Configuration reference
Generated from api/src/utils/config.ts. Secrets are read from Docker secret files at /run/secrets/<name> (with an env-var fallback for local dev); everything else is an environment variable.
Never commit secrets
The values for items marked secret belong in the secrets/ directory (mounted as Docker secrets) or a secret manager — never in source control or plain .env committed to a repo.
| Variable | Type | Required | Default | Notes |
|---|---|---|---|---|
DATABASE_URL | url | Yes | — | Must be a valid URL. |
db_password | secret | Yes | — | Docker secret file db_password (no env-var fallback). |
integration_encryption_key | secret | Yes | — | Docker secret file integration_encryption_key (no env-var fallback). |
JWT_SECRET | secret | Yes | — | Docker secret jwt_secret; min length 32. |
OPENSEARCH_URL | url | Yes | — | Must be a valid URL. |
TICKETRA_ADMIN_PASSWORD | secret | Yes | — | Docker secret admin_password; min length 12. |
TICKETRA_ADMIN_USERNAME | string | Yes | — | Required. |
ALLOWED_ORIGINS | string | No | — | CORS allowlist — comma-separated list of allowed origins. |
ATTACHMENTS_DIR | string | No | /app/data/attachments | — |
AVATAR_DIR | string | No | — | — |
BACKUP_DIR | string | No | /app/data/backups | — |
INTEGRATION_ENCRYPTION_KEY | string | No | — | — |
INTEGRATION_ENCRYPTION_KEY_FILE | string | No | — | — |
LOG_LEVEL | enum | No | info | One of: debug, info, warn, error. |
MAX_ATTACHMENT_SIZE_MB | integer | No | 10 | — |
MAX_AVATAR_SIZE_MB | integer | No | 2 | — |
NODE_ENV | string | No | — | Set to production in production (enables Secure cookies). |
PORT | integer | No | 8080 | — |
RATE_LIMIT_AVATAR_UPLOADS_PER_MIN | integer | No | 3 | — |
RATE_LIMIT_LOGIN_IP_PER_MIN | integer | No | 30 | — |
RATE_LIMIT_LOGIN_PER_MIN | integer | No | 10 | — |
SESSION_TTL_HOURS | integer | No | 8 | — |
Was this page helpful?