git-annex(1)

📦

version 10.20261026 · 12 versions

10.20261026 · alpine 3.24, arch rolling (latest)
10.20250828 · opensuse-leap 16.0
10.20250320 · epel 10
10.20260421 · nixos 26.05, nixpkgs unstable
10.20250416 · debian trixie
8.20210223 · ubuntu jammy
10.20250721 · fedora 43, ubuntu questing
10.20240129 · ubuntu noble
10.20260115 · fedora 44
10.20230126 · debian bookworm
10.20251029 · fedora 43, ubuntu resolute, ubuntu stonking
10.20250416 · debian trixie

💖 git-annex(1) — the girlies' guide to managing files with git 💖

okay so this is part of the General Commands Manual (the git-annex manual, obvs) and bestie, buckle up, because this one is a whole vibe. ✨

🌸 NAME 🌸

git-annex — manage files with git, without checking their contents in

✨ SYNOPSIS ✨

git annex command [params ...]

🦋 DESCRIPTION 🦋

git-annex lets you manage files with git without checking the file contents into git. and like, yes, that sounds paradoxical at first — I know 😭 — but it's genuinely useful when you're dealing with files bigger than git can currently easily handle, whether that's because of limitations in memory, checksumming time, or disk space.

Even without file content tracking, being able to manage files with git, move files around and delete files with versioned directory trees, and use branches and distributed clones are all very handy reasons to use git. and here's the slay part: annexed files can co-exist in the same git repository with regularly versioned files, which is super convenient for maintaining documents, Makefiles, etc that are associated with annexed files but that benefit from full revision control. 👑

When a file is annexed, its content is moved into a key-value store, and a symlink is made that points to the content. These symlinks are checked into git and versioned like regular files. You can move them around, delete them, and so on. Pushing to another git repository will make git-annex there aware of the annexed file, and it can be used to retrieve its content from the key-value store. it's giving ✨distributed✨ and we're obsessed.

🎀 EXAMPLES 🎀

like, real ones. no cap. 🫶

 # git annex get video/hackity_hack_and_kaxxt.mov
 get video/hackity_hack_and_kaxxt.mov (not available)
   I was unable to access these remotes: server
   Try making some of these repositories available:
        5863d8c0-d9a9-11df-adb2-af51e6559a49  -- my home file server
         58d84e8a-d9ae-11df-a1aa-ab9aa8c00826  -- portable USB drive
         ca20064c-dbb5-11df-b2fe-002170d25c55  -- backup SATA drive
 failed
 # sudo mount /media/usb
 # git remote add usbdrive /media/usb
 # git annex get video/hackity_hack_and_kaxxt.mov
 get video/hackity_hack_and_kaxxt.mov (from usbdrive...) ok

 # git annex add iso
 add iso/Debian_5.0.iso ok

 # git annex drop iso/Debian_4.0.iso
 drop iso/Debian_4.0.iso ok

 # git annex move iso --to=usbdrive
 move iso/Debian_5.0.iso (moving to usbdrive...) ok

👑 COMMONLY USED COMMANDS 👑

these are the ones you'll actually be typing 24/7, bestie.💅

help — Display built-in help.

For help on a specific command, use git annex help command

add [path ...] — Adds files to the annex.

See git-annex-add(1) for details.

get [path ...] — Gets the content of annexed files.

See git-annex-get(1) for details.

drop [path ...] — Drops the content of annexed files from this repository.

See git-annex-drop(1) for details.

put [path ...] — Send the content of annexed files to other repositories.

See git-annex-put(1) for details.

move [path ...] [--from=remote|--to=remote] — Moves the content of files from or to another remote.

See git-annex-move(1) for details.

copy [path ...] [--from=remote|--to=remote] — Copies the content of files from or to another remote.

See git-annex-copy(1) for details.

status [path ...] — Show the working tree status. (deprecated) ⚠️

See git-annex-status(1) for details.

unlock [path ...] — Unlock annexed files for modification.

See git-annex-unlock(1) for details.

edit [path ...] — This is an alias for the unlock command. May be easier to remember, if you think of this as allowing you to edit an annexed file. lowkey genius naming tbh.
lock [path ...] — Use this to undo an unlock command if you don't want to modify the files, or have made modifications you want to discard.

See git-annex-lock(1) for details.

pull [remote ...] — Pull content from remotes.

See git-annex-pull(1) for details.

push [remote ...] — Push content to remotes.

See git-annex-push(1) for details.

sync [remote ...] — Synchronize local repository with remotes.

See git-annex-sync(1) for details.

assist [remote ...] — Add files and sync changes with remotes.

See git-annex-assist(1) for details.

satisfy [remote ...] — Satisfy preferred content settings by transferring and dropping content.

See git-annex-satisfy(1) for details.

mirror [path ...] [--to=remote|--from=remote] — Mirror content of files to/from another repository.

See git-annex-mirror(1) for details.

addurl [url ...] — Downloads each url to its own file, which is added to the annex.

See git-annex-addurl(1) for details.

rmurl file url — Record that the file is no longer available at the url.

See git-annex-rmurl(1) for details.

import --from remote branch[:subdir] | [path ...] — Add a tree of files to the repository.

See git-annex-import(1) for details.

importfeed [url ...] — Imports the contents of podcast feeds into the annex.

See git-annex-importfeed(1) for details.

export treeish --to remote — Export content to a remote.

See git-annex-export(1) for details.

undo [filename|directory] ... — Undo last change to a file or directory. (deprecated) ⚠️

See git-annex-undo(1) for details.

addcomputed — Adds computed files to the repository.

See git-annex-addcomputed(1) for details.

recompute — Recomputes computed files.

See git-annex-recompute(1) for details.

findcomputed — Lists computed files.

See git-annex-findcomputed(1) for details.

multicast — Multicast file distribution.

See git-annex-multicast(1) for details.

watch — Daemon to watch for changes and autocommit.

See git-annex-watch(1) for details.

assistant — Daemon to automatically sync changes.

See git-annex-assistant(1) for details.

webapp — Opens a web app, that allows easy setup of a git-annex repository, and control of the git-annex assistant. If the assistant is not already running, it will be started.

See git-annex-webapp(1) for details.

p2phttp — Allows a git-annex repository to be accessed over HTTP using git-annex p2p protocol.

See git-annex-p2phttp(1) for details.

remotedaemon — Persistant communication with remotes.

See git-annex-remotedaemon(1) for details.

🧚 REPOSITORY SETUP COMMANDS 🧚

this is the "get your life together before the main character era begins" section. 🌈

init [description] — Until a repository (or one of its remotes) has been initialized, git-annex will refuse to operate on it, to avoid accidentally using it in a repository that was not intended to have an annex.

See git-annex-init(1) for details.

describe repository description — Changes the description of a repository.

See git-annex-describe(1) for details.

initremote name type=value [param=value ...] — Creates a new special remote, and adds it to .git/config.

See git-annex-initremote(1) for details.

enableremote name [param=value ...] — Enables use of an existing special remote in the current repository.

See git-annex-enableremote(1) for details.

verifyremote name — Verify if a special remote is safe to use.

See git-annex-verifyremote(1) for details.

configremote name [param=value ...] — Changes configuration of an existing special remote.

See git-annex-configremote(1) for details.

renameremote — Renames a special remote.

See git-annex-renameremote(1) for details.

enable-tor — Sets up tor hidden service. 🕵️‍♀️

See git-annex-enable-tor(1) for details.

numcopies [N] — Configure desired number of copies.

See git-annex-numcopies(1) for details.

mincopies [N] — Configure minimum number of copies.

See git-annex-mincopies(1) for details.

trust [repository ...] — Records that a repository is trusted to not unexpectedly lose content. Use with care. ⚠️

See git-annex-trust(1) for details.

untrust [repository ...] — Records that a repository is not trusted and could lose content at any time.

See git-annex-untrust(1) for details.

semitrust [repository ...] — Returns a repository to the default semi trusted state.

See git-annex-semitrust(1) for details.

group repository groupname — Add a repository to a group.

See git-annex-group(1) for details.

ungroup repository groupname — Removes a repository from a group.

See git-annex-ungroup(1) for details.

wanted repository [expression] — Get or set preferred content expression.

See git-annex-wanted(1) for details.

groupwanted groupname [expression] — Get or set groupwanted expression.

See git-annex-groupwanted(1) for details.

required repository [expression] — Get or set required content expression.

See git-annex-required(1) for details.

maxsize repository [size] — Get or set maximum size of repository.
initcluster — Initializes a new cluster.

See git-annex-initcluster(1) for details.

updatecluster — Update records of cluster nodes.

See git-annex-updatecluster(1) for details.

extendcluster — Adds an additional gateway to a cluster.

See git-annex-extendcluster(1) for details.

updateproxy — Update records with proxy configuration.

See git-annex-updateproxy(1) for details.

schedule repository [expression] — Get or set scheduled jobs.

See git-annex-schedule(1) for details.

config — Get and set other configuration stored in git-annex branch.

See git-annex-config(1) for details.

vicfg — Opens EDITOR on a temp file containing most of the above configuration settings, as well as a few others, and when it exits, stores any changes made back to the git-annex branch.

See git-annex-vicfg(1) for details.

adjust — Switches a repository to use an adjusted branch, which can automatically unlock all files, etc.

See git-annex-adjust(1) for details.

🛠️ REPOSITORY MAINTENANCE COMMANDS 💅

fsck [path ...] — the vibe check for your annex ✨ It checks annex consistency and warns you about any problems it finds (or fixes them, if you ask). Genuinely the perfect complement to git fsck, bestie. See git-annex-fsck(1) for details.
expire [repository:]time ... — ghosting repos that have been slacking 🫥 It expires repositories that haven't recently performed an activity (such as a fsck). No activity? No more repo for you, periodt. See git-annex-expire(1) for details.
unused — the "who even are you" command 👀 Checks the annex for data that does not correspond to any files present in any tag or branch, and prints a numbered list of that data. See git-annex-unused(1) for details.
dropunused [number|range ...] — drops the data corresponding to the numbers, as listed by the last git annex unused. Bye-bye, orphaned content 🗑️ See git-annex-dropunused(1) for details.
addunused [number|range ...] — the glow-up comeback arc 💫 Adds back files for the content corresponding to the numbers or ranges, as listed by the last git annex unused. See git-annex-addunused(1) for details.
fix [path ...] — symlink glow-up 🎀 Fixes up symlinks that have become broken so they again point to annexed content. See git-annex-fix(1) for details.
merge — automatically merge changes from remotes. It's giving "group project but everyone actually shows up" 🤝 See git-annex-merge(1) for details.
upgrade — upgrades the repository. Level up, bestie ⬆️👑 See git-annex-upgrade(1) for details.
dead [repository ...] [--key key] — rip in peace 🪦 Indicates that a repository or a single key has been irretrievably lost. See git-annex-dead(1) for details.
forget — causes the git-annex branch to be rewritten, throwing away historical data about past locations of files. Lowkey the "we don't talk about that era" option 🙈 See git-annex-forget(1) for details.
filter-branch — produces a filtered version of the git-annex branch. See git-annex-filter-branch(1) for details.
repair — the actual main character of damage control 🔥 This can repair many of the problems with git repositories that git fsck detects, but does not itself fix. It's useful if a repository has become badly damaged. One way this can happen is if a repository used by git-annex is on a removable drive that gets unplugged at the wrong time. (We've all been there. Not me, but someone.) See git-annex-repair(1) for details.
p2p — configure peer-2-Peer links between repositories 🦋 See git-annex-p2p(1) for details.

🔍 QUERY COMMANDS ✨

find [path ...] — outputs a list of annexed files in the specified path. With no path, it finds files in the current directory and its subdirectories. Your "where is everything" bestie 🕵️‍♀️ See git-annex-find(1) for details.
whereis [path ...] — displays information about where the contents of files are located. The tracking-your-friend's-location-but-consensually command 📍 See git-annex-whereis(1) for details.
list [path ...] — displays a table of remotes that contain the contents of the specified files. This is similar to whereis but a more compact display. Same tea, cuter formatting ☕💅 See git-annex-list(1) for details.
whereused — finds what files use or used a key. See git-annex-whereused(1) for details.
log [path ...] — displays the location log for the specified file or files, showing each repository they were added to ("+") and removed from ("-"). It's the receipts, honestly 🧾 See git-annex-log(1) for details.
oldkeys [path ...] — list keys used for old versions of files. Throwback era content 🎞️ See git-annex-oldkeys(1) for details.
info [directory|file|remote|uuid ...] — displays statistics and other information for the specified item, which can be a directory, or a file, or a remote, or the uuid of a repository.

When no item is specified, it displays statistics and information for the repository as a whole. The full stats reveal moment 📊✨ See git-annex-info(1) for details.

version — shows the version of git-annex, as well as repository version information. "What's your sign" but for your software 🌈 See git-annex-version(1) for details.
map — generate map of repositories 🗺️ Literally cartography, but make it git. See git-annex-map(1) for details.
inprogress — access files while they're being downloaded. Living in the moment, downloading edition ⏳ See git-annex-inprogress(1) for details.
findkeys — similar to git-annex find, but operating on keys 🔑 Same energy, different level. See git-annex-findkeys(1) for details.

🏷️ METADATA COMMANDS 🎀

metadata [path ...] — okay so the content of an annexed file can have any number of metadata fields attached to it to describe it, and each metadata field can in turn have any number of values 💖

This command can be used to set metadata, or show the currently set metadata. Categorize your files like you categorize your playlists, bestie. See git-annex-metadata(1) for details.

view [tag ...] [field=value ...] [field=glob ...] [?tag ...] [field?=glob] [!tag ...] [field!=value ...] — uses metadata to build a view branch of the files in the current branch, and checks out the view branch 🌸 Only files in the current branch whose metadata matches all the specified field values and tags will be shown in the view. It's giving custom feed algorithm, but for your own files. See git-annex-view(1) for details.
vpop [N] — switches from the currently active view back to the previous view. Or, from the first view back to the original branch. The "back back back" button ⬅️🙈 See git-annex-vpop(1) for details.
vfilter [tag ...] [field=value ...] [!tag ...] [field!=value ...] — filters the current view to only the files that have the specified field values and tags. Refining the search, no cap 🔎 See git-annex-vfilter(1) for details.
vadd [field=glob ...] [field=value ...] [tag ...] — changes the current view, adding an additional level of directories to categorize the files. Nesting levels like a fairy-tale tower 🧚 See git-annex-vfilter(1) for details.
vcycle — when a view involves nested subdirectories, this cycles the order 🔄 See git-annex-vcycle(1) for details.

🧰 UTILITY COMMANDS ⭐

migrate [path ...] — changes the specified annexed files to use a different key-value backend. A whole rebrand, honestly 💅 See git-annex-migrate(1) for details.
reinject src dest — moves the src file into the annex as the content of the dest file. This can be useful if you have obtained the content of a file from elsewhere and want to put it in the local annex. Adoption arc 🫶 See git-annex-reinject(1) for details.
unannex [path ...] — use this to undo an accidental git annex add command. It puts the file back how it was before the add. The Ctrl+Z of annex, and we all need it 😭 See git-annex-unannex(1) for details.
uninit — de-initialize git-annex and clean out repository. Closing the account, deleting the app 🧹 See git-annex-uninit(1) for details.
reinit uuid|description — initialize repository, reusing old UUID. Same soul, new era 👑 See git-annex-reinit(1) for details.

🔧 PLUMBING COMMANDS 💀

pre-commit [path ...] — this is meant to be called from git's pre-commit hook. git annex init automatically creates a pre-commit hook using this. See git-annex-pre-commit(1) for details.
post-receive — this is meant to be called from git's post-receive hook. git annex init automatically creates a post-receive hook using this. See git-annex-post-receive(1) for details.
pre-push — this is meant to be called from git's post-receive hook. git annex init automatically creates a pre-push hook using this. See git-annex-pre-push(1) for details.
lookupkey [file ...] — looks up key used for file 🔑 See git-annex-lookupkey(1) for details.
calckey [file ...] — calculates the key that would be used to refer to a file. Predict the future much? 🔮 See git-annex-calckey(1) for details.
contentlocation [key ..] — looks up location of annexed content for a key 📍 See git-annex-contentlocation(1) for details.
examinekey [key ...] — print information that can be determined purely by looking at the key. Just from the key alone, iconic 👁️ See git-annex-examinekey(1) for details.
matchexpression — checks if a preferred content expression matches provided data ✅ See git-annex-matchexpression(1) for details.
fromkey [key file] — manually set up a file in the git repository to link to a specified key 🔗 See git-annex-fromkey(1) for details.
registerurl [key url] — registers an url for a key 📝 See git-annex-registerurl(1) for details.
unregisterurl [key url] — unregisters an url for a key 🚫 See git-annex-unregisterurl(1) for details.
reregisterurl [key url] — updates url registration information 🔄 See git-annex-reregisterurl(1) for details.
setkey key file — moves a file into the annex as the content of a key. See git-annex-setkey(1) for details.
dropkey [key ...] — drops annexed content for specified keys 🗑️ See git-annex-dropkey(1) for details.
transferkey key [--from=remote|--to=remote] — transfers a key from or to a remote 🚚 See git-annex-transferkey(1) for details.
transferrer — used internally by git-annex to transfer content. Backstage crew energy 🎭 See git-annex-transferrer(1) for details.
setpresentkey key uuid [1|0] — this plumbing-level command changes git-annex's records about whether the specified key's content is present in a remote with the specified uuid. See git-annex-setpresentkey(1) for details.
readpresentkey key uuid — read records of where key is present 📖 See git-annex-readpresentkey(1) for details.
checkpresentkey key remote — check if key is present in remote ❓ See git-annex-checkpresentkey(1) for details.
rekey [file key ...] — change keys used for files 🔁 See git-annex-rekey(1) for details.
resolvemerge — resolves a conflicted merge, by adding both conflicting versions of the file to the tree, using variants of their filename. This is done automatically when using git annex sync or git-annex pull or git annex merge. Both versions get to stay, nobody loses 💖 See git-annex-resolvemerge(1) for details.
diffdriver — this can be used to make git diff diff the content of annexed files. See git-annex-diffdriver(1) for details.
smudge — this command lets git-annex be used as a git filter driver, allowing annexed files in the git repository to be unlocked regular files instead of symlinks. See git-annex-smudge(1) for details.
filter-process — an alternative implementation of a git filter driver, that is faster in some situations and slower in others than git-annex smudge. Situational queen 👑 See git-annex-filter-process(1) for details.
restage — restages unlocked files in the git index. See git-annex-restage(1) for details.
findref [ref] — lists files in a git ref. (deprecated) ⚠️ She's retired, bestie, treat her with respect.

See git-annex-findref(1) for details.

See git-annex-proxy(1) for details.

✨ TESTING COMMANDS ✨

Okay so these are the "trust but verify" commands, bestie. They poke and prod at git-annex itself to make sure it's behaving. 💅

test — runs git-annex's own built-in test suite. Think of it as git-annex doing a little self-care checkup on itself 🩺. Peep git-annex-test(1) for the deets.
testremote remote — this one tests a remote by literally generating some random objects, yeeting them over to the remote, redownloading them, removing them from the remote, etc. Like a full round-trip vibe check on your remote 🌈. It's safe to run in an existing repo (the repository contents are not altered), no cap — but word to the wise, it may perform expensive data transfers 😭. See git-annex-testremote(1) for details.
sim — this simulates a whole network of git-annex repositories 🕸️. Iconic for testing out a configuration before you commit to using it in the real world. See git-annex-sim(1) for details.
fuzztest — generates random changes to files in the current repository, for use in testing the assistant 🎲. Chaos as a service, honestly. See git-annex-fuzztest(1) for details.
benchmark — runs git-annex's built-in benchmarks... if it was built with benchmarking support 🏎️. See git-annex-benchmark(1) for details.

🧩 ADDON COMMANDS 🧩

Plot twist, bestie: on top of all the commands listed above, you can add more commands to git-annex by dropping commands named like git-annex-foo into a directory in the PATH. It's giving "build your own adventure" fr fr 🫶.

⚙️ CONFIGURATION ⚙️

Like other git commands, git-annex is configured via .git/config 💖. These settings — plus the relevant git config settings — are the ones git-annex actually uses.

Some of these settings can also be set, across all clones of the repository, using git-annex-config. See its man page for a list. 👑

The settings themselves, one by one 🎀

annex.uuid — a unique UUID for this repository (automatically set). Don't touch it, it's her ✨.
annex.backend — the name of the default key-value backend to use when adding new files to the repository. See git-annex-backends(1) for info about the available backends 🔥.

This is overridden by annex annex.backend configuration in the .gitattributes files, and by the --backend option.

(This used to be named annex.backends, and that will still be used if set — legacy queen behavior 💅.)

annex.securehashesonly — set to true to indicate that the repository should only use cryptographically secure hashes (SHA2, SHA3) and not insecure hashes (MD5, SHA1, XXH3) for content 🔒.

When this is set, the contents of files using cryptographically insecure hashes will not be allowed to be added to the repository.

Also, git-annex fsck will complain about any files present in the repository that use insecure hashes. And git-annex import --no-content will refuse to import files from special remotes using insecure hashes 😤.

To configure the behavior in new clones of the repository, this can be set using git-annex-config.

annex.maxextensionlength — the maximum length, in bytes, of what is considered a filename extension 📏. This is used when adding a file to a backend that preserves filename extensions, and also when generating a view branch.

The default length is 4, which allows extensions like "jpeg". The dot before the extension is not counted as part of its length.

annex.maxextensions — the maximum number of filename extensions to preserve when using a backend that preserves filename extensions, and also when generating a view branch 🧚.

The default is 2, which allows for compound extensions like ".tar.gz". When set to 1, it will only preserve the last extension, eg ".gz".

annex.diskreserve — the amount of disk space to reserve 💾. Disk space is checked when transferring annexed content to avoid running out, and additional free space can be reserved via this option, to make space for other data (such as git commit logs). Can be specified with any commonly used units, for example, "0.5 gb", "500M", or "100 KiloBytes".

The default reserve is 100 megabytes.

annex.fullybalancedthreshhold — configures the percent full a repository must be in order for the "fullybalanced" preferred content expression to consider it to be full ⚖️. The default is 90.

(Yes, that spelling with the double-h is exactly how it's written — copy it character for character, bestie, don't "fix" it 💀.)

annex.skipunknown — set to true to make commands like git-annex get silently skip over items that are listed in the command line, but are not checked into git 🙈.

Set to false to make it an error for commands like git-annex get to be asked to operate on files that are not checked into git. (This is the default in recent versions of git-annex.)

Note that, when annex.skipunknown is false, a command like git-annex get . will fail if no files in the current directory are checked into git. Commands like git-annex get foo/ will fail if no files in the directory are checked into git, but if at least one file is, it will ignore other files that are not. This is all the same as the behavior of git-ls files --error-unmatch.

Also note that git-annex skips files that are checked into git, but are not annexed files; this setting does not affect that 🫶.

annex.largefiles — used to configure which files are large enough to be added to the annex 🐘. It's an expression that matches the large files, eg "include=*.mp3 or largerthan=500kb". See git-annex-matching-expression(1) for details on the syntax.

Overrides any annex.largefiles attributes in .gitattributes files.

To configure a default annex.largefiles for all clones of the repository, this can be set in git-annex-config(1).

This configures the behavior of both git-annex and git when adding files to the repository. By default, git-annex add adds all files to the annex (except dotfiles and files in dotdirs), and git add adds files to git (unless they were added to the annex previously). When annex.largefiles is configured, both git annex add and git add will add matching large files to the annex, and the other files to git ✨.

Other git-annex commands also honor annex.largefiles, including git annex import, git annex addurl, git annex importfeed, git-annex assist, and the git-annex assistant 🔥.

annex.dotfiles — normally, dotfiles and files inside dotdirs are assumed to be configuration files like .gitignore, whose content should always be part of the git repository, so they will not be added to the annex 🙅‍♀️. Setting annex.dotfiles to true makes these files be added to the annex the same as any other file.

To annex only some dotfiles, set this and configure annex.largefiles to match the ones you want. For example, to match only dotfiles ending in ".big":

git config annex.largefiles "(include=.*.big or include=*/.*.big) or (exclude=.* and exclude=*/.*)"
git config annex.dotfiles true

To configure a default annex.dotfiles for all clones of the repository, this can be set in git-annex-config(1).

annex.gitaddtoannex — setting this to false will prevent git add from adding files to the annex, despite the annex.largefiles configuration 🚫.
annex.addsmallfiles — controls whether small files (files not matching annex.largefiles, or dotfiles) should be checked into git by git annex add 🐣. Defaults to true; set to false to instead make small files be skipped.
annex.addunlocked — commands like git-annex add default to adding files to the repository in locked form 🔒. This can make them add the files in unlocked form, the same as if git-annex-unlock(1) were run on the files.

This can be set to "true" to add everything unlocked, or it can be a more complicated expression that matches files by name, size, or content. See git-annex-matching-expression(1) for details.

To configure a default annex.addunlocked for all clones of the repository, this can be set in git-annex-config(1).

Using git add always adds files in unlocked form and it is not affected by this setting. The assistant defaults to adding all files unlocked, unless annex.assistant.allowunlocked is set.

When a repository has core.symlinks set to false, or has an adjusted unlocked branch checked out, this setting is ignored, and files are always added to the repository in unlocked form 💅.

annex.assistant.allowunlocked — the git-annex assistant defaults to adding all files unlocked, so that files can be modified without the user needing to do anything to unlock them 🙌.

If this is set to true then it will instead use the annex.addunlocked configuration to decide which files to add unlocked.

annex.initwanted — when this is set to a preferred content expression, all new repositories (and special remotes) will have it copied into their configuration when initialized, the same as if you had run git-annex-wanted(1) 🎀.
annex.initrequired — when this is set to a preferred content expression, all new repositories (and special remotes) will have it copied into their configuration when initialized, the same as if you had run git-annex-required(1) ✅.
annex.initgroups — when this is set to a list of groups (separated by whitespace), all new repositories (and special remotes) start out in those groups when initialized, the same as if you had run git-annex-group(1) 🫂.
annex.numcopies — this is a deprecated setting ⚠️. You should instead use the git annex numcopies command to configure how many copies of files are kept across all repositories, or the annex.numcopies .gitattributes setting.

This config setting is only looked at when git annex numcopies has never been configured, and when there's no annex.numcopies setting in the .gitattributes file.

annex.genmetadata — set this to true to make git-annex automatically generate some metadata when adding files to the repository 🏷️.

In particular, it stores year, month, and day metadata, from the file's modification date.

When importfeed is used, it stores additional metadata from the feed, such as the author, title, etc.

annex.used-refspec — this controls which refs git-annex unused considers to be used 👀. See REFSPEC FORMAT in git-annex-unused(1) for details.
annex.jobs — configure the number of concurrent jobs to run 🏃‍♀️. Default is 1.

Only git-annex commands that support the --jobs option will use this.

okay so picking right back up with annex.jobs: setting it to "cpus" will run one job per CPU core 💅 and ngl, when the --batch option is used, this configuration is straight-up ignored. periodt.

`annex.adjustedbranchrefresh`

So when git-annex-adjust(1) is used to set up an adjusted branch that needs to be refreshed after getting or dropping files, this config is the little dial that controls how often the branch gets refreshed ✨

And like — refreshing the branch takes some time, so doing it after every single file can be way too slow. (It also can generate a lot of dangling git objects, which, oof.) The default value is 0 (or false), which does not refresh the branch at all. Setting 1 (or true) will refresh only once, after git-annex has made other changes. Setting 2 refreshes after every file, 3 after every other file, and so on; setting 100 refreshes after every 99 files 🌀

(And fr, if git-annex gets faster in the future, refresh rates will increase proportional to the speed improvements. icon behavior.)

`annex.queuesize`

git-annex builds a queue of git commands so it can combine similar commands together for speed — main character optimization energy 👑 By default the size of the queue is limited to 10240 commands, and this setting changes that size. If you have plenty of memory and you're working with very large numbers of files, increasing the queue size can speed things up 📈

`annex.bloomcapacity`

The git annex unused and git annex sync --content commands use a bloom filter to figure out what files are present in, like, the work tree. The default bloom filter is sized to handle up to 500000 files. If your repository is bigger than that, bestie, you should increase this value. Larger values will make git-annex unused and git annex sync --content consume more memory — so run git annex info for memory usage numbers before you go feral 🫶

`annex.bloomaccuracy`

This one adjusts the accuracy of the bloom filter used by git annex unused and git annex sync --content. The default accuracy is 10000000 — meaning 1 unused file out of 10000000 will be missed by git annex unused. Increasing the accuracy will make git annex unused consume more memory; again, run git annex info for memory usage numbers 💖

`annex.sshcaching`

By default, git-annex caches ssh connections using ssh's ControlMaster and ControlPersist settings (if it was built using a new enough ssh). To disable all that, set this to false 🦋

`annex.adviceNoSshCaching`

So when git-annex is unable to use ssh connection caching, or has been configured not to, and concurrency is enabled, it will warn you that this might result in multiple ssh processes prompting for passwords at the same time 😭 To disable that warning — like if you've configured ssh connection caching yourself, or you have ssh agent caching passwords — set this to false.

`annex.alwayscommit`

By default, git-annex automatically commits data to the git-annex branch after each command is run. If you have a series of commands and you want them to make a single commit, you can run the commands with -c annex.alwayscommit=false. Later you can commit the data by running git annex merge (or by automatic merges) or git annex sync ✨

`annex.commitmessage`

When git-annex updates the git-annex branch, it usually makes up its own commit message (eg "update"), since users rarely look at or care about changes to that branch. But if you do care — and honestly, slay — you can specify this setting by running commands with:

-c annex.commitmessage=whatever

This works well in combination with annex.alwayscommit=false, to gather up a set of changes and commit them with a message you specify 🎀

`annex.commitmessage-command`

This command is run and its output is used as the commit message to the git-annex branch.

Alternatively, a hook script can be installed in .git/hooks/commitmessage-annex 🌸

`annex.post-update-command`

This command is run after git-annex updates the git-annex branch.

When publishing a git-annex repository by http, this can be used to run git update-server-info.

Alternatively, a hook script can be installed in .git/hooks/post-update-annex 🧚

`annex.pre-commit-command`

This command is run whenever a commit is made to the HEAD branch of the git repository, either by git commit or by git-annex.

Alternatively, a hook script can be installed in .git/hooks/pre-commit-annex 🦋

`annex.pre-init-command`

This command is run before the repository is initialized, either by git-annex init or by automatic initialization. It can configure the repository in any way needed. And heads up: if it exits nonzero, the repository initialization will fail 💀

Alternatively, a hook script can be installed in .git/hooks/pre-init-annex.

`annex.alwayscompact`

By default, git-annex compacts data it records in the git-annex branch. Setting this to false avoids doing that compaction in some cases, which can speed up operations that populate the git-annex branch with a lot of data. But — and this is the catch — when used with operations that overwrite old values in the git-annex branch, that may cause the git-annex branch to use more disk space, and so slow down reading data from it 🐌

An example of a command that can be sped up by using -c annex.alwayscompact=false is git-annex registerurl --batch, when adding a large number of urls to the same key.

This option was first supported by git-annex version 10.20220724. It is not entirely safe to set this option in a repository that may also be used by an older version of git-annex at the same time as a version that supports this option 🙈

`annex.allowsign`

By default git-annex avoids gpg signing commits that it makes when they're not the purpose of a command, but only a side effect. That default avoids lots of gpg password prompts when commit.gpgSign is set 🔐 A command like git annex sync or git annex merge will gpg sign its commit, but a command like git annex get, that updates the git-annex branch, will not. The assistant also avoids signing commits.

Setting annex.allowsign to true lets all commits be signed, as controlled by commit.gpgSign and other git configuration ✨

`annex.merge-annex-branches`

By default, git-annex branches that have been pulled from remotes are automatically merged into the local git-annex branch, so that git-annex has the most up-to-date possible knowledge 👑

To avoid that merging, set this to "false".

This can be useful particularly when you don't have write permission to the repository. While git-annex is mostly able to work in a read-only repository with unmerged git-annex branches, some things do not work, and when it does work it will be slower due to needing to look at each of the unmerged branches ⭐

`annex.private`

When this is set to true, no information about the repository will be recorded in the git-annex branch 🤫

For example, to make a repository without any mention of it ever appearing in the git-annex branch:

git init myprivate
cd myprivaterepo
git config annex.private true
git annex init

`annex.hardlink`

Set this to true to make file contents be hard linked between the repository and its remotes when possible, instead of a more expensive copy 💸

Use with caution — this can invalidate numcopies counting, since with hard links, fewer copies of a file can exist. So it is a good idea to mark a repository using this setting as untrusted.

When a repository is set up using git clone --shared, git-annex init will automatically set annex.hardlink and mark the repository as untrusted.

When annex.thin is also set, setting annex.hardlink has no effect 🫶

`annex.thin`

Set this to true to make unlocked files be a hard link to their content in the annex, rather than a second copy. This can save considerable disk space, but when a modification is made to a file, you will lose the local (and possibly only) copy of the old version 😭 Any other, locked files in the repository that pointed to that content will get broken as well (git-annex fsck will detect and clean up after that). So, enable this with care.

After setting (or unsetting) this, you should run git annex fix to fix up the annexed files in the work tree to be hard links (or copies).

Note that this has no effect when the filesystem does not support hard links. And when multiple files in the work tree have the same content, only one of them gets hard linked to the annex 🔗

`annex.supportunlocked`

By default git-annex supports unlocked files as well as locked files, so this defaults to true. If set to false, git-annex will only support locked files. That will avoid doing the work needed to support unlocked files 💅

Note that setting this to false does not prevent a repository from having unlocked files added to it — and in that case the content of the files will not be accessible until they are locked 😬

After changing this config, you need to re-run git-annex init for it to take effect.

`annex.trashbin`

When this is set to the name of a remote, files that are dropped from the repository will be moved to that remote 🗑️✨

Note that if it takes a long time to move a file to the remote, the user will not see a progress display for their drop action. So this is best used with a fast remote 🏃‍♀️

And, if the remote is not accessible, or a file fails to be moved to it, the file will not be dropped from the repository.

`annex.url`

When a remote has a http url, the first time git-annex uses the remote it will check if it can download its .git/config file. If it is able to, and the file has this config set to an "annex+http" or "annex+https" url, that url will be copied into remote.<name>.annexUrl 🌈

`annex.resolvemerge`

Set to false to prevent merge conflicts in the checked out branch being automatically resolved by the git-annex assistant, git-annex assist, git-annex sync, git-annex pull, git-annex merge, and the git-annex post-receive hook 🛠️

To configure the behavior in all clones of the repository, this can be set in git-annex-config(1) 👑

annex.synccontent — set this to true and git-annex sync will default to transferring annexed content, no questions asked. Set it to false and it stops git-annex assist, git-annex pull and git-annex push from transferring annexed content. If you want this to be the vibe in every clone of the repo, set it in git-annex-config(1) instead. 💅
annex.synconlyannex — set to true and git-annex assist, git-annex sync, git-annex pull and git-annex push will default to touching only the git-annex branch and annexed content. Same deal: want it repo-wide? Put it in git-annex-config(1).
annex.syncmigrations — set to false to stop git-annex sync and git-annex pull from scanning for migrations and updating the local repo for those migrations. Like, no thanks, not today. 🙈
annex.viewunsetdirectory — this sets the name of the directory that shows up in a view holding all the files that don't have metadata set. Default name is _. Peep git-annex-view(1) for the full tea. ☕
annex.debug — set to true and debug logging is on by default. Detective mode: activated. 🕵️
annex.debugfilter — picks which debug messages show up (only matters when debug display is already turned on via annex.debug or --debug). The value is one or more module names, separated by commas.
annex.version — the current version of the git-annex repository. git-annex maintains this itself and it should never be changed by hand, periodt. ⚠️
annex.autoupgraderepository — when an old git-annex repository version is no longer supported, git-annex will normally just auto-upgrade the repo to the new version by itself. It might also sometimes upgrade from an old repo version that's still supported but just isn't as good as a later one.

Set this to false and git-annex won't auto-upgrade. If the repo version isn't supported, git-annex will straight up exit with an error message instead. If it's still supported, git-annex keeps working fine. Then you can run git annex upgrade yourself when you're ready. 🫶

annex.crippledfilesystem — set to true if the repo lives on a crippled filesystem, like FAT, which doesn't support symbolic links, or hard links, or unix permissions. git annex init probes for this automatically, bless it. 💖
annex.pidlock — normally git-annex uses fine-grained lock files so multiple processes can run at the same time without stepping on each other. That works great… unless you're on a filesystem that doesn't support POSIX fcntl locks. Which, lowkey, happens with NFS or Lustre filesystems. 😭

So: set annex.pidlock to true and it falls back to a single top-level pid file lock.

That said, you'd really be better off fixing your networked filesystem config to support POSIX locks. And fr fr, some networked filesystems are so inconsistent that one node can't reliably tell when another node is holding a pid lock. Caveat emptor, bestie. 💀

annex.pidlocktimeout — git-annex waits up to this many seconds for the pid lock file to go away, then aborts if it can't continue. Default: 300.

When you're using pid lock files, a stale lock file can get left behind by a previous git-annex run that crashed or got interrupted. It's mostly avoided, but it happens — especially on a network file system. This timeout stops git-annex from waiting forever in that situation. 🙏

annex.dbdir — the directory where git-annex stores its sqlite databases. Default location is inside .git/annex/.

Certain filesystems, such as cifs, may not support the locking operations sqlite needs, and pointing this at a directory on another filesystem can work around that problem.

It's totally safe to set this to the same directory in the config of multiple repositories — each repo will use its own subdirectory for its sqlite database. 🌸

annex.cachecreds — when "true" (the default), git-annex caches the credentials used to access special remotes in files in .git/annex/creds/ that only you can read. To disable that caching, set it to "false", and credentials will only be read from the environment — or, if they've been embedded in encrypted form in the git repo, they'll be extracted and decrypted each and every time git-annex needs to access the remote. 🔐
annex.secure-erase-command — set this to a command that should be run whenever git-annex removes the content of a file from the repo. In the command line, %file gets replaced with the file that should be erased. For example, to use the wipe command, set it to wipe -f %file. 🧹

Alternatively to setting the git config, you can install a hook script in .git/hooks/secure-erase-annex. The hook gets passed the file to be erased as its only parameter.

annex.freezecontent-command, annex.thawcontent-command — usually the write permission bits get unset to protect annexed objects from being modified or deleted. freezecontent runs after git-annex has removed (or attempted to remove) the write bit, and can be used to prevent writing some other way. thawcontent should undo its effect, and runs before git-annex restores the write bit. 🧊🔥

In the command line, %path gets replaced with the file or directory to operate on.

(When annex.crippledfilesystem is set, git-annex won't try to remove/restore the write bit, but it'll still run freezecontent and thawcontent.)

Alternatively to setting the git config, hook scripts can be installed in .git/hooks/freezecontent-annex and .git/hooks/thawcontent-annex. The hook gets passed the file or directory to operate on as its only parameter.

annex.tune.objecthash1, annex.tune.objecthashlower, annex.tune.branchhash1 — these can be passed to git annex init to tune the repo. They cannot be safely changed in a running repository and should never be set in global git config. For the deets, see https://git-annex.branchable.com/tuning/. 👑
annex.cluster.<name> — setting this makes the repository a gateway to a cluster. The value is the cluster UUID. Note that cluster UUIDs are not the same as repository UUIDs, and a repository UUID cannot be used here. Usually this gets set up by running git-annex-initcluster or git-annex-extendcluster. 🌈

🌐 CONFIGURATION OF REMOTES 🌐

Remotes are configured using these settings in .git/config. Let's gooo. 💜

remote.<name>.annex-cost — when git-annex is figuring out which repo to transfer annexed files from or to, ones with lower costs win. The default cost is 100 for local repositories, and 200 for remote repositories.
remote.<name>.annex-cost-command — if set, the command gets run, and the number it outputs is used as the cost. This lets you vary the cost based on, say, the current network. 🦋
remote.<name>.annex-start-command — a command to run when git-annex begins using the remote. Could be used to, for example, mount the directory containing the remote.

Heads up: the command may be run repeatedly when multiple git-annex processes are running concurrently.

remote.<name>.annex-stop-command — a command to run when git-annex is done using the remote.

The command will only be run once all running git-annex processes are finished using the remote. Teamwork. 🤝

remote.<name>.annex-shell — specify an alternative git-annex-shell executable on the remote instead of looking for "git-annex-shell" on the PATH.

Super useful if the git-annex-shell program is outside the PATH or has a non-standard name.

remote.<name>.annex-ignore — if set to true, stops git-annex from storing or retrieving annexed file contents on this remote by default. (You can still explicitly ask for it with the --from and --to options, bestie, we're not locking you out.)

Useful, for example, if the remote is somewhere without git-annex-shell (say… on GitHub 👀). Or if the network connection between two repos is too slow to be used normally.

This does not stop git-annex sync, git-annex pull, git-annex push, git-annex assist or the git-annex assistant from operating on the git repository. It only affects annexed content.

remote.<name>.annex-ignore-command — if set, the command gets run, and if it exits nonzero, that's the same as setting annex-ignore to true. Lets you control behaviour based on, e.g., the current network.
remote.<name>.annex-ignore-auto — git-annex sets this itself when it sets remote.<name>.annex-ignore because it detected that the remote repo isn't usable by git-annex.

When this is set, git-annex push will check whether the remote repo is now usable by git-annex, and if it is, it'll unset remote.<name>.annex-ignore. Self-healing queen. ✨

remote.<name>.annex-sync — if set to false, stops git-annex sync (plus git-annex pull, git-annex push, git-annex assist and the git-annex assistant) from operating on this remote by default.
remote.<name>.annex-sync-command — if set, the command gets run, and if it exits nonzero, that's the same as setting annex-sync to false. Again: network-dependent vibes, controlled. 📡
remote.<name>.annex-pull — if set to false, stops git-annex pull, git-annex sync, git-annex assist and the git-annex assistant from ever pulling (or fetching) from the remote. Ever ever.
remote.<name>.annex-push — if set to false, stops git-annex push, git-annex sync, git-annex assist and the git-annex assistant from ever pushing to the remote.
remote.<name>.annex-readonly — if set to true, stops git-annex from making changes to a remote. It prevents git-annex sync and git-annex assist from pushing changes to a git repository, and it prevents storing or removing files. Look, don't touch. 🚫
remote.<name>.annex-verify, annex.verify — so by default git-annex always checks the checksums of objects it pulled down from remotes 💅 like it's just doing its little trust exercises. If you fully trust a remote and don't wanna pay the overhead of those checksums, set this to false. But (and this is the fine print bestie): even at false, git-annex still does verification in some edge cases — specifically when it's likely an object was downloaded wrong, or when it's needed for security. So it's not a total vibe-off, okay? 🫶
remote.<name>.annex-fastcopy, annex.fastcopy — set to "true" to optimize copying files to/from a remote ✨. It lets cp use the copy_file_range system call (when the cp command supports it). The actual benefit is filesystem-dependent:
- On NFS, this can allow a server-side copy to be done 🎀.
- On ext4, it avoids some memory transfer overhead, but the file still needs to be copied.
- There is no benefit on btrfs, since git-annex does the equivalently fast CoW reflinking on btrfs by default 👑.

It'll do little to speed things up when git-annex has to read the copied file to verify it. So for maximum speed, set this and set remote.<name>.annex-verify or annex.verify to false. Currently, this also prevents resuming interrupted copies where they left off — an interrupted copy gets re-run from the beginning 😭.

remote.<name>.annex-tracking-branch — this one's for special remotes that support exports and imports 🦋. Set it to eg "master" and you're telling git-annex you want the special remote to track that branch. Set it to eg "master:subdir" and the special remote tracks only the subdirectory of that branch. Setting this makes some other commands work with those special remotes: git-annex pull will import changes from the remote and merge them into the annex-tracking-branch, and git-annex push will export changes to the remote. The higher-level commands git-annex sync --content and git-annex assist both import and export 💖.
remote.<name>.annex-export-tracking — deprecated name for remote.<name>.annex-tracking-branch ⚠️. It'll still be used if it's configured and remote.<name>.annex-tracking-branch is not.
remote.<name>.annexUrl — lets you specify a different url than the regular remote.<name>.url for git-annex to use when accessing the remote, similar to the pushUrl used by git-push 🌸. When this is set to an annex+http or annex+https url, that url is used for git-annex operations only, and the remote.<name>.url is used for git operations — which is how git-annex-p2phttp can serve a git-annex repository over http 🧚. When this and the remote.<name>.url contain the same hostname, and this is an annex+http(s) url, and that is also a http(s) url, git-annex assumes the same username and password can be used for both urls. With password caching configured, that means you only get prompted once for a password when using both git and git-annex 💅. See gitcredentials(7) for how to set up password caching.
url.<base>.annexInsteadOf — works similarly to git's url.<base>.pushInsteadOf, rewriting a remote url that starts with the value of this config to instead start with <base> 🎀. The rewritten url is what git-annex uses to access the remote, and it works the same as remote.<name>.annexUrl, including supporting annex+http urls. Note that git-annex also supports git's url.<base>.insteadOf config — when both are set, the remote's url is first rewritten by insteadOf, and that rewritten url can then be further rewritten using annexInsteadOf 👑.
remote.<name>.annex-uuid — git-annex caches UUIDs of remote repositories here 🦋.
remote.<name>.annex-config-uuid — used for some special remotes; it points to a different special remote configuration to use ✨.
remote.<name>.annex-retry, annex.retry — number of times a transfer that fails can be retried. (default 0) 💀
remote.<name>.annex-forward-retry, annex.forward-retry — if a transfer made some forward progress before failing, this lets it be retried even when annex.retry does not 🌈. The value is the maximum number of times to do that. (default 5) When both annex.retry and this are set, the maximum number of retries is the larger of the two.
remote.<name>.annex-retry-delay, annex.retry-delay — number of seconds to delay before the first retry of a transfer ⭐. When making multiple retries of the same transfer, the delay doubles after each retry. (default 1)
remote.<name>.annex-bwlimit, annex.bwlimit — use this to limit how much bandwidth is used for a transfer from or to a remote 🍓. For example, to limit transfers to 1 mebibyte per second:

git config annex.bwlimit "1MiB"

This works with many remotes, including git remotes, but not for remotes where the transfer is run by a separate program than git-annex 🙈.

remote.<name>.annex-bwlimit-download, annex.bwlimit-download — limit bandwidth for downloads from a remote 💖. Overrides remote.<name>.annex-bwlimit and annex.bwlimit.
remote.<name>.annex-bwlimit-upload, annex.bwlimit-upload — limit bandwidth for uploads to a remote 💖. Overrides remote.<name>.annex-bwlimit and annex.bwlimit.
remote.<name>.annex-stalldetection, annex.stalldetection — configuring this lets stalled or too-slow transfers be detected and dealt with, so instead of getting stuck forever, git-annex cancels the stalled operation 😭. The transfer counts as failed, so settings like annex.retry control what happens next.

The default is to automatically detect when transfers have probably stalled and suggest configuring this — but not cancel the stalled operations 🫶. For that automatic detection to work, a remote needs to update its progress consistently; remotes that don't won't get automatic stall detection done. And it may take a while for git-annex to decide a remote is really stalled when using automatic stall detection, since it has to be conservative about what looks like a stall.

Set it to "false" to avoid all attempts at stall detection 💀.

To detect and cancel stalled transfers, set this to a value in the form "$amount/$timeperiod", which specifies how much data git-annex should expect to see flowing, minimum, over a given period of time. For example, to detect outright stalls where no data has been transferred after 30 seconds:

git config annex.stalldetection "1KB/30s"

Or, if you have a remote on a USB drive that's normally capable of several megabytes per second but has bad sectors where it gets stuck for a long time, you could use:

git config remote.usbdrive.annex-stalldetection "1MB/1m"

Some remotes don't report transfer progress at all, and stalls can't be detected when using those 🙈. Some remotes only report transfer progress occasionally, eg after each chunk — to avoid false timeouts in that situation, if the first progress update takes longer to arrive than the configured time period, the stall detection is automatically adjusted to use a longer time period. For example, if the first progress update comes after 10 minutes, but annex.stalldetection is "1MB/1m", it will be treated as eg "30MB/30m" 🔥.

heads up: configuring stall detection can make git-annex use more resources ⚠️. To be able to cancel stalls, git-annex has to run transfers in separate processes (one per concurrent job), so it may need to open more connections to a remote than usual, or the communication with those processes may make it a bit slower.

remote.<name>.annex-stalldetection-download, annex.stalldetection-download — stall detection for downloads from a remote 🌸. For example, if a remote is often fast but sometimes is very slow, and there's another remote that's consistently medium speed and contains the same data, this could be set to treat the fast remote as stalled when it's slow — then a command like git-annex get will fall back to downloading from the medium speed remote 💅. Overrides remote.<name>.annex-stalldetection, annex.stalldetection.
remote.<name>.annex-stalldetection-upload, annex.stalldetection-upload — stall detection for uploads to a remote 🌸. Overrides remote.<name>.annex-stalldetection, annex.stalldetection.
remote.<name>.annex-checkuuid — this only affects remotes whose url points to a directory on the same system 🎀. git-annex normally checks the uuid of such remotes each time it's run, which lets it transparently deal with different drives being mounted to the location at different times. Setting annex-checkuuid to false prevents it from checking the uuid at startup — although the uuid is still verified before making any changes to the remote repository 🦋. This may be useful to prevent unnecessary spin-up or automounting of a drive.
remote.<name>.annex-trustlevel — configures a local trust level for the remote, overriding the value configured by the trust and untrust commands 👑. The value can be any of "trusted", "semitrusted" or "untrusted".
remote.<name>.annex-speculate-present — set to "true" to make git-annex speculate that this remote may contain the content of any file, even though its normal location tracking doesn't indicate that it does 😳. This makes git-annex try to get all file contents from the remote — can be useful when setting up a caching remote ⭐.
remote.<name>.annex-proxy — set to "true" to make the local repository able to act as a proxy to this remote 💅. The remote can be a git-annex repository or a special remote. After configuring this, run [[git-annex-updateproxy](1) to store the new configuration in the git-annex branch.
remote.<name>.annex-proxied-by — usually this is used internally, when git-annex sets up proxied remotes, so you won't need to configure it yourself 🌈. The value is the UUID of the git-annex repository that proxies access to this remote.
remote.<name>.annex-cluster-node — okay so this is the "you're in the squad now" flag 💅 set it to the name of a cluster and boom, this remote is part of that cluster. And bestie, you can list multiple cluster names separated by whitespace if you want your remote in more than one cluster at once. Polyamorous remote, we love to see it.

After you set this up, run git-annex updatecluster to actually store the new configuration in the git-annex branch — it doesn't just magically appear, you gotta commit to the bit ✨

remote.<name>.annex-cluster-gateway — set this to the UUID of a cluster that this remote serves as a gateway for 🎀 Multiple UUIDs? Sure, list 'em separated by whitespace. And when the local repository is also a gateway for that cluster, it will proxy for the nodes of the remote gateway. Very main character of it.

Usually this whole situation gets set up by running git-annex extendcluster — you're not expected to hand-craft it, ngl.

remote.<name>.annex-private — set this to true and no information about the remote gets recorded in the git-annex branch 🙈 super useful for special remotes especially, and this is what gets set when you use git-annex initremote with the --private option. Secretive. Mysterious. Iconic.
remote.<name>.annex-max-git-bundles, annex.max-git-bundles — this one's for when you're using git-remote-annex to store a git repository inside a special remote 🧚 it configures how many separate git bundle objects get stored in the special remote before it re-uploads a single git bundle containing the entire git repository.

Default is 100, which is like... the sweet spot, fr — it aims to avoid needing to often re-upload while preventing a clone or fetch from having to download too many objects. Set it to 0 to disable re-uploading entirely.

remote.<name>.annex-allow-encrypted-gitrepo — set this to true and you're allowed to use git-remote-annex to push the git repository to an encrypted special remote 🔐

But listen — this is not allowed by default, and there's a real reason: it's impossible to git clone from an encrypted special remote, because it needs encryption keys that are stored in the remote. So if you set this, please please please don't rely on the encrypted special remote being your only copy of your git repository. That's the kind of thing that ruins a whole weekend 😭

remote.<name>.annex-bare — tells git-annex whether a remote is a bare repository or not. Normally git-annex figures this out all by itself (it's smart like that), so this is just for when you want to be the one making the decisions.
remote.<name>.annex-verified — this tracks the verification status of a special remote, and it's a whole little story:
- When a special remote has been verified, by e.g. git-annex verify, this is set to "verified" ✅
- When a special remote has been autoenabled but not yet verified, it's set to "automatic".
- When a special remote has been enabled by git-annex initremote but not yet verified, this config is set to "manual".
remote.<name>.annex-availability — this configuration setting is no longer used 💀 it's giving retired legend. Lowkey still here for the lore.
remote.<name>.annex-ssh-options, annex.ssh-options — options to use when using ssh to talk to this remote 🦋 drop your ssh flags in here and let git-annex handle the rest.
remote.<name>.annex-rsync-options, annex.rsync-options — options to use when using rsync to or from this remote. For example, to force IPv6 and limit the bandwidth to 100Kbyte/s, set it to -6 --bwlimit 100 🏃‍♀️💨

Heads up bestie: git-annex-shell has a whitelist of allowed rsync options, and others won't be passed to the remote rsync. So using some options may break the communication between the local and remote rsyncs. Choose wisely 💅

remote.<name>.annex-rsync-upload-options, annex.rsync-upload-options — options to use when using rsync to upload a file to a remote ⬆️ These get passed after other applicable rsync options, so you can use them to override those. For example, to limit upload bandwidth to 10Kbyte/s, set --bwlimit 10.
remote.<name>.annex-rsync-download-options, annex.rsync-download-options — options to use when using rsync to download a file from a remote ⬇️ These are also passed after other applicable rsync options, so once again, override city. Population: you.
remote.<name>.annex-rsync-transport — the remote shell to use to connect to the rsync remote 🌈 Possible values are ssh (the default) and rsh, together with their arguments, for instance ssh -p 2222 -c blowfish. Note that the remote hostname should not appear there — check rsync(1) for the details, iykyk.

When the transport used is ssh, connections are automatically cached unless annex.sshcaching is unset. Caching! We stan efficiency.

remote.<name>.annex-bup-split-options, annex.bup-split-options — options to pass to bup split when storing content in this remote. For example, to limit the bandwidth to 100Kbyte/s, set it to --bwlimit 100k. (There is no corresponding option for bup join, so don't go looking for one 🎀)
remote.<name>.annex-gnupg-options, annex.gnupg-options — options to pass to GnuPG when it's encrypting data 🔐 For instance, to use the AES cipher with a 256 bits key and disable compression, set it to --cipher-algo AES256 --compress-algo none. These options take precedence over the default GnuPG configuration, which is otherwise used — so yeah, they win the argument.
remote.<name>.annex-gnupg-decrypt-options, annex.gnupg-decrypt-options — options to pass to GnuPG when it's decrypting data 🔓 These options take precedence over the default GnuPG configuration, which is otherwise used. Same energy, other direction.
remote.<name>.annex-shared-sop-command, annex.shared-sop-command — use this command — an implementation of the Stateless OpenPGP command line interface — rather than GnuPG for encrypting and decrypting data ✨ This is only used when a special remote is configured with encryption=shared.

For example, to use Sequoia PGP's sqop command, set this to "sqop". Sophisticated. Distinguished. Obsessed.

remote.<name>.annex-shared-sop-profile, annex.shared-sop-profile — when encrypting with a Stateless OpenPGP command, you can use this to specify the profile to use, such as "rfc4880" 🎀

For a list of available profiles, run e.g. sqop list-profiles encrypt:

sqop list-profiles encrypt

remote.<name>.annex-rsyncurl — used by rsync special remotes, this configures the location of the rsync repository to use 🗂️ Normally this gets automatically set up by git annex initremote, but you can change it if needed. Your remote, your rules.
remote.<name>.annex-buprepo — used by bup special remotes, this configures the location of the bup repository to use. Normally it's automatically set up by git annex initremote, but you can change it if needed 💖
remote.<name>.annex-borgrepo — used by borg special remotes, this configures the location of the borg repository to use. Normally automatically set up by git annex initremote, but you can change it if needed 👑
remote.<name>.annex-compute — used to identify compute special remotes 🖥️ Normally this is automatically set up by git annex initremote. Number-crunching remote, we respect you.
remote.<name>.annex-ddarrepo — used by ddar special remotes, this configures the location of the ddar repository to use. Normally automatically set up by git annex initremote, but you can change it if needed 🌸
remote.<name>.annex-directory — used by directory special remotes, this configures the location of the directory where annexed files are stored for this remote 📁 Normally automatically set up by git annex initremote, but you can change it if needed.
remote.<name>.annex-adb — used to identify remotes on Android devices accessed via adb 🤖 Normally this is automatically set up by git annex initremote.
remote.<name>.annex-androiddirectory — used by adb special remotes, this is the directory on the Android device where files are stored for this remote 📱 Normally automatically set up by git annex initremote, but you can change it if needed.
remote.<name>.annex-androidserial — used by adb special remotes, this is the serial number of the Android device used by the remote. Normally automatically set up by git annex initremote, but you can change it if needed — e.g. when upgrading to a new Android device 🫶 new phone, who dis.
remote.<name>.annex-s3 — used to identify Amazon S3 special remotes ☁️ Normally this is automatically set up by git annex initremote.
remote.<name>.annex-s3-restore-tier, annex.s3-restore-tier — when using an Amazon S3 special remote, this specifies the tier to use when retrieving objects from deep storage 🧊 It can be set to "standard" (the default), "bulk", or "expedited".
remote.<name>.annex-s3-restore-days, annex.s3-restore-days — when using an Amazon S3 special remote, this specifies how many days objects that are retrieved from deep storage should be left available ⏳ The default is 1 day.
remote.<name>.annex-glacier — used to identify Amazon Glacier special remotes 🧊 Normally this is automatically set up by git annex initremote. Cold storage, warm heart.
remote.<name>.annex-rclone — used to identify rclone special remotes 🌀 Normally this is automatically set up by git annex initremote.
remote.<name>.annex-web — used to identify web special remotes 🌐 Normally this is automatically set up by git annex initremote.
remote.<name>.annex-webdav — used to identify webdav special remotes 🕸️ Normally this is automatically set up by git annex initremote.
remote.<name>.annex-tahoe — used to identify tahoe special remotes 🌴 Points to the configuration directory for tahoe. Vacation vibes only.
remote.<name>.annex-gcrypt — used to identify gcrypt special remotes 🔐 Normally this is automatically set up by git annex initremote.

It is set to "true" if this is a gcrypt remote. If the gcrypt remote is accessible over ssh and has git-annex-shell available to manage it, it's set to "shell" 🐚

remote.<name>.annex-git-lfs — used to identify git-lfs special remotes 🧡 Normally this is automatically set up by git annex initremote.

It is set to "true" if this is a git-lfs remote.

remote.<name>.annex-httpalso — used to identify httpalso special remotes 🌈 Normally this is automatically set up by git annex initremote.
remote.<name>.annex-mask — used by mask special remotes, this is set to the name of the remote that is masked 🎭 If this is set to "true", then any remote with the right UUID will be used. Normally this is automatically set up by git annex initremote.
remote.<name>.annex-externaltype — used by external special remotes to record the type of the remote 🔌

E.g., if this is set to "foo", git-annex will run a git-annex-remote-foo program to communicate with the external special remote. Plug-and-play remote, honestly iconic.

If this is set to "readonly" — okay so real talk — git-annex will not run any external special remote program, but it will try to grab stuff stored in the remote using http. And bestie, that only works for some external special remotes, so pls go read the docs of the one you're actually using before you @ me. 🫶

remote.<name>.annex-hooktype — this one's the lil name tag that hook special remotes use to record the type of the remote ✨
annex.web-options, remote.<name>.annex-web-options — extra options to hand off to curl whenever git-annex uses it to download urls (instead of the default built-in url downloader).

Like, if you wanna force IPv4 only, you literally just set it to "-4" 💅

Setting this makes git-annex use curl, but only when annex.security.allowed-ip-addresses is configured in a specific way — go check its docs, iykyk.

Heads up tho: setting this stops git-annex from using git-credential to prompt for http passwords in the situations where it normally does (eg when using a git remote, or the web special remote 😭). Instead, you can toss in "--netrc" so curl uses your ~/.netrc file and you can record the passwords in there.

annex.youtube-dl-options — options to pass to yt-dlp. Example: if youtube is being a whole diva and demanding cookies, use something like "--cookies-from-browser firefox" 🍪

⚠️ Some options may break git-annex's integration with yt-dlp. Like, the --output option could make it stash files somewhere git-annex won't ever find them 💀 So avoid setting here (or in the yt-dlp config file) any options that cause it to download more than one file, or to store the file anywhere other than the current working directory. periodt.

annex.youtube-dl-command — deprecated and unused, bestie, it's giving ghost town 👻 git-annex always runs "yt-dlp", since the "youtube-dl" command has been deprecated.
annex.aria-torrent-options — options to pass to aria2c when using it to download a torrent 🌊
annex.http-headers — the HTTP headers to send when downloading from the web. You can set this option multiple times, one per header 🎀
annex.http-headers-command — if set, the command gets run and every line of its output is used as a HTTP header. This overrides annex.http-headers.

Alternatively, a hook script can be installed in .git/hooks/http-headers-annex 🪝

annex.security.allowed-url-schemes — the list of URL schemes git-annex is allowed to download content from. The default is "http https ftp" 🔒

💀 Think very carefully before changing this; there are security implications, no cap. For example, if it's changed to allow "file" URLs, then literally anyone who can get a commit into your git-annex repository could git-annex addurl a pointer to a private file located outside that repository — possibly causing it to be copied into your repository and transferred on to other remotes, exposing its content. Not the vibe. 🙈

Any url schemes supported by curl can be listed here, but you'll also need to configure annex.security.allowed-ip-addresses to allow using curl.

Some special remotes support their own domain-specific URL schemes; those are not affected by this configuration setting ✨

annex.security.allowed-ip-addresses — by default, git-annex only makes connections to public IP addresses; it will straight-up refuse to use HTTP and other servers on localhost or on a private network 🚫

This setting can override that behavior, allowing access to particular IP addresses that would normally be blocked. For example "127.0.0.1 ::1" allows access to localhost (both IPV4 and IPV6). To allow access to all IP addresses, use "all" 🌈

💀 Think very carefully before changing this; there are security implications, fr fr. Anyone who can get a commit into your git-annex repository could git annex addurl an url on a private server, possibly causing it to be downloaded into your repository and transferred to other remotes, exposing its content. 😭

Note that, since the interfaces of curl and yt-dlp do not allow these IP address restrictions to be enforced, curl and yt-dlp will never be used unless annex.security.allowed-ip-addresses=all.

To allow accessing local or private IP addresses on only specific ports, use the syntax "[addr]:port". For example "[127.0.0.1]:80 [127.0.0.1]:443 [::1]:80 [::1]:443" allows localhost on the http ports only 🎯

annex.security.allowed-http-addresses — old name for annex.security.allowed-ip-addresses. If set, this is treated the same as having annex.security.allowed-ip-addresses set. it's the same pic, different filter 💅
annex.security.allow-insecure-https — this can be used to loosen the security of the HTTPS implementation 😬

Set to "tls-1.2-no-EMS" to allow using TLS 1.2 without Extended Main Secret support. You should do this only when needing to use git-annex with a server that is insecure, and where the security of TLS is not important to you. like, only if you truly don't care 🫣

annex.security.allow-unverified-downloads — okay so for security reasons, git-annex refuses to download content from most special remotes when it can't check a hash to verify that the correct content was downloaded. This particularly impacts downloading the content of URL or WORM keys, which lack hashes 😤

The best way to avoid problems due to this is to migrate files away from such keys, before their content reaches a special remote. See git-annex-migrate(1) ✨

When the content is only available from a special remote, you can use this configuration to force git-annex to download it. But you do so at your own risk, and it's very important you read and understand the info below first! 👑

Downloading unverified content from encrypted special remotes is prevented, because the special remote could send some other encrypted content than what you expect, causing git-annex to decrypt data that you never checked into git-annex, and risking exposing the decrypted data to any non-encrypted remotes you send content to 💀

Downloading unverified content from (non-encrypted) external special remotes is prevented, because they could follow http redirects to web servers on localhost or on a private network, or in some cases to a file:/// url 🙈

If you decide to bypass this security check, the best thing to do is to only set it temporarily while running the command that gets the file. The value to set the config to is "ACKTHPPT". For example:

git -c annex.security.allow-unverified-downloads=ACKTHPPT annex get myfile

It would be a good idea to check that it downloaded the file you expected, too 👀

remote.<name>.annex-security-allow-unverified-downloads — per-remote configuration of annex.security.allow-unverified-downloads 🎀
annex.security.allowed-compute-programs — this is a space separated list of compute programs, eg "git-annex-compute-foo git-annex-compute-bar". Listing a compute program here allows compute special remotes that use that program to be enabled by git-annex enableremote or autoenabled ⚡

🧚 CONFIGURATION OF ASSISTANT 🧚

`annex.delayadd`

Makes the watch and assistant commands delay for the specified number of seconds before adding a newly created file to the annex. Normally this is not needed, because they already wait for all writers of the file to close it 🫶

Note that this only delays adding files created while the daemon is running. Changes made when it is not running will be added immediately the next time it is started up ⏰

`annex.expireunused`

Controls what the assistant does about unused file contents that are stored in the repository 🗑️

The default is false, which causes all old and unused file contents to be retained, unless the assistant is able to move them to some other repository (such as a backup repository).

Can be set to a time specification, like "7d" or "1m", and then file contents that have been known to be unused for a week or a month will be deleted 🔥

`annex.fscknudge`

When set to false, prevents the webapp from reminding you when using repositories that lack consistency checks. it's giving "stop nagging me" energy 💅

`annex.autoupgrade`

When set to ask (the default), the webapp will check for new versions and prompt if they should be upgraded to. When set to true, automatically upgrades without prompting (on some supported platforms). When set to false, disables any upgrade checking ✨

Note that upgrade checking is only done when git-annex is installed from one of the prebuilt images from its website. This does not bypass e.g., a Linux distribution's own upgrade handling code 👑

This setting also controls whether to restart the git-annex assistant when the git-annex binary is detected to have changed. That is useful no matter how you installed git-annex 🌀

`annex.autocommit`

Set to false to prevent the git-annex assistant, git-annex assist, and git-annex sync from automatically committing changes to files in the repository 🙅

To configure the behavior in all clones of the repository, this can be set in git-annex-config(1) 🌈

`annex.startupscan`

Set to false to prevent the git-annex assistant from scanning the repository for new and changed files on startup. This will prevent it from noticing changes that were made while it was not running, but can be a useful performance tweak for a large repository ⚡

`annex.listen`

Configures which IP address the webapp listens on. The default is localhost. Can be either an IP address, or a hostname that resolves to the desired address 🎧

`annex.port`

Configures which port address the webapp listens on. The default is to pick an unused port 🔌

🎀 CONFIGURATION VIA .gitattributes 🎀

okay so you can pick your key-value backend per file type using .gitattributes files, which is honestly so cute of her. in the file, set the annex.backend attribute to the name of the backend you want. (peep git-annex-backends(1) for the full roster of available backends 👀)

for example, here's how you'd roll with the WORM backend as your default, but use SHA256E for ogg files:

* annex.backend=WORM
*.ogg annex.backend=SHA256E

there's also an annex.largefiles attribute 💖 which configures which files are large enough to get added to the annex. but here's the thing — since attributes can't contain spaces, it's genuinely difficult to use for more complex annex.largefiles settings. setting annex.largefiles in git-annex-config(1) is the easier way to configure it across all clones of the repository, no cap. see git-annex-matching-expression(1) for the deets on the syntax.

the numcopies and mincopies settings can also be configured per-file-type via the annex.numcopies and annex.mincopies attributes in .gitattributes files, and this overrides other settings. like, this makes two copies be needed for wav files and 3 copies for flac files:

*.wav annex.numcopies=2
*.flac annex.numcopies=3

git-annex honors these settings whenever it's operating on a matching file. however — and this is the part where you gotta pay attention bestie 😭 — when you use --all, --unused, or --key to specify keys to operate on, git-annex is operating on keys and not files, so it will not honor the settings from .gitattributes. for this reason, the git annex numcopies and git annex mincopies commands are super useful for configuring a global default. iconic behavior honestly.

also note that when using views, only the toplevel .gitattributes file is preserved in the view, so other settings in other files won't have any effect. yeah. that's just how it is 🙈

💅 EXIT STATUS 💅

git-annex herself will exit 0 on success and 1 on failure — unless the --size-limit or --time-limit option is hit, in which case she exits 101. dramatic? maybe. consistent? yes.

a few git-annex subcommands have other exit statuses used to indicate specific problems, and those are documented on their individual man pages. so like, check those if a number looks weird 🫶

🌈 ENVIRONMENT 🌈

these environment variables are used by git-annex when set:

GIT_WORK_TREE, GIT_DIR — handled the same as they are by git, see git(1).
GIT_SSH, GIT_SSH_COMMAND — handled similarly to the same as described in git(1). the one difference is that git-annex will sometimes pass an additional -n parameter to these, as the first parameter, to prevent ssh from reading from stdin. since that can break existing uses of these environment variables that don't expect the extra parameter, you will need to set GIT_ANNEX_USE_GIT_SSH=1 to make git-annex support these.
- note that setting either of these environment variables prevents git-annex from automatically enabling ssh connection caching (see annex.sshcaching), so it will slow down some operations with remotes over ssh. it's up to you to enable ssh connection caching if you need it; see ssh's documentation.
- also, annex.ssh-options and remote.<name>.annex-ssh-options won't have any effect when these environment variables are set.
- usually it's better to configure any desired options through your ~/.ssh/config file, or by setting annex.ssh-options.
GIT_SSL_CAINFO, GIT_SSL_CAPATH — similarly to git, when set to a file or directory, this overrides the default SSL certificates used to verify HTTPS connections.
- (the http.sslCAInfo and http.sslCAPath git configs have the same effect.)
GIT_ANNEX_VECTOR_CLOCK — normally git-annex timestamps lines in the log files committed to the git-annex branch. setting this environment variable to a number will make git-annex use that (or a larger number) rather than the current number of seconds since the UNIX epoch. note that decimal seconds are supported.
- this is only provided for advanced users who either have a better way to tell which commit is current than the local clock, or who need to avoid embedding timestamps for policy reasons. so like, not your average situation bestie 💀
Some special remotes use additional environment variables — for authentication etc. for example, AWS_ACCESS_KEY_ID and GIT_ANNEX_P2P_AUTHTOKEN. see special remote documentation.

🌸 FILES 🌸

these files are used by git-annex:

.git/annex/objects/ in your git repository contains the annexed file contents that are currently available. annexed files in your git repository symlink to that content.
.git/annex/ in your git repository contains other run-time information used by git-annex.
~/.config/git-annex/autostart is a list of git repositories to start the git-annex assistant in.

🦋 SEE ALSO 🦋

more git-annex documentation is available on its web site, <https://git-annex.branchable.com/> ✨

if git-annex is installed from a package, a copy of its documentation should be included, in, for example, /usr/share/doc/git-annex/.

👑 AUTHOR 👑

Joey Hess <id@joeyh.name>

<https://git-annex.branchable.com/>

and that's a wrap on git-annex(1), bestie 💖 the whole page, all nine parts, done and dusted — source, version and date all bundled into that little footer at the bottom 🎀 go forth and annex responsibly, you absolute main character 🫶✨💅

📦 where this page comes from

alpine 3.24: git-annex-doc 10.20261026-r0 · AGPL-3.0-or-later
arch rolling: git-annex 10.20261026-2 · AGPL-3.0-only
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-04: a language model's rewrite of the original, under its terms