Skip to content
Sofie

Environment variables

An app’s own .env.example, which sofie gen keeps current, lists the ones its features read. Required ones have no default.

  • DATABASE_URL (required): The app’s database, and every module’s that sets none of its own.
  • SOFIE_SIGNING_KEYS (required): Comma-separated base64 keys of 32 bytes sealing sessions and signing links; the first seals. Read as SOFIE_SESSION_KEYS too, with a warning.
  • SOFIE_BASE_URL: Where the app is reached, such as https://example.com, which mails, checkouts, OAuth and pages link back to; each package’s own base URL overrides it.
  • SOFIE_ENVIRONMENT: The environment feature flags are narrowed to, such as production; an app with flags needs it.
  • SOFIE_ADDRESS: Where the web role listens; 127.0.0.1:8080 when unset.
  • SOFIE_TRUSTED_PROXIES: Comma-separated addresses or CIDR ranges of the proxies that may tell the client’s address; none when unset.
  • SOFIE_REQUEST_ID_HEADER: The header a trusted proxy names its own request id in, logged as edge_request_id beside the server’s; x-request-id when unset.
  • SOFIE_CORS_ORIGINS: With the cors feature: comma-separated area=origin, such as api=https://app.example.com, added to each area’s own origins; none when unset.
  • SOFIE_TLS_CERTIFICATE: With the tls feature: the PEM file holding the certificate chain, leaf first; set with SOFIE_TLS_KEY, or neither for plain HTTP.
  • SOFIE_TLS_KEY: With the tls feature: the PEM file holding the certificate’s PKCS#8, PKCS#1 or SEC1 key.
  • SOFIE_SHIELD: With the shield feature: on, dry-run (reports only) or off (tests, benchmarks, fuzzing); dry-run in a debug build and on in a release one when unset.
  • SOFIE_SHIELD_THRESHOLDS: With the shield feature: comma-separated rule=count or area.rule=count, such as scan=60, web.probe=10; each rule’s default when unset.
  • SOFIE_SHIELD_SHARED: With the shield feature: on shares blocks between instances through the database; off when unset.
  • SOFIE_METRICS_TOKEN: With the metrics feature: the bearer token, at least 32 characters, that /metrics asks for; without it /metrics does not exist.
  • SOFIE_MIGRATE: on migrates the database when the process starts; off when unset.
  • SOFIE_TIME_ZONE: The IANA time zone instants are shown in, such as Europe/Istanbul; UTC when unset.
  • SOFIE_LOG: Which events are logged, such as info,sofie_http=debug; info when unset.
  • SOFIE_LOG_SAMPLE: The share of traces, from 0 to 1, whose info lines are logged; warnings and errors always are; 1 when unset.
  • SOFIE_TRACE_SAMPLE: With the otlp feature: the share of traces, from 0 to 1, that are exported; 1 when unset.
  • SOFIE_BROWSER_SAMPLE: With the browser-telemetry feature: the share of browser reports, from 0 to 1, that are kept; 1 when unset.
  • SOFIE_PRODUCT_EVENTS_KEEP_DAYS: With the product-reports feature: days product events are kept; 400 when unset.
  • SOFIE_RUNTIME_THREADS: Threads running requests and jobs; one per logical CPU when unset.
  • SOFIE_DB_POOL_SIZE: Database connections the process keeps open at most; twice the runtime threads when unset.
  • SOFIE_DB_POOL_WAIT_MS: Milliseconds a request waits for a free connection before it is answered 503; 5000 when unset.
  • SOFIE_WORKER_BATCH: Messages the worker claims and handles at once; 2 when unset.
  • SOFIE_WORKER_POOL_SIZE: Connections of a pool of the worker’s own, so jobs cannot take the requests’ connections; the app’s pool when unset.
  • SOFIE_CACHE_STORE: With the cache feature: memory, database (with cache-database) or redis (with cache-redis); memory when unset.
  • SOFIE_REDIS_URL: With SOFIE_CACHE_STORE=redis: redis://[user:password@]host[:port][/database], or rediss:// for TLS.
  • SOFIE_SEARCH: With the search-meilisearch feature: database or meilisearch, the engine searched records are matched by; database when unset.
  • SOFIE_SEARCH_MEILISEARCH_URL: With SOFIE_SEARCH=meilisearch: where Meilisearch answers, such as https://search.example.com.
  • SOFIE_SEARCH_MEILISEARCH_API_KEY: With SOFIE_SEARCH=meilisearch: the key Meilisearch asks for, allowed to search and to write documents and settings; none when unset.
  • SOFIE_SEARCH_MEILISEARCH_PRIVATE: With SOFIE_SEARCH=meilisearch: on lets it be a private address spoken to over plain HTTP, for a Meilisearch inside the network; off when unset.
  • SOFIE_STORAGE: With the storage feature: local, or s3 (with storage-s3), where stored files are kept; local when unset.
  • SOFIE_STORAGE_ROOT: With SOFIE_STORAGE=local: the directory stored files are kept in; storage when unset.
  • SOFIE_STORAGE_S3_ENDPOINT: With SOFIE_STORAGE=s3: where an S3-compatible service answers; AWS’s endpoint for the region when unset.
  • SOFIE_STORAGE_S3_REGION: With SOFIE_STORAGE=s3: the bucket’s region, such as eu-central-1.
  • SOFIE_STORAGE_S3_BUCKET: With SOFIE_STORAGE=s3: the bucket stored files are kept in.
  • SOFIE_STORAGE_S3_ACCESS_KEY_ID: With SOFIE_STORAGE=s3: the access key’s id.
  • SOFIE_STORAGE_S3_SECRET_ACCESS_KEY: With SOFIE_STORAGE=s3: the access key’s secret.
  • SOFIE_STORAGE_S3_PATH_STYLE: With SOFIE_STORAGE=s3: on names the bucket in the path rather than the host, as MinIO asks; off when unset.
  • SOFIE_STORAGE_S3_PRIVATE: With SOFIE_STORAGE=s3: on lets it be a private address spoken to over plain HTTP, for a service inside the network; off when unset.
  • SOFIE_BILLING_PROVIDER: With the billing feature: stripe or paddle, the provider payments go through; none when unset, and plans, trials and quotas still work.
  • SOFIE_BILLING_API_KEY: With SOFIE_BILLING_PROVIDER: the provider’s API key.
  • SOFIE_BILLING_WEBHOOK_SECRET: With SOFIE_BILLING_PROVIDER: the secret the provider signs its webhooks with.
  • SOFIE_BILLING_BASE_URL: With SOFIE_BILLING_PROVIDER: where checkouts return to, such as https://example.com. SOFIE_BASE_URL when unset.
  • SOFIE_BILLING_PRICES: With SOFIE_BILLING_PROVIDER: comma-separated plan or product=price id, such as pro=price_123,credits=price_456.
  • SOFIE_BILLING_API_URL: With SOFIE_BILLING_PROVIDER: where the provider’s API answers; the provider’s own when unset.
  • SOFIE_NOTIFY_VAPID_PUBLIC_KEY: With the notify feature: the base64url VAPID public key web push is sent with; set all three VAPID keys or none, and none sends no web push.
  • SOFIE_NOTIFY_VAPID_PRIVATE_KEY: With the notify feature: the base64url VAPID private key.
  • SOFIE_NOTIFY_VAPID_SUBJECT: With the notify feature: the contact push services may reach, such as mailto:[email protected].
  • SOFIE_OAUTH_PROVIDERS: Comma-separated google, microsoft, github or another OpenID Connect provider’s name; none offered when unset. Each reads SOFIE_OAUTH_<NAME>_CLIENT_ID and _CLIENT_SECRET, Microsoft _TENANT, and another provider _LABEL, _ISSUER, _AUTHORIZATION_URL and _TOKEN_URL.
  • SOFIE_OAUTH_BASE_URL: With SOFIE_OAUTH_PROVIDERS: the app’s public URL without a trailing /, which providers return to. SOFIE_BASE_URL when unset.

Generated from sofie at 4aa7c05.