Leave database, cache, SMTP, and storage fields blank/defaulted for the bundled one-container path. Set the matching external fields only when intentionally moving that service out of the AIO container.&#xD;
- Blank secret fields generate and persist values in [code]/appdata/config/generated.env[/code]. Explicit template values override generated values.&#xD;
- [code]/appdata/config/extra.env[/code] is loaded as a final sanitized key/value escape hatch, not a substitute for the exposed template options. Only [code]PENPOT_[/code], [code]AWS_[/code], and core runtime keys are accepted; shell syntax is not executed.&#xD;
&#xD;
[b]Important Notes[/b]&#xD;
- Penpot is a real multi-service stack. Plan for at least 2 CPU cores and 4 GiB RAM, with more for active teams or large files.&#xD;
- Public exposure should sit behind a trusted HTTPS reverse proxy. Remove [code]disable-secure-session-cookies[/code] and [code]disable-email-verification[/code] for production.&#xD;
- The bundled Mailpit inbox is for local/lab capture, not real mail deliverability.</Overview>
  <Changes>### 2026-06-18&#xD;
- Generated from CHANGELOG.md during release preparation. Do not edit manually.&#xD;
- Migrate to the shared aio-base s6 overlay (#24)</Changes>
  <Category>Productivity Tools:Utilities</Category>
  <WebUI>http://[IP]:[PORT:8080]</WebUI>
  <TemplateURL>https://raw.githubusercontent.com/JSONbored/awesome-unraid/main/penpot-aio.xml</TemplateURL>
  <ReadMe>https://github.com/JSONbored/penpot-aio#readme</ReadMe>
  <Icon>https://raw.githubusercontent.com/JSONbored/awesome-unraid/main/icons/penpot.png</Icon>
  <ExtraSearchTerms>design prototype figma alternative whiteboard mcp ux ui product design self-hosted</ExtraSearchTerms>
  <Requires>Penpot is a heavier multi-service application. Plan for at least 2 CPU cores and 4 GiB RAM. Use HTTPS and production-safe flags before exposing it publicly.</Requires>
  <Screenshot>https://raw.githubusercontent.com/JSONbored/awesome-unraid/main/screenshots/penpot-aio/01-login.png</Screenshot>
  <Screenshot>https://raw.githubusercontent.com/JSONbored/awesome-unraid/main/screenshots/penpot-aio/02-projects.png</Screenshot>
  <Screenshot>https://raw.githubusercontent.com/JSONbored/awesome-unraid/main/screenshots/penpot-aio/03-editor.png</Screenshot>
  <ExtraParams/>
  <PostArgs/>
  <CPUset/>
  <DateInstalled/>
  <DonateText>Support JSONbored on GitHub Sponsors.</DonateText>
  <DonateLink>https://github.com/sponsors/JSONbored</DonateLink>
  <Description/>
  <Networking>
    <Mode>bridge</Mode>
    <Publish>
      <Port>
        <HostPort>9001</HostPort>
        <ContainerPort>8080</ContainerPort>
        <Protocol>tcp</Protocol>
      </Port>
      <Port>
        <HostPort>8026</HostPort>
        <ContainerPort>8025</ContainerPort>
        <Protocol>tcp</Protocol>
      </Port>
    </Publish>
  </Networking>
  <Data>
    <Volume>
      <HostDir>/mnt/user/appdata/penpot-aio</HostDir>
      <ContainerDir>/appdata</ContainerDir>
      <Mode>rw</Mode>
    </Volume>
  </Data>
  <Environment/>

  <Config Name="Web UI Port" Target="8080" Default="9001" Mode="tcp" Description="Penpot frontend, API gateway, exporter routes, and MCP proxy." Type="Port" Display="always" Required="true" Mask="false">9001</Config>
  <Config Name="Mailpit UI Port" Target="8025" Default="8026" Mode="tcp" Description="Bundled Mailpit inbox UI for local/lab mail capture. Advanced because normal Penpot use starts through the Web UI." Type="Port" Display="advanced" Required="false" Mask="false">8026</Config>
  <Config Name="MCP HTTP Port" Target="4401" Default="" Mode="tcp" Description="Optional direct host port for the Penpot MCP HTTP endpoint. Leave blank unless you need direct MCP access outside the frontend /mcp route." Type="Port" Display="advanced" Required="false" Mask="false"/>
  <Config Name="MCP WebSocket Port" Target="4402" Default="" Mode="tcp" Description="Optional direct host port for the Penpot MCP WebSocket endpoint. Leave blank unless you need direct MCP access outside the frontend /mcp route." Type="Port" Display="advanced" Required="false" Mask="false"/>
  <Config Name="AppData" Target="/appdata" Default="/mnt/user/appdata/penpot-aio" Mode="rw" Description="Persistent Penpot data, PostgreSQL data, cache data, generated secrets, assets, Mailpit data, logs, and optional extra.env." Type="Path" Display="always" Required="true" Mask="false">/mnt/user/appdata/penpot-aio</Config>
  <Config Name="Public URL" Target="PENPOT_PUBLIC_URI" Default="http://localhost:9001" Mode="" Description="Canonical URL users will visit, including http or https. For LAN installs use your Unraid host and mapped port; for public installs use the reverse-proxy HTTPS URL." Type="Variable" Display="always" Required="false" Mask="false">http://localhost:9001</Config>
  <Config Name="[AIO Runtime] Enable Internal Postgres" Target="PENPOT_AIO_ENABLE_INTERNAL_POSTGRES" Default="true|false" Mode="" Description="Use the bundled PostgreSQL database. Set false only when PENPOT_DATABASE_URI points at an external PostgreSQL server." Type="Variable" Display="advanced" Required="false" Mask="false">true</Config>
  <Config Name="[AIO Runtime] Enable Internal Redis" Target="PENPOT_AIO_ENABLE_INTERNAL_REDIS" Default="true|false" Mode="" Description="Use the bundled Redis-compatible cache. Set false only when PENPOT_REDIS_URI points at an external Redis or Valkey service." Type="Variable" Display="advanced" Required="false" Mask="false">true</Config>
  <Config Name="[AIO Runtime] Enable Mailpit" Target="PENPOT_AIO_ENABLE_MAILPIT" Default="true|false" Mode="" Description="Use bundled Mailpit when SMTP_HOST is blank so local email-dependent flows work on first boot." Type="Variable" Display="advanced" Required="false" Mask="false">true</Config>
  <Config Name="[AIO Runtime] Enable MCP" Target="PENPOT_AIO_ENABLE_MCP" Default="true|false" Mode="" Description="Run Penpot MCP inside the AIO container and expose it through the frontend /mcp routes." Type="Variable" Display="advanced" Required="false" Mask="false">true</Config>
  <Config Name="[AIO Runtime] Default Flags" Target="PENPOT_AIO_DEFAULT_FLAGS" Default="disable-email-verification enable-smtp disable-secure-session-cookies enable-mcp" Mode="" Description="Default flags used when PENPOT_FLAGS is blank. Remove disable-* entries before public HTTPS production use." Type="Variable" Display="advanced" Required="false" Mask="false">disable-email-verification enable-smtp disable-secure-session-cookies enable-mcp</Config>
  <Config Name="[AIO Runtime] Extra Env File" Target="PENPOT_AIO_EXTRA_ENV_FILE" Default="/appdata/config/extra.env" Mode="" Description="Optional dotenv-style escape hatch loaded after generated defaults. Only PENPOT_, AWS_, and core runtime keys are accepted; shell syntax is not executed." Type="Variable" Display="advanced" Required="false" Mask="false">/appdata/config/extra.env</Config>
  <Config Name="[AIO Runtime] Wait Timeout Seconds" Target="PENPOT_AIO_WAIT_TIMEOUT_SECONDS" Default="360" Mode="" Description="Startup wait timeout for internal PostgreSQL, Redis, and Mailpit readiness checks." Type="Variable" Display="advanced" Required="false" Mask="false">360</Config>
  <Config Name="[AIO Runtime] Database Name" Target="PENPOT_AIO_DATABASE_NAME" Default="penpot" Mode="" Description="Database name used by the bundled PostgreSQL cluster." Type="Variable" Display="advanced" Required="false" Mask="false">penpot</Config>
  <Config Name="[AIO Runtime] Redis Password" Target="PENPOT_AIO_REDIS_PASSWORD" Default="" Mode="" Description="Optional manual password for bundled Redis. Leave blank to generate and persist one on first boot." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="[AIO Runtime] Redis Maxmemory" Target="PENPOT_AIO_REDIS_MAXMEMORY" Default="256mb" Mode="" Description="Bundled Redis maxmemory setting." Type="Variable" Display="advanced" Required="false" Mask="false">256mb</Config>
  <Config Name="[AIO Runtime] Redis Maxmemory Policy" Target="PENPOT_AIO_REDIS_MAXMEMORY_POLICY" Default="volatile-lfu|allkeys-lfu|allkeys-lru|volatile-lru|noeviction" Mode="" Description="Bundled Redis memory eviction policy." Type="Variable" Display="advanced" Required="false" Mask="false">volatile-lfu</Config>
  <Config Name="[AIO Runtime] Mailpit Ui Username" Target="PENPOT_AIO_MAILPIT_UI_USERNAME" Default="" Mode="" Description="Optional Mailpit UI username. Leave blank to persist the default penpot username." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[AIO Runtime] Mailpit Ui Password" Target="PENPOT_AIO_MAILPIT_UI_PASSWORD" Default="" Mode="" Description="Optional Mailpit UI password. Leave blank to generate and persist one on first boot." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="[AIO Runtime] Mailpit Max Messages" Target="PENPOT_AIO_MAILPIT_MAX_MESSAGES" Default="500" Mode="" Description="Maximum messages retained by the bundled Mailpit inbox." Type="Variable" Display="advanced" Required="false" Mask="false">500</Config>
  <Config Name="[AIO Runtime] Mailpit Max Age" Target="PENPOT_AIO_MAILPIT_MAX_AGE" Default="14d" Mode="" Description="Maximum age for messages retained by bundled Mailpit." Type="Variable" Display="advanced" Required="false" Mask="false">14d</Config>
  <Config Name="[AIO Runtime] Log Level" Target="PENPOT_AIO_LOG_LEVEL" Default="info|debug|warn|error" Mode="" Description="Wrapper log level. This does not replace upstream Penpot logging controls." Type="Variable" Display="advanced" Required="false" Mask="false">info</Config>
  <Config Name="[Storage] AWS Access Key Id" Target="AWS_ACCESS_KEY_ID" Default="" Mode="" Description="Advanced upstream Penpot environment variable AWS_ACCESS_KEY_ID." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="[Storage] AWS Secret Access Key" Target="AWS_SECRET_ACCESS_KEY" Default="" Mode="" Description="Advanced upstream Penpot environment variable AWS_SECRET_ACCESS_KEY." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="[Advanced Upstream] Admins" Target="PENPOT_ADMINS" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_ADMINS." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Advanced Upstream] Allow Demo Users" Target="PENPOT_ALLOW_DEMO_USERS" Default="false|true" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_ALLOW_DEMO_USERS." Type="Variable" Display="advanced" Required="false" Mask="false">false</Config>
  <Config Name="[Storage] Assets Path" Target="PENPOT_ASSETS_PATH" Default="/internal/assets/" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_ASSETS_PATH." Type="Variable" Display="advanced" Required="false" Mask="false">/internal/assets/</Config>
  <Config Name="[Storage] Assets Storage Backend" Target="PENPOT_ASSETS_STORAGE_BACKEND" Default="fs|s3" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_ASSETS_STORAGE_BACKEND." Type="Variable" Display="advanced" Required="false" Mask="false">fs</Config>
  <Config Name="[Advanced Upstream] Audit Log Archive URI" Target="PENPOT_AUDIT_LOG_ARCHIVE_URI" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_AUDIT_LOG_ARCHIVE_URI." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Advanced Upstream] Audit Log Http Handler Concurrency" Target="PENPOT_AUDIT_LOG_HTTP_HANDLER_CONCURRENCY" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_AUDIT_LOG_HTTP_HANDLER_CONCURRENCY." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Auth] Auth Token Cookie Max Age" Target="PENPOT_AUTH_TOKEN_COOKIE_MAX_AGE" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_AUTH_TOKEN_COOKIE_MAX_AGE." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Auth] Auth Token Cookie Name" Target="PENPOT_AUTH_TOKEN_COOKIE_NAME" Default="auth-token" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_AUTH_TOKEN_COOKIE_NAME." Type="Variable" Display="advanced" Required="false" Mask="false">auth-token</Config>
  <Config Name="[Limits/Performance] Auto File Snapshot Every" Target="PENPOT_AUTO_FILE_SNAPSHOT_EVERY" Default="5" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_AUTO_FILE_SNAPSHOT_EVERY." Type="Variable" Display="advanced" Required="false" Mask="false">5</Config>
  <Config Name="[Limits/Performance] Auto File Snapshot Timeout" Target="PENPOT_AUTO_FILE_SNAPSHOT_TIMEOUT" Default="3h" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_AUTO_FILE_SNAPSHOT_TIMEOUT." Type="Variable" Display="advanced" Required="false" Mask="false">3h</Config>
  <Config Name="[Access] Backend URI" Target="PENPOT_BACKEND_URI" Default="http://127.0.0.1:6060" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_BACKEND_URI." Type="Variable" Display="advanced" Required="false" Mask="false">http://127.0.0.1:6060</Config>
  <Config Name="[Database] Database Max Pool Size" Target="PENPOT_DATABASE_MAX_POOL_SIZE" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_DATABASE_MAX_POOL_SIZE." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Database] Database Min Pool Size" Target="PENPOT_DATABASE_MIN_POOL_SIZE" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_DATABASE_MIN_POOL_SIZE." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Database] Database Password" Target="PENPOT_DATABASE_PASSWORD" Default="" Mode="" Description="PostgreSQL password. Leave blank to generate and persist one for the bundled database." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="[Database] Database Readonly" Target="PENPOT_DATABASE_READONLY" Default="false|true" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_DATABASE_READONLY." Type="Variable" Display="advanced" Required="false" Mask="false">false</Config>
  <Config Name="[Database] Database URI" Target="PENPOT_DATABASE_URI" Default="" Mode="" Description="Leave blank for bundled PostgreSQL. Set a PostgreSQL URI only when using an external database." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="[Database] Database Username" Target="PENPOT_DATABASE_USERNAME" Default="penpot" Mode="" Description="PostgreSQL username. The bundled database uses penpot." Type="Variable" Display="advanced" Required="false" Mask="false">penpot</Config>
  <Config Name="[Advanced Upstream] Default Blob Version" Target="PENPOT_DEFAULT_BLOB_VERSION" Default="4" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_DEFAULT_BLOB_VERSION." Type="Variable" Display="advanced" Required="false" Mask="false">4</Config>
  <Config Name="[Limits/Performance] Default Executor Parallelism" Target="PENPOT_DEFAULT_EXECUTOR_PARALLELISM" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_DEFAULT_EXECUTOR_PARALLELISM." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Advanced Upstream] Default Internal Resolver" Target="PENPOT_DEFAULT_INTERNAL_RESOLVER" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_DEFAULT_INTERNAL_RESOLVER." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Limits/Performance] Default Rpc Rlimit" Target="PENPOT_DEFAULT_RPC_RLIMIT" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_DEFAULT_RPC_RLIMIT." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Limits/Performance] Deletion Delay" Target="PENPOT_DELETION_DELAY" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_DELETION_DELAY." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[SMTP] Email Domain Blacklist" Target="PENPOT_EMAIL_DOMAIN_BLACKLIST" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_EMAIL_DOMAIN_BLACKLIST." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[SMTP] Email Domain Whitelist" Target="PENPOT_EMAIL_DOMAIN_WHITELIST" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_EMAIL_DOMAIN_WHITELIST." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[SMTP] Email Verify Threshold" Target="PENPOT_EMAIL_VERIFY_THRESHOLD" Default="15m" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_EMAIL_VERIFY_THRESHOLD." Type="Variable" Display="advanced" Required="false" Mask="false">15m</Config>
  <Config Name="[Telemetry] Error Report Webhook" Target="PENPOT_ERROR_REPORT_WEBHOOK" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_ERROR_REPORT_WEBHOOK." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Limits/Performance] Executor Threads" Target="PENPOT_EXECUTOR_THREADS" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_EXECUTOR_THREADS." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Advanced Upstream] Exporter Shared Key" Target="PENPOT_EXPORTER_SHARED_KEY" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_EXPORTER_SHARED_KEY." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="[Access] Exporter URI" Target="PENPOT_EXPORTER_URI" Default="http://127.0.0.1:6061" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_EXPORTER_URI." Type="Variable" Display="advanced" Required="false" Mask="false">http://127.0.0.1:6061</Config>
  <Config Name="[Limits/Performance] File Clean Delay" Target="PENPOT_FILE_CLEAN_DELAY" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_FILE_CLEAN_DELAY." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Storage] File Data Backend" Target="PENPOT_FILE_DATA_BACKEND" Default="storage|legacy-db|db" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_FILE_DATA_BACKEND." Type="Variable" Display="advanced" Required="false" Mask="false">storage</Config>
  <Config Name="[Core] Flags" Target="PENPOT_FLAGS" Default="" Mode="" Description="Raw upstream Penpot flags. Leave blank to use AIO defaults plus per-flag dropdown controls." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Storage] Font Max File Size" Target="PENPOT_FONT_MAX_FILE_SIZE" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_FONT_MAX_FILE_SIZE." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Auth] Github Client Id" Target="PENPOT_GITHUB_CLIENT_ID" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_GITHUB_CLIENT_ID." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Auth] Github Client Secret" Target="PENPOT_GITHUB_CLIENT_SECRET" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_GITHUB_CLIENT_SECRET." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="[Auth] Gitlab Base URI" Target="PENPOT_GITLAB_BASE_URI" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_GITLAB_BASE_URI." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Auth] Gitlab Client Id" Target="PENPOT_GITLAB_CLIENT_ID" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_GITLAB_CLIENT_ID." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Auth] Gitlab Client Secret" Target="PENPOT_GITLAB_CLIENT_SECRET" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_GITLAB_CLIENT_SECRET." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="[Auth] Google Client Id" Target="PENPOT_GOOGLE_CLIENT_ID" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_GOOGLE_CLIENT_ID." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Auth] Google Client Secret" Target="PENPOT_GOOGLE_CLIENT_SECRET" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_GOOGLE_CLIENT_SECRET." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="[Access] Host" Target="PENPOT_HOST" Default="localhost" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_HOST." Type="Variable" Display="advanced" Required="false" Mask="false">localhost</Config>
  <Config Name="[Access] Http Server Host" Target="PENPOT_HTTP_SERVER_HOST" Default="127.0.0.1" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_HTTP_SERVER_HOST." Type="Variable" Display="advanced" Required="false" Mask="false">127.0.0.1</Config>
  <Config Name="[Limits/Performance] Http Server Io Threads" Target="PENPOT_HTTP_SERVER_IO_THREADS" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_HTTP_SERVER_IO_THREADS." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Limits/Performance] Http Server Max Body Size" Target="PENPOT_HTTP_SERVER_MAX_BODY_SIZE" Default="367001600" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_HTTP_SERVER_MAX_BODY_SIZE." Type="Variable" Display="advanced" Required="false" Mask="false">367001600</Config>
  <Config Name="[Limits/Performance] Http Server Max Multipart Body Size" Target="PENPOT_HTTP_SERVER_MAX_MULTIPART_BODY_SIZE" Default="367001600" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_HTTP_SERVER_MAX_MULTIPART_BODY_SIZE." Type="Variable" Display="advanced" Required="false" Mask="false">367001600</Config>
  <Config Name="[Limits/Performance] Http Server Max Worker Threads" Target="PENPOT_HTTP_SERVER_MAX_WORKER_THREADS" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_HTTP_SERVER_MAX_WORKER_THREADS." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Access] Http Server Port" Target="PENPOT_HTTP_SERVER_PORT" Default="6060" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_HTTP_SERVER_PORT." Type="Variable" Display="advanced" Required="false" Mask="false">6060</Config>
  <Config Name="[Advanced Upstream] Initial Project Skey" Target="PENPOT_INITIAL_PROJECT_SKEY" Default="initial-project" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_INITIAL_PROJECT_SKEY." Type="Variable" Display="advanced" Required="false" Mask="true">initial-project</Config>
  <Config Name="[Access] Internal Resolver" Target="PENPOT_INTERNAL_RESOLVER" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_INTERNAL_RESOLVER." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Auth] LDAP Attrs Email" Target="PENPOT_LDAP_ATTRS_EMAIL" Default="mail" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_LDAP_ATTRS_EMAIL." Type="Variable" Display="advanced" Required="false" Mask="false">mail</Config>
  <Config Name="[Auth] LDAP Attrs Fullname" Target="PENPOT_LDAP_ATTRS_FULLNAME" Default="cn" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_LDAP_ATTRS_FULLNAME." Type="Variable" Display="advanced" Required="false" Mask="false">cn</Config>
  <Config Name="[Auth] LDAP Attrs Photo" Target="PENPOT_LDAP_ATTRS_PHOTO" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_LDAP_ATTRS_PHOTO." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Auth] LDAP Attrs Username" Target="PENPOT_LDAP_ATTRS_USERNAME" Default="uid" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_LDAP_ATTRS_USERNAME." Type="Variable" Display="advanced" Required="false" Mask="false">uid</Config>
  <Config Name="[Auth] LDAP Base Dn" Target="PENPOT_LDAP_BASE_DN" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_LDAP_BASE_DN." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Auth] LDAP Bind Dn" Target="PENPOT_LDAP_BIND_DN" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_LDAP_BIND_DN." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Auth] LDAP Bind Password" Target="PENPOT_LDAP_BIND_PASSWORD" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_LDAP_BIND_PASSWORD." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="[Auth] LDAP Host" Target="PENPOT_LDAP_HOST" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_LDAP_HOST." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Auth] LDAP Port" Target="PENPOT_LDAP_PORT" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_LDAP_PORT." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Auth] LDAP Ssl" Target="PENPOT_LDAP_SSL" Default="false|true" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_LDAP_SSL." Type="Variable" Display="advanced" Required="false" Mask="false">false</Config>
  <Config Name="[Auth] LDAP Starttls" Target="PENPOT_LDAP_STARTTLS" Default="false|true" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_LDAP_STARTTLS." Type="Variable" Display="advanced" Required="false" Mask="false">false</Config>
  <Config Name="[Auth] LDAP User Query" Target="PENPOT_LDAP_USER_QUERY" Default="(&#124;(uid=:username)(mail=:username))" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_LDAP_USER_QUERY." Type="Variable" Display="advanced" Required="false" Mask="false">(&#124;(uid=:username)(mail=:username))</Config>
  <Config Name="[Advanced Upstream] Loggers Loki Environment" Target="PENPOT_LOGGERS_LOKI_ENVIRONMENT" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_LOGGERS_LOKI_ENVIRONMENT." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Advanced Upstream] Loggers Loki Instance" Target="PENPOT_LOGGERS_LOKI_INSTANCE" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_LOGGERS_LOKI_INSTANCE." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Advanced Upstream] Loggers Loki Job" Target="PENPOT_LOGGERS_LOKI_JOB" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_LOGGERS_LOKI_JOB." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Advanced Upstream] Loggers Loki URI" Target="PENPOT_LOGGERS_LOKI_URI" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_LOGGERS_LOKI_URI." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Advanced Upstream] Management Api Key" Target="PENPOT_MANAGEMENT_API_KEY" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_MANAGEMENT_API_KEY." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="[MCP] MCP Log Dir" Target="PENPOT_MCP_LOG_DIR" Default="/appdata/logs/mcp" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_MCP_LOG_DIR." Type="Variable" Display="advanced" Required="false" Mask="false">/appdata/logs/mcp</Config>
  <Config Name="[MCP] MCP Log Level" Target="PENPOT_MCP_LOG_LEVEL" Default="info|debug|warn|error|trace" Mode="" Description="MCP log verbosity." Type="Variable" Display="advanced" Required="false" Mask="false">info</Config>
  <Config Name="[MCP] MCP Remote Mode" Target="PENPOT_MCP_REMOTE_MODE" Default="true|false" Mode="" Description="MCP remote mode. Keep true for the bundled HTTP/WebSocket MCP server path." Type="Variable" Display="advanced" Required="false" Mask="false">true</Config>
  <Config Name="[MCP] MCP Repl Port" Target="PENPOT_MCP_REPL_PORT" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_MCP_REPL_PORT." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[MCP] MCP Server Host" Target="PENPOT_MCP_SERVER_HOST" Default="127.0.0.1" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_MCP_SERVER_HOST." Type="Variable" Display="advanced" Required="false" Mask="false">127.0.0.1</Config>
  <Config Name="[MCP] MCP Server Port" Target="PENPOT_MCP_SERVER_PORT" Default="4401" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_MCP_SERVER_PORT." Type="Variable" Display="advanced" Required="false" Mask="false">4401</Config>
  <Config Name="[MCP] MCP URI" Target="PENPOT_MCP_URI" Default="http://127.0.0.1:4401" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_MCP_URI." Type="Variable" Display="advanced" Required="false" Mask="false">http://127.0.0.1:4401</Config>
  <Config Name="[MCP] MCP URI Ws" Target="PENPOT_MCP_URI_WS" Default="http://127.0.0.1:4402" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_MCP_URI_WS." Type="Variable" Display="advanced" Required="false" Mask="false">http://127.0.0.1:4402</Config>
  <Config Name="[MCP] MCP Websocket Port" Target="PENPOT_MCP_WEBSOCKET_PORT" Default="4402" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_MCP_WEBSOCKET_PORT." Type="Variable" Display="advanced" Required="false" Mask="false">4402</Config>
  <Config Name="[Storage] Media Directory" Target="PENPOT_MEDIA_DIRECTORY" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_MEDIA_DIRECTORY." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Storage] Media Max File Size" Target="PENPOT_MEDIA_MAX_FILE_SIZE" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_MEDIA_MAX_FILE_SIZE." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Storage] Media URI" Target="PENPOT_MEDIA_URI" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_MEDIA_URI." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Limits/Performance] Netty Io Threads" Target="PENPOT_NETTY_IO_THREADS" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_NETTY_IO_THREADS." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Advanced Upstream] Nexus Shared Key" Target="PENPOT_NEXUS_SHARED_KEY" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_NEXUS_SHARED_KEY." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="[Advanced Upstream] Nitrate Backend URI" Target="PENPOT_NITRATE_BACKEND_URI" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_NITRATE_BACKEND_URI." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Advanced Upstream] Nitrate Shared Key" Target="PENPOT_NITRATE_SHARED_KEY" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_NITRATE_SHARED_KEY." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="[Access] Nitrate URI" Target="PENPOT_NITRATE_URI" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_NITRATE_URI." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Storage] Objects Storage " Target="PENPOT_OBJECTS_STORAGE_" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_OBJECTS_STORAGE_." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Storage] Objects Storage Backend" Target="PENPOT_OBJECTS_STORAGE_BACKEND" Default="fs|s3" Mode="" Description="Object storage backend. The AIO default stores assets on the AppData filesystem; S3 requires the matching S3 fields." Type="Variable" Display="advanced" Required="false" Mask="false">fs</Config>
  <Config Name="[Storage] Objects Storage Fs Directory" Target="PENPOT_OBJECTS_STORAGE_FS_DIRECTORY" Default="/appdata/assets" Mode="" Description="Filesystem asset directory for the bundled storage path." Type="Variable" Display="advanced" Required="false" Mask="false">/appdata/assets</Config>
  <Config Name="[Storage] Objects Storage S3 Bucket" Target="PENPOT_OBJECTS_STORAGE_S3_BUCKET" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_OBJECTS_STORAGE_S3_BUCKET." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Storage] Objects Storage S3 Endpoint" Target="PENPOT_OBJECTS_STORAGE_S3_ENDPOINT" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_OBJECTS_STORAGE_S3_ENDPOINT." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Storage] Objects Storage S3 Region" Target="PENPOT_OBJECTS_STORAGE_S3_REGION" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_OBJECTS_STORAGE_S3_REGION." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Auth] OIDC Auth URI" Target="PENPOT_OIDC_AUTH_URI" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_OIDC_AUTH_URI." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="[Auth] OIDC Base URI" Target="PENPOT_OIDC_BASE_URI" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_OIDC_BASE_URI." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Auth] OIDC Client Id" Target="PENPOT_OIDC_CLIENT_ID" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_OIDC_CLIENT_ID." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Auth] OIDC Client Secret" Target="PENPOT_OIDC_CLIENT_SECRET" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_OIDC_CLIENT_SECRET." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="[Auth] OIDC Email Attr" Target="PENPOT_OIDC_EMAIL_ATTR" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_OIDC_EMAIL_ATTR." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Auth] OIDC Jwks URI" Target="PENPOT_OIDC_JWKS_URI" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_OIDC_JWKS_URI." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Auth] OIDC Name Attr" Target="PENPOT_OIDC_NAME_ATTR" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_OIDC_NAME_ATTR." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Auth] OIDC Roles" Target="PENPOT_OIDC_ROLES" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_OIDC_ROLES." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Auth] OIDC Roles Attr" Target="PENPOT_OIDC_ROLES_ATTR" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_OIDC_ROLES_ATTR." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Auth] OIDC Scopes" Target="PENPOT_OIDC_SCOPES" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_OIDC_SCOPES." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Auth] OIDC Token URI" Target="PENPOT_OIDC_TOKEN_URI" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_OIDC_TOKEN_URI." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="[Auth] OIDC User Info Source" Target="PENPOT_OIDC_USER_INFO_SOURCE" Default="auto|userinfo|token" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_OIDC_USER_INFO_SOURCE." Type="Variable" Display="advanced" Required="false" Mask="false">auto</Config>
  <Config Name="[Auth] OIDC User URI" Target="PENPOT_OIDC_USER_URI" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_OIDC_USER_URI." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Advanced Upstream] Prepl Host" Target="PENPOT_PREPL_HOST" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_PREPL_HOST." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Advanced Upstream] Prepl Port" Target="PENPOT_PREPL_PORT" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_PREPL_PORT." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Limits/Performance] Profile Bounce Max Age" Target="PENPOT_PROFILE_BOUNCE_MAX_AGE" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_PROFILE_BOUNCE_MAX_AGE." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Advanced Upstream] Profile Bounce Threshold" Target="PENPOT_PROFILE_BOUNCE_THRESHOLD" Default="10" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_PROFILE_BOUNCE_THRESHOLD." Type="Variable" Display="advanced" Required="false" Mask="false">10</Config>
  <Config Name="[Limits/Performance] Profile Complaint Max Age" Target="PENPOT_PROFILE_COMPLAINT_MAX_AGE" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_PROFILE_COMPLAINT_MAX_AGE." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Advanced Upstream] Profile Complaint Threshold" Target="PENPOT_PROFILE_COMPLAINT_THRESHOLD" Default="2" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_PROFILE_COMPLAINT_THRESHOLD." Type="Variable" Display="advanced" Required="false" Mask="false">2</Config>
  <Config Name="[Limits/Performance] Quotes Access Tokens Per Profile" Target="PENPOT_QUOTES_ACCESS_TOKENS_PER_PROFILE" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_QUOTES_ACCESS_TOKENS_PER_PROFILE." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="[Limits/Performance] Quotes Comments Per File" Target="PENPOT_QUOTES_COMMENTS_PER_FILE" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_QUOTES_COMMENTS_PER_FILE." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Limits/Performance] Quotes Comment Threads Per File" Target="PENPOT_QUOTES_COMMENT_THREADS_PER_FILE" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_QUOTES_COMMENT_THREADS_PER_FILE." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Limits/Performance] Quotes Files Per Project" Target="PENPOT_QUOTES_FILES_PER_PROJECT" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_QUOTES_FILES_PER_PROJECT." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Limits/Performance] Quotes Files Per Team" Target="PENPOT_QUOTES_FILES_PER_TEAM" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_QUOTES_FILES_PER_TEAM." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Limits/Performance] Quotes Font Variants Per Team" Target="PENPOT_QUOTES_FONT_VARIANTS_PER_TEAM" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_QUOTES_FONT_VARIANTS_PER_TEAM." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Limits/Performance] Quotes Invitations Per Team" Target="PENPOT_QUOTES_INVITATIONS_PER_TEAM" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_QUOTES_INVITATIONS_PER_TEAM." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Limits/Performance] Quotes Profiles Per Team" Target="PENPOT_QUOTES_PROFILES_PER_TEAM" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_QUOTES_PROFILES_PER_TEAM." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Limits/Performance] Quotes Projects Per Team" Target="PENPOT_QUOTES_PROJECTS_PER_TEAM" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_QUOTES_PROJECTS_PER_TEAM." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Limits/Performance] Quotes Snapshots Per File" Target="PENPOT_QUOTES_SNAPSHOTS_PER_FILE" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_QUOTES_SNAPSHOTS_PER_FILE." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Limits/Performance] Quotes Snapshots Per Team" Target="PENPOT_QUOTES_SNAPSHOTS_PER_TEAM" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_QUOTES_SNAPSHOTS_PER_TEAM." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Limits/Performance] Quotes Teams Per Profile" Target="PENPOT_QUOTES_TEAMS_PER_PROFILE" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_QUOTES_TEAMS_PER_PROFILE." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Limits/Performance] Quotes Team Access Requests Per Requester" Target="PENPOT_QUOTES_TEAM_ACCESS_REQUESTS_PER_REQUESTER" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_QUOTES_TEAM_ACCESS_REQUESTS_PER_REQUESTER." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Limits/Performance] Quotes Team Access Requests Per Team" Target="PENPOT_QUOTES_TEAM_ACCESS_REQUESTS_PER_TEAM" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_QUOTES_TEAM_ACCESS_REQUESTS_PER_TEAM." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Limits/Performance] Quotes Upload Chunks Per Session" Target="PENPOT_QUOTES_UPLOAD_CHUNKS_PER_SESSION" Default="20" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_QUOTES_UPLOAD_CHUNKS_PER_SESSION." Type="Variable" Display="advanced" Required="false" Mask="false">20</Config>
  <Config Name="[Limits/Performance] Quotes Upload Sessions Per Profile" Target="PENPOT_QUOTES_UPLOAD_SESSIONS_PER_PROFILE" Default="5" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_QUOTES_UPLOAD_SESSIONS_PER_PROFILE." Type="Variable" Display="advanced" Required="false" Mask="false">5</Config>
  <Config Name="[Cache] Redis URI" Target="PENPOT_REDIS_URI" Default="" Mode="" Description="Leave blank for bundled Redis-compatible cache. Set an external Redis or Valkey URI only when disabling the internal cache." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="[Auth] Registration Domain Whitelist" Target="PENPOT_REGISTRATION_DOMAIN_WHITELIST" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_REGISTRATION_DOMAIN_WHITELIST." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Limits/Performance] Rpc Climit Config" Target="PENPOT_RPC_CLIMIT_CONFIG" Default="resources/climit.edn" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_RPC_CLIMIT_CONFIG." Type="Variable" Display="advanced" Required="false" Mask="false">resources/climit.edn</Config>
  <Config Name="[Limits/Performance] Rpc Rlimit Config" Target="PENPOT_RPC_RLIMIT_CONFIG" Default="resources/rlimit.edn" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_RPC_RLIMIT_CONFIG." Type="Variable" Display="advanced" Required="false" Mask="false">resources/rlimit.edn</Config>
  <Config Name="[Limits/Performance] Scheduled Executor Parallelism" Target="PENPOT_SCHEDULED_EXECUTOR_PARALLELISM" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_SCHEDULED_EXECUTOR_PARALLELISM." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Core] Secret Key" Target="PENPOT_SECRET_KEY" Default="" Mode="" Description="Penpot master secret key. Leave blank to generate and persist a strong value on first boot. Changing this later can invalidate sessions and encrypted data." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="[SMTP] SMTP Default From" Target="PENPOT_SMTP_DEFAULT_FROM" Default="Penpot &lt;no-reply@penpot.local&gt;" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_SMTP_DEFAULT_FROM." Type="Variable" Display="advanced" Required="false" Mask="false">Penpot &lt;no-reply@penpot.local&gt;</Config>
  <Config Name="[SMTP] SMTP Default Reply To" Target="PENPOT_SMTP_DEFAULT_REPLY_TO" Default="Penpot &lt;no-reply@penpot.local&gt;" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_SMTP_DEFAULT_REPLY_TO." Type="Variable" Display="advanced" Required="false" Mask="false">Penpot &lt;no-reply@penpot.local&gt;</Config>
  <Config Name="[SMTP] SMTP Host" Target="PENPOT_SMTP_HOST" Default="" Mode="" Description="External SMTP hostname. Leave blank to use bundled Mailpit for local/lab email capture." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[SMTP] SMTP Password" Target="PENPOT_SMTP_PASSWORD" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_SMTP_PASSWORD." Type="Variable" Display="advanced" Required="false" Mask="true"/>
  <Config Name="[SMTP] SMTP Port" Target="PENPOT_SMTP_PORT" Default="" Mode="" Description="External SMTP port. Leave blank with SMTP Host to use bundled Mailpit on internal port 1025." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[SMTP] SMTP Ssl" Target="PENPOT_SMTP_SSL" Default="false|true" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_SMTP_SSL." Type="Variable" Display="advanced" Required="false" Mask="false">false</Config>
  <Config Name="[SMTP] SMTP Tls" Target="PENPOT_SMTP_TLS" Default="false|true" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_SMTP_TLS." Type="Variable" Display="advanced" Required="false" Mask="false">false</Config>
  <Config Name="[SMTP] SMTP Username" Target="PENPOT_SMTP_USERNAME" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_SMTP_USERNAME." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Security/SSRF] SSRF Allowed Hosts" Target="PENPOT_SSRF_ALLOWED_HOSTS" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_SSRF_ALLOWED_HOSTS." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Security/SSRF] SSRF Extra Blocked Cidrs" Target="PENPOT_SSRF_EXTRA_BLOCKED_CIDRS" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_SSRF_EXTRA_BLOCKED_CIDRS." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Storage] Storage Assets " Target="PENPOT_STORAGE_ASSETS_" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_STORAGE_ASSETS_." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Storage] Storage Assets Fs Directory" Target="PENPOT_STORAGE_ASSETS_FS_DIRECTORY" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_STORAGE_ASSETS_FS_DIRECTORY." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Storage] Storage Assets S3 Bucket" Target="PENPOT_STORAGE_ASSETS_S3_BUCKET" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_STORAGE_ASSETS_S3_BUCKET." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Storage] Storage Assets S3 Endpoint" Target="PENPOT_STORAGE_ASSETS_S3_ENDPOINT" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_STORAGE_ASSETS_S3_ENDPOINT." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Storage] Storage Assets S3 Region" Target="PENPOT_STORAGE_ASSETS_S3_REGION" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_STORAGE_ASSETS_S3_REGION." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Telemetry] Telemetry Enabled" Target="PENPOT_TELEMETRY_ENABLED" Default="false|true" Mode="" Description="Usage telemetry toggle. The AIO default is false for privacy-first self-hosting." Type="Variable" Display="advanced" Required="false" Mask="false">false</Config>
  <Config Name="[Telemetry] Telemetry Referer" Target="PENPOT_TELEMETRY_REFERER" Default="unraid-aio" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_TELEMETRY_REFERER." Type="Variable" Display="advanced" Required="false" Mask="false">unraid-aio</Config>
  <Config Name="[Telemetry] Telemetry URI" Target="PENPOT_TELEMETRY_URI" Default="https://telemetry.penpot.app/" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_TELEMETRY_URI." Type="Variable" Display="advanced" Required="false" Mask="false">https://telemetry.penpot.app/</Config>
  <Config Name="[Telemetry] Telemetry With Taiga" Target="PENPOT_TELEMETRY_WITH_TAIGA" Default="false|true" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_TELEMETRY_WITH_TAIGA." Type="Variable" Display="advanced" Required="false" Mask="false">false</Config>
  <Config Name="[Core] Tenant" Target="PENPOT_TENANT" Default="default" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_TENANT." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Advanced Upstream] Urepl Host" Target="PENPOT_UREPL_HOST" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_UREPL_HOST." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Advanced Upstream] Urepl Port" Target="PENPOT_UREPL_PORT" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_UREPL_PORT." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Telemetry] User Feedback Destination" Target="PENPOT_USER_FEEDBACK_DESTINATION" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_USER_FEEDBACK_DESTINATION." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Limits/Performance] Worker Default Parallelism" Target="PENPOT_WORKER_DEFAULT_PARALLELISM" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_WORKER_DEFAULT_PARALLELISM." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Telemetry] Worker Webhook Parallelism" Target="PENPOT_WORKER_WEBHOOK_PARALLELISM" Default="" Mode="" Description="Advanced upstream Penpot environment variable PENPOT_WORKER_WEBHOOK_PARALLELISM." Type="Variable" Display="advanced" Required="false" Mask="false"/>
  <Config Name="[Flags] access-tokens" Target="PENPOT_AIO_FLAG_ACCESS_TOKENS" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag access-tokens. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] audit-log" Target="PENPOT_AIO_FLAG_AUDIT_LOG" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag audit-log. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] audit-log-archive" Target="PENPOT_AIO_FLAG_AUDIT_LOG_ARCHIVE" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag audit-log-archive. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] audit-log-gc" Target="PENPOT_AIO_FLAG_AUDIT_LOG_GC" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag audit-log-gc. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] audit-log-logger" Target="PENPOT_AIO_FLAG_AUDIT_LOG_LOGGER" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag audit-log-logger. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] auto-file-snapshot" Target="PENPOT_AIO_FLAG_AUTO_FILE_SNAPSHOT" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag auto-file-snapshot. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] backend-api-doc" Target="PENPOT_AIO_FLAG_BACKEND_API_DOC" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag backend-api-doc. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] backend-openapi-doc" Target="PENPOT_AIO_FLAG_BACKEND_OPENAPI_DOC" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag backend-openapi-doc. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] backend-svgo" Target="PENPOT_AIO_FLAG_BACKEND_SVGO" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag backend-svgo. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] backend-worker" Target="PENPOT_AIO_FLAG_BACKEND_WORKER" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag backend-worker. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] client-header-check-middleware" Target="PENPOT_AIO_FLAG_CLIENT_HEADER_CHECK_MIDDLEWARE" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag client-header-check-middleware. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] component-thumbnails" Target="PENPOT_AIO_FLAG_COMPONENT_THUMBNAILS" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag component-thumbnails. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] cors" Target="PENPOT_AIO_FLAG_CORS" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag cors. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] dashboard-templates-section" Target="PENPOT_AIO_FLAG_DASHBOARD_TEMPLATES_SECTION" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag dashboard-templates-section. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] demo-users" Target="PENPOT_AIO_FLAG_DEMO_USERS" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag demo-users. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] demo-warning" Target="PENPOT_AIO_FLAG_DEMO_WARNING" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag demo-warning. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] email-blacklist" Target="PENPOT_AIO_FLAG_EMAIL_BLACKLIST" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag email-blacklist. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] email-verification" Target="PENPOT_AIO_FLAG_EMAIL_VERIFICATION" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag email-verification. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] email-whitelist" Target="PENPOT_AIO_FLAG_EMAIL_WHITELIST" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag email-whitelist. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] export-file-v3" Target="PENPOT_AIO_FLAG_EXPORT_FILE_V3" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag export-file-v3. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] exporter-svgo" Target="PENPOT_AIO_FLAG_EXPORTER_SVGO" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag exporter-svgo. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] feature-fdata-objects-map" Target="PENPOT_AIO_FLAG_FEATURE_FDATA_OBJECTS_MAP" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag feature-fdata-objects-map. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] file-schema-validation" Target="PENPOT_AIO_FLAG_FILE_SCHEMA_VALIDATION" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag file-schema-validation. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] file-validation" Target="PENPOT_AIO_FLAG_FILE_VALIDATION" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag file-validation. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] frontend-svgo" Target="PENPOT_AIO_FLAG_FRONTEND_SVGO" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag frontend-svgo. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] google-fonts-provider" Target="PENPOT_AIO_FLAG_GOOGLE_FONTS_PROVIDER" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag google-fonts-provider. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] hide-release-modal" Target="PENPOT_AIO_FLAG_HIDE_RELEASE_MODAL" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag hide-release-modal. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] inspect-styles" Target="PENPOT_AIO_FLAG_INSPECT_STYLES" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag inspect-styles. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] log-emails" Target="PENPOT_AIO_FLAG_LOG_EMAILS" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag log-emails. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] log-invitation-tokens" Target="PENPOT_AIO_FLAG_LOG_INVITATION_TOKENS" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag log-invitation-tokens. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] login" Target="PENPOT_AIO_FLAG_LOGIN" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag login. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] login-with-custom-sso" Target="PENPOT_AIO_FLAG_LOGIN_WITH_CUSTOM_SSO" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag login-with-custom-sso. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] login-with-github" Target="PENPOT_AIO_FLAG_LOGIN_WITH_GITHUB" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag login-with-github. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] login-with-gitlab" Target="PENPOT_AIO_FLAG_LOGIN_WITH_GITLAB" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag login-with-gitlab. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] login-with-google" Target="PENPOT_AIO_FLAG_LOGIN_WITH_GOOGLE" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag login-with-google. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] login-with-ldap" Target="PENPOT_AIO_FLAG_LOGIN_WITH_LDAP" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag login-with-ldap. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] login-with-oidc" Target="PENPOT_AIO_FLAG_LOGIN_WITH_OIDC" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag login-with-oidc. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] login-with-password" Target="PENPOT_AIO_FLAG_LOGIN_WITH_PASSWORD" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag login-with-password. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] mcp" Target="PENPOT_AIO_FLAG_MCP" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag mcp. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] nitrate" Target="PENPOT_AIO_FLAG_NITRATE" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag nitrate. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] nrepl-server" Target="PENPOT_AIO_FLAG_NREPL_SERVER" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag nrepl-server. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] oidc-registration" Target="PENPOT_AIO_FLAG_OIDC_REGISTRATION" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag oidc-registration. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] onboarding" Target="PENPOT_AIO_FLAG_ONBOARDING" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag onboarding. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] perf-logs" Target="PENPOT_AIO_FLAG_PERF_LOGS" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag perf-logs. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] prepl-server" Target="PENPOT_AIO_FLAG_PREPL_SERVER" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag prepl-server. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] quotes" Target="PENPOT_AIO_FLAG_QUOTES" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag quotes. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] redis-cache" Target="PENPOT_AIO_FLAG_REDIS_CACHE" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag redis-cache. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] registration" Target="PENPOT_AIO_FLAG_REGISTRATION" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag registration. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] render-wasm-dpr" Target="PENPOT_AIO_FLAG_RENDER_WASM_DPR" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag render-wasm-dpr. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] rpc-climit" Target="PENPOT_AIO_FLAG_RPC_CLIMIT" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag rpc-climit. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] rpc-rlimit" Target="PENPOT_AIO_FLAG_RPC_RLIMIT" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag rpc-rlimit. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] sec-fetch-metadata-middleware" Target="PENPOT_AIO_FLAG_SEC_FETCH_METADATA_MIDDLEWARE" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag sec-fetch-metadata-middleware. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] secure-session-cookies" Target="PENPOT_AIO_FLAG_SECURE_SESSION_COOKIES" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag secure-session-cookies. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] smtp" Target="PENPOT_AIO_FLAG_SMTP" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag smtp. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] smtp-debug" Target="PENPOT_AIO_FLAG_SMTP_DEBUG" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag smtp-debug. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] soft-file-schema-validation" Target="PENPOT_AIO_FLAG_SOFT_FILE_SCHEMA_VALIDATION" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag soft-file-schema-validation. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] soft-file-validation" Target="PENPOT_AIO_FLAG_SOFT_FILE_VALIDATION" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag soft-file-validation. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] soft-quotes" Target="PENPOT_AIO_FLAG_SOFT_QUOTES" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag soft-quotes. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] soft-rpc-rlimit" Target="PENPOT_AIO_FLAG_SOFT_RPC_RLIMIT" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag soft-rpc-rlimit. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] strict-session-cookies" Target="PENPOT_AIO_FLAG_STRICT_SESSION_COOKIES" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag strict-session-cookies. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] subscriptions" Target="PENPOT_AIO_FLAG_SUBSCRIPTIONS" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag subscriptions. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] subscriptions-old" Target="PENPOT_AIO_FLAG_SUBSCRIPTIONS_OLD" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag subscriptions-old. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] telemetry" Target="PENPOT_AIO_FLAG_TELEMETRY" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag telemetry. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] terms-and-privacy-checkbox" Target="PENPOT_AIO_FLAG_TERMS_AND_PRIVACY_CHECKBOX" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag terms-and-privacy-checkbox. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] tiered-file-data-storage" Target="PENPOT_AIO_FLAG_TIERED_FILE_DATA_STORAGE" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag tiered-file-data-storage. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] token-base-font-size" Target="PENPOT_AIO_FLAG_TOKEN_BASE_FONT_SIZE" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag token-base-font-size. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] token-color" Target="PENPOT_AIO_FLAG_TOKEN_COLOR" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag token-color. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] token-shadow" Target="PENPOT_AIO_FLAG_TOKEN_SHADOW" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag token-shadow. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] token-tokenscript" Target="PENPOT_AIO_FLAG_TOKEN_TOKENSCRIPT" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag token-tokenscript. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] transit-readable-response" Target="PENPOT_AIO_FLAG_TRANSIT_READABLE_RESPONSE" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag transit-readable-response. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] urepl-server" Target="PENPOT_AIO_FLAG_UREPL_SERVER" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag urepl-server. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] user-feedback" Target="PENPOT_AIO_FLAG_USER_FEEDBACK" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag user-feedback. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] v2-migration" Target="PENPOT_AIO_FLAG_V2_MIGRATION" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag v2-migration. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
  <Config Name="[Flags] webhooks" Target="PENPOT_AIO_FLAG_WEBHOOKS" Default="default|enable|disable" Mode="" Description="Per-flag control for Penpot flag webhooks. default leaves upstream/AIO defaults alone; enable or disable appends the matching flag token when PENPOT_FLAGS is blank." Type="Variable" Display="advanced" Required="false" Mask="false">default</Config>
</Container>