Settings

Logging & audit

Log level

Error Warn Info Debug

Applies at once. Debug is verbose.

Audit retention

How long audit events and finished update transactions (with their logs) are kept. A running transaction is never removed. 8760h is 365 days.

At least 24h. 720h = 30 days.

Prometheus metrics

Serve /metrics

Off: /metrics answers 404.

Scrape token

Bearer token a remote Prometheus sends (Authorization: Bearer ...). Empty: only a scraper on this host, not behind a proxy, is served. Applies at once.

Write-only. Empty: local scraper only.

Device names in metric labels

Off: metrics carry counts only.

Device networks

Where your devices live.

Device networks

TasmoFleet never contacts an address outside these networks: no polling, no scan, no update.

Reset to defaultDefault, set on save

CIDRs, one per line or comma separated.

Health checks

How often devices are checked.

HTTP poll interval Reset to defaultDefault, set on save

Without MQTT. At least 1s.

Policy check read

How often each device is read for the policy view (jittered, side-effect-free queries). 0 = no background reads; MQTT updates and the on-demand check stay.

0 = off.

Telemetry period

Expected telemetry period. A device counts as stale after twice this period plus a minute.

Stale after 2× + 1 min.

Settings text area warning

Warn on the device page when a device's settings text area (Status 2 CR) is fuller than this.

Percent, 50 to 100.

Default device credentials

Prefilled for new devices.

Web user

admin

Fixed by Tasmota.

Default device password

Prefilled as the web password when you add a device or accept a discovered one (user admin). Each device keeps its own copy; you can still change it per device.

Reset to defaultDefault, set on save

Write-only. Prefills new devices.

Broker

Changes apply at once. An empty host turns MQTT off.

Host Reset to defaultDefault, set on save

Port

TLS

Use TLS

User

Empty if the broker needs no login.

Password

Write-only. Empty keeps it.

Saves nothing.

Topics

Full topic pattern

Discovery listens on tasmota/discovery/+/config.

Must contain %prefix% and %topic% once each.

MQTT discovery

MQTT discovery is listening Topic tasmota/discovery/+/config · 5 new devices waiting

Discover devices from MQTT

A discovered device is never added on its own: an admin accepts it on the Discovered page.

Needs MQTT. Finds are proposals.

Open Discovered

Network scan

Scheduled network scan

Probes the networks below on a schedule.

Scan interval

At least 1h.

Scan networks

Each CIDR must lie inside the device networks and hold at most 1024 addresses (/22).

Inside the device networks, max /22 each.

Scans only inside the device networks (Network & devices).

Events

What is sent. Every channel gets the same events.

Update job finished

One message per job, not per device.

Send when

Any result Failed or partial only

Scheduled device backup failed

Counts the scheduled run only. A manual backup shows its error on screen. All devices that fail in one run make one message.

One message per run, listing the devices.

Database snapshot failed

The nightly SQLite snapshot.

Browser

Desktop notifications while a TasmoFleet tab is open. Set per browser; nothing is stored on the server.

Needs JavaScript Browser notifications are set up on this page with scripts on.

Message

Read-only preview.

POST <webhook URL>
Content-Type: application/json

{
  "event": "update.finished",
  "result": "partial",
  "title": "Update job #41: 11 ok, 1 failed",
  "text": "12 devices to 16.1.0; 1 failed",
  "url": "",
  "time": "2026-10-31T03:12:07+01:00"
}

The whole webhook request: request line, headers and body (the secret header is not shown). The e-mail uses the title as subject and the text as body, with the link when TASMOFLEET_PUBLIC_URL is set.

Webhook

Home Assistant, ntfy, Gotify, anything that takes a POST.

Send to a webhook

POST a message when an event above happens.

Format

Generic JSON and Home Assistant send the same body. For Home Assistant use a webhook trigger and the address http://<host>:8123/api/webhook/<id>; the automation reads trigger.json.event, .result, .title and .text. ntfy: enter the topic address (https://ntfy.sh/<topic>); the message is plain text with a title, a link (with TASMOFLEET_PUBLIC_URL) and a priority. Gotify: enter http://<host>/message and put the application token in the secret header X-Gotify-Key (not in the address).

What the receiver expects. Details under the info icon.

Webhook URL

The address is stored as entered. Its path and query can be a secret (a Home Assistant webhook id): the audit log, the status line and the logs show only scheme, host and port.

http or https. Local addresses are fine.

Authentication

None: a Home Assistant webhook id is its own secret. Secret header: a fixed header such as a bearer token, sent with every message.

None Secret header

Header name

Header value

Sent only to the exact address it was entered for. Change the address (host, port, scheme, path or query) and it must be entered again; a save or a test without it sends none.

Write-only. Empty keeps it, for the same address only.

Not configured Turn it on and enter a URL.

Sends a test message with the values above. Saves nothing.

E-mail (SMTP)

SMTP with STARTTLS, TLS or none. No provider APIs in this version.

Send e-mail

One message per event.

SMTP host

Port

Security

User

Empty if the server needs no login.

Password

Sent only to the server, port, security and user it was entered for. Change one of them and it must be entered again; a save or a test without it sends none.

Write-only. Empty keeps it, for the same server only.

From

Several addresses separated by commas.

Not configured Turn it on and enter a host.

Sends one test e-mail. Saves nothing.

Firmware source

Firmware base URL

Devices download firmware from this address, e.g. the container address. Required for updates.

RestartReset to defaultDefault, set on save

Plain http:// address devices fetch firmware from.

Upstream sources Restart

githubota.tasmota.com

Two sources = cross-check.

Index refresh interval

How often the upstream index is refreshed in the background, e.g. 6h.

Restart

0 = only at start.

Releases kept

Cached firmware of releases older than the newest this many is deleted after an index refresh and once a day. Files a queued or running update needs and uploads stay.

0 = never delete.

Cross-check

Restart

Accept single-source files

Off: a firmware file must be offered by two sources with the same checksum. On: one source is enough. Shown in the warning colour while on.

Off is recommended.

Updates (OTA)

Updates in parallel

Fleet-wide.

Restore original OtaUrl

Device gets its previous update address back.

Key	Value
`TASMOFLEET_DATA_DIR`	`/data`
`TASMOFLEET_LISTEN`	`192.0.2.69`
`TASMOFLEET_FIRMWARE_LISTEN`	`192.0.2.70`
`TASMOFLEET_PUBLIC_URL`	empty
`TASMOFLEET_BASE_PATH`	empty
`TASMOFLEET_LOG_FORMAT`	`text`
`TASMOFLEET_TRUSTED_PROXIES`	`127.0.0.1/32`
`TASMOFLEET_OIDC_POST_LOGOUT_URL`	empty
`TASMOFLEET_HEADER_USER`	`X-authentik-username`
`TASMOFLEET_HEADER_NAME`	`X-authentik-name`
`TASMOFLEET_HEADER_EMAIL`	`X-authentik-email`
`TASMOFLEET_HEADER_GROUPS`	`X-authentik-groups`
`TASMOFLEET_HEADER_GROUPS_SEPARATOR`	`\|`

Key	Value
`TASMOFLEET_HEADER_LOGOUT_URL`	empty
`TASMOFLEET_LOCAL_LOGIN`	`true`
`TASMOFLEET_SESSION_IDLE`	`2h`
`TASMOFLEET_SESSION_MAX`	`12h`
`TASMOFLEET_OIDC_RECHECK`	`15m`
`TASMOFLEET_INITIAL_ADMIN_PASSWORD`	empty
`TASMOFLEET_TLS_CERT_FILE`	empty
`TASMOFLEET_TLS_KEY_FILE`	empty
`TASMOFLEET_TLS_SANS`	empty
`TASMOFLEET_ALLOW_INSECURE_HTTP`	`false`
`TASMOFLEET_FIRMWARE_UPSTREAM_OVERRIDE`	`http://192.0.2.71/github`
`TASMOFLEET_DECODER_PATH`	`/usr/local/bin/decode-config`

Logging & audit

Prometheus metrics

Device networks

Health checks

Default device credentials

Broker

Topics

MQTT discovery

Network scan

Events

Browser

Message

Webhook

E-mail (SMTP)

Firmware source

Cross-check

Updates (OTA)

Set by the container

Reset all settings?

Settings

Logging & audit

Prometheus metrics

Device networks

Health checks

Default device credentials

Broker

Topics

MQTT discovery

Network scan

Events

Browser

Message

Webhook

E-mail (SMTP)

Firmware source

Cross-check

Updates (OTA)

Sign-in mode

Identity provider

Roles and claims

Set by the container