maren

Settings

Settings

Applies to the whole TasmoFleet instance

Events

What is sent. Every channel gets the same events.

Update job finished

One message per job, not per device.

Send when

Any result Failed or partial only

Scheduled device backup failed

Counts the scheduled run only. A manual backup shows its error on screen. All devices that fail in one run make one message.

One message per run, listing the devices.

Database snapshot failed

The nightly SQLite snapshot.

Browser

Desktop notifications while a TasmoFleet tab is open. Set per browser; nothing is stored on the server.

Needs JavaScript Browser notifications are set up on this page with scripts on.

Message

Read-only preview.

POST <webhook URL>
Content-Type: application/json

{
  "event": "update.finished",
  "result": "partial",
  "title": "Update job #41: 11 ok, 1 failed",
  "text": "12 devices to 16.1.0; 1 failed",
  "url": "",
  "time": "2026-10-31T03:12:07+01:00"
}

The whole webhook request: request line, headers and body (the secret header is not shown). The e-mail uses the title as subject and the text as body, with the link when TASMOFLEET_PUBLIC_URL is set.

Webhook

Home Assistant, ntfy, Gotify, anything that takes a POST.

Send to a webhook

POST a message when an event above happens.

Format

Generic JSON and Home Assistant send the same body. For Home Assistant use a webhook trigger and the address http://<host>:8123/api/webhook/<id>; the automation reads trigger.json.event, .result, .title and .text. ntfy: enter the topic address (https://ntfy.sh/<topic>); the message is plain text with a title, a link (with TASMOFLEET_PUBLIC_URL) and a priority. Gotify: enter http://<host>/message and put the application token in the secret header X-Gotify-Key (not in the address).

What the receiver expects. Details under the info icon.

Webhook URL

The address is stored as entered. Its path and query can be a secret (a Home Assistant webhook id): the audit log, the status line and the logs show only scheme, host and port.

http or https. Local addresses are fine.

Authentication

None: a Home Assistant webhook id is its own secret. Secret header: a fixed header such as a bearer token, sent with every message.

None Secret header

Header name

Header value

Sent only to the exact address it was entered for. Change the address (host, port, scheme, path or query) and it must be entered again; a save or a test without it sends none.

Write-only. Empty keeps it, for the same address only.

Not configured Turn it on and enter a URL.

Sends a test message with the values above. Saves nothing.

E-mail (SMTP)

SMTP with STARTTLS, TLS or none. No provider APIs in this version.

Send e-mail

One message per event.

SMTP host

Port

Security

User

Empty if the server needs no login.

Password

Sent only to the server, port, security and user it was entered for. Change one of them and it must be entered again; a save or a test without it sends none.

Write-only. Empty keeps it, for the same server only.

From

To

Several addresses separated by commas.

Not configured Turn it on and enter a host.

Sends one test e-mail. Saves nothing.

Sign-in mode

Asks you to confirm

Sign-in mode Environment

header

TASMOFLEET_AUTH_MODE in the container configuration.

Needs TASMOFLEET_PUBLIC_URL in the container configuration. The local admin always works as a fallback.

Identity provider

Disabled while Local accounts is selected.

RestartAsks you to confirm

Issuer URL

Must equal the issuer in the provider's discovery document (/.well-known/openid-configuration), character for character. Authentik's ends with a slash, e.g. https://auth.example/application/o/tasmofleet/; with another provider the slash may be missing, and adding it makes discovery fail.

Exactly the issuer your identity provider publishes.

Saves nothing.

Client ID

Registered for TasmoFleet at your IdP.

Client secret

Sent only to the issuer it was entered for. Change the issuer and the secret must be entered again.

Write-only.

Scopes

Comma separated.

Display name claim

Claim with the person's full name, shown instead of the user name. Users can override it on their Account page.

Default: name.

Button name

Name of your identity provider on the login page. Default: Single sign-on.

“Sign in with <name>”.

Roles and claims

RestartAsks you to confirm

Admin groups Environment

adm

TASMOFLEET_ADMIN_GROUPS in the container configuration.

Operator groups Environment

ops

TASMOFLEET_OPERATOR_GROUPS in the container configuration.

Groups claim

Claim in the ID token that lists the user's groups.

Default: groups.

User name claim

Claim shown as the user name.

Default: preferred_username.

No unsaved changes Discard

Set by the container

Read-only. Change them in the container configuration.

Bootstrap settings (listeners, TLS, keys) come from the container configuration only and are never editable here.

Key	Value
`TASMOFLEET_DATA_DIR`	`/data`
`TASMOFLEET_LISTEN`	`192.0.2.69`
`TASMOFLEET_FIRMWARE_LISTEN`	`192.0.2.70`
`TASMOFLEET_PUBLIC_URL`	empty
`TASMOFLEET_BASE_PATH`	empty
`TASMOFLEET_LOG_FORMAT`	`text`
`TASMOFLEET_TRUSTED_PROXIES`	`127.0.0.1/32`
`TASMOFLEET_OIDC_POST_LOGOUT_URL`	empty
`TASMOFLEET_HEADER_USER`	`X-authentik-username`
`TASMOFLEET_HEADER_NAME`	`X-authentik-name`
`TASMOFLEET_HEADER_EMAIL`	`X-authentik-email`
`TASMOFLEET_HEADER_GROUPS`	`X-authentik-groups`
`TASMOFLEET_HEADER_GROUPS_SEPARATOR`	`\|`

Key	Value
`TASMOFLEET_HEADER_LOGOUT_URL`	empty
`TASMOFLEET_LOCAL_LOGIN`	`true`
`TASMOFLEET_SESSION_IDLE`	`2h`
`TASMOFLEET_SESSION_MAX`	`12h`
`TASMOFLEET_OIDC_RECHECK`	`15m`
`TASMOFLEET_INITIAL_ADMIN_PASSWORD`	empty
`TASMOFLEET_TLS_CERT_FILE`	empty
`TASMOFLEET_TLS_KEY_FILE`	empty
`TASMOFLEET_TLS_SANS`	empty
`TASMOFLEET_ALLOW_INSECURE_HTTP`	`false`
`TASMOFLEET_FIRMWARE_UPSTREAM_OVERRIDE`	`http://192.0.2.71/github`
`TASMOFLEET_DECODER_PATH`	`/usr/local/bin/decode-config`

Reset all settings

Devices, backups and users are kept.

Reset settings…