panel/.env.example at main · XyraPanel/panel · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
# XyraPanel Settings
APP_NAME="XyraPanel"

# Environment
NODE_ENV="production"
DEBUG=false

# Application URLs / Auth
BETTER_AUTH_URL=https://panel.example.com
BETTER_AUTH_TRUSTED_ORIGINS=https://panel.example.com
NUXT_PUBLIC_APP_URL=https://panel.example.com
PANEL_PUBLIC_URL="https://panel.example.com"
PANEL_INTERNAL_URL="http://127.0.0.1:3000"
PORT="3000"
XYRA_PASTE_URL=https://paste.xyrapanel.com

# PM2 overrides (optional; defaults in ecosystem.config.cjs)
# INSTANCES=1 # uncomment to force single instance on low-memory hosts
# MAX_MEMORY_RESTART="1G" # match host capacity; default is 1G

# Generate a strong secret with: openssl rand -base64 32
BETTER_AUTH_SECRET=

# Seed (used to bootstrap the first admin account via POST /api/system/seed)
# Generate with: openssl rand -base64 32
SEED_SECRET=
SEED_ADMIN_EMAIL="admin@example.com"
SEED_ADMIN_PASSWORD="changeme"
SEED_ADMIN_USERNAME="admin"
SEED_ADMIN_NAME="Admin"

# Database (PostgreSQL required)
# The app only reads DATABASE_URL. Set it to your PostgreSQL connection string.
DATABASE_URL="postgresql://xyra:changeme@postgres:5432/xyrapanel"

# Docker only: these configure the postgres container in docker-compose.yml
# They must match the credentials in DATABASE_URL above.
DB_USER="xyra"
DB_PASSWORD="changeme"
DB_NAME="xyrapanel"

# Redis
REDIS_HOST="redis"
REDIS_PORT="6379"
# REDIS_USERNAME=""
# REDIS_PASSWORD=""
# REDIS_TLS="false"

# Nitro / Nuxt Redis storage (server-side caching)
NITRO_STORAGE_CACHE_DRIVER="redis"
NITRO_STORAGE_CACHE_HOST="redis"
NITRO_STORAGE_CACHE_PORT="6379"
NUXT_REDIS_HOST="redis"
NUXT_REDIS_PORT="6379"

# Security
NUXT_SECURITY_CORS_ORIGIN="https://panel.example.com"
NUXT_SECURITY_CONNECT_SRC="https://panel.example.com"
NUXT_SECURITY_RATE_LIMIT_DRIVER="redis" # lruCache (default) or redis (recommended in production)
NUXT_SECURITY_RATE_LIMIT_TOKENS="150"
NUXT_SECURITY_RATE_LIMIT_INTERVAL_MS="300000"
NUXT_SECURITY_CSP_REPORT_ONLY="false" # Start in report-only (true), then set false to enforce CSP
NUXT_SECURITY_CSP_REPORT_URI="" # Optional endpoint for CSP violation reports
# - Secret rotation is handled operationally (rotate BETTER_AUTH_SECRET via your secret manager).
# - API key expiration policy is configured in server/utils/auth.ts via apiKey({ keyExpiration: ... }).

# HTTP Cache
NUXT_HTTP_CACHE_ENABLED="true"
NUXT_HTTP_CACHE_DEFAULT_MAX_AGE="5"
NUXT_HTTP_CACHE_DEFAULT_SWR="15"
NUXT_HTTP_CACHE_DASHBOARD_MAX_AGE="10"
NUXT_HTTP_CACHE_DASHBOARD_SWR="30"
NUXT_HTTP_CACHE_ADMIN_DASHBOARD_MAX_AGE="10"
NUXT_HTTP_CACHE_ADMIN_DASHBOARD_SWR="30"
NUXT_HTTP_CACHE_ADMIN_NODE_MAX_AGE="5"
NUXT_HTTP_CACHE_ADMIN_NODE_SWR="15"

# Captcha Provider (turnstile, recaptcha, or hcaptcha)
CAPTCHA_PROVIDER="turnstile"

# Cloudflare Turnstile
NUXT_TURNSTILE_SECRET_KEY=""
NUXT_PUBLIC_TURNSTILE_SITE_KEY="" # Test mode key: 1x00000000000000000000AA

# Google reCAPTCHA v3
# NUXT_RECAPTCHA_SECRET_KEY=""
# NUXT_RECAPTCHA_MIN_SCORE="0.5"

# hCaptcha
# NUXT_HCAPTCHA_SECRET_KEY=""
# NUXT_HCAPTCHA_SITE_KEY=""

# Request Limits (MB)
NUXT_MAX_REQUEST_SIZE_MB="10"
NUXT_MAX_UPLOAD_SIZE_MB="20"