Configuration

Remem is configured two ways: a small set of environment variables (mostly for secrets and deployment-level settings), and a remem-server.toml config file for everything else — storage, vector index, embedding, connections, and background task schedules.

Environment variables

Variable	Default	Description
`REMEM_API_KEY`	(empty)	API key for `remem-server`. Required in production.
`REMEM_API_KEY_SECONDARY`	(empty)	Optional second accepted key, for zero-downtime key rotation — set the new key here, roll out callers, then promote it to `REMEM_API_KEY` and drop this.
`REMEM_ALLOW_AUTH_DISABLED`	`false`	Set `true` to explicitly allow running with no API key (development only).
`REMEM_CORS_ORIGINS`	(empty)	Comma-separated allowed CORS origins.
`REMEM_ENV`	`development`	Set `production` to enforce the production safety gate — see below.
`REMEM_RATE_LIMIT_RPS`	`100`	Per-client requests/second (keyed by IP). `0` disables rate limiting.
`REMEM_RATE_LIMIT_BURST`	`50`	Burst allowance on top of the steady rate.
`REMEM_TRUST_PROXY_HEADERS`	`false`	Set `true` to key rate limits by `X-Forwarded-For`/`Forwarded` instead of the TCP peer IP — only correct behind a trusted reverse proxy that strips client-supplied values for these headers.
`RUST_LOG`	`info`	Log filter: `trace`/`debug`/`info`/`warn`/`error`.
`REMEM_SERVER_URL`	`http://remem-server:4545`	`remem-mcp` binary → `remem-server` endpoint.

Everything else — port, data directory, HNSW parameters, embedding model, auto-discovery threshold, task schedules — lives in remem-server.toml, not environment variables.

Production safety gate

Setting REMEM_ENV=production makes remem-server refuse to start if the configuration looks unsafe for production:

REMEM_ALLOW_AUTH_DISABLED=true is set
REMEM_API_KEY is empty, shorter than 16 characters, or matches a known placeholder value
REMEM_CORS_ORIGINS is empty (permissive CORS)

This catches exactly the defaults a freshly-copied .env.example ships with, so a misconfigured production deploy fails fast at boot instead of running open.

`config/remem-server.toml`

[server]
port = 4545
host = "0.0.0.0"
api_key = ""                        # empty = auth disabled (dev only)

[storage]
data_dir = "/var/lib/remem"
sync_writes = true
checkpoint_interval_secs = 300      # flush indexes to disk every 5 minutes
max_wal_size_mb = 256               # trigger checkpoint when WAL exceeds this

[vector]
dimension = 384                     # must match the embedding model
hnsw_m = 16                         # connections per node (16-64 recommended)
hnsw_ef_construction = 200          # build quality (100-400 recommended)
hnsw_ef_search = 50                 # search quality (40-200 recommended)

[embedding]
model = "all-MiniLM-L6-v2"
cache_size = 10000                  # embeddings kept in LRU cache

[connections]
auto_discovery_threshold = 0.7      # minimum similarity to auto-link two memories
auto_discovery_top_k = 5            # max auto-created connections per new memory

[tasks]
expire_short_term_secs = 300
apply_importance_decay_secs = 86400
active_forgetting_secs = 86400
consolidate_similar_secs = 604800
cleanup_archived_secs = 2592000
discover_connections_secs = 3600
discovery_workers = 2
discovery_queue_size = 10000

Mount this file into the remem-server container at /etc/remem/config.toml (read-only) via docker-compose.yml. dimension in [vector] must match the embedding model’s output size — changing [embedding].model requires updating dimension to match and reindexing existing data; dimension changes are not migrated automatically.

Authentication

Auth is fail-closed by default: if REMEM_API_KEY is empty and REMEM_ALLOW_AUTH_DISABLED is not set, remem-server returns HTTP 500 on every request rather than silently allowing unauthenticated access.

To run with auth enabled, set REMEM_API_KEY:

Authorization: Bearer your-secret-key

or X-API-Key: your-secret-key. To run without auth (development only), explicitly set REMEM_ALLOW_AUTH_DISABLED=true. /api/v1/health, /api/v1/ready, and /api/v1/openapi.json never require auth.

Docker Compose environment

services:
  remem-server:
    image: rememorg/remem-community:server-latest
    environment:
      - RUST_LOG=info
      - REMEM_API_KEY=${REMEM_API_KEY}
      - REMEM_CORS_ORIGINS=http://localhost:5173
    volumes:
      - ./config/remem-server.toml:/etc/remem/config.toml:ro   # optional — omit to run on built-in defaults

Mounting config.toml is optional — remem-server runs on built-in defaults when nothing is mounted at /etc/remem/config.toml. See Docker Compose for the minimal zero-config compose file, and its “Enabling authentication” section for the dev-mode REMEM_ALLOW_AUTH_DISABLED alternative to setting a real REMEM_API_KEY.