Runtime configuration

.env.example is the canonical and complete reference for environment-based runtime configuration in version 2.0.2.

The application deliberately does not support the former SALES_URL or PRICE_* variables. Pricing and Pro advertising were removed from the public UI; dead configuration keys are not kept for compatibility.

HTTP and identity

LISTEN_ADDRESS
BASE_URL
OUTPUT_BASE_URL
PUBLIC_NAME
CONTACT_URL
DEFAULT_LANGUAGE
HEALTHCHECK_URL
SERVICE_MODE
API_ALLOWED_ORIGIN

Proxy, logging and transport security

TRUST_PROXY
TRUSTED_PROXY_CIDRS
LOG_CLIENT_IP
ENABLE_HSTS
REQUIRE_LICENSE
WHITE_LABEL

TRUST_PROXY=true is rejected unless at least one valid CIDR is configured. Forwarded client-IP headers are only considered when the direct peer address is inside one of those networks.

LOG_CLIENT_IP=false keeps client addresses out of structured request logs.

ENABLE_HSTS=true emits Strict-Transport-Security: max-age=31536000; includeSubDomains; enable it only on deployments that are actually HTTPS-only.

Prometheus

METRICS_ENABLED
METRICS_TOKEN
METRICS_TOKEN_FILE

Metrics are disabled by default. When enabled, a bearer token of at least 32 characters is mandatory. A configured METRICS_TOKEN_FILE has priority over METRICS_TOKEN.

Operator, privacy and accessibility pages

The following settings feed /legal, /privacy and /accessibility in full and bulk mode:

LEGAL_STRICT
LEGAL_NAME
LEGAL_ADDRESS
LEGAL_REPRESENTATIVE
LEGAL_EMAIL
LEGAL_PHONE
LEGAL_REGISTER
LEGAL_REGISTER_NUMBER
LEGAL_VAT_ID
EDITORIAL_RESPONSIBLE_NAME
EDITORIAL_RESPONSIBLE_ADDRESS
DATA_PROTECTION_CONTACT
HOSTING_PROVIDER
HOSTING_ADDRESS
LOG_RETENTION
DATA_RECIPIENTS
THIRD_COUNTRY_TRANSFERS
SUPERVISORY_AUTHORITY_NAME
SUPERVISORY_AUTHORITY_URL
CONSUMER_DISPUTE_STATUS
CONSUMER_DISPUTE_BODY
CONSUMER_DISPUTE_URL
ACCESSIBILITY_CONTACT
ACCESSIBILITY_STATUS

LEGAL_STRICT=true is a deployment guard, not a legal-compliance determination. It prevents startup if the core operator/privacy data is empty or still contains common placeholder markers. The pages themselves explicitly state that they do not replace legal review.

Runtime licensing

LICENSE_TOKEN
LICENSE_TOKEN_FILE
LICENSE_INSTANCE_ID
LICENSE_MODE
LICENSE_SERVER_URL
LICENSE_CACHE_FILE
LICENSE_REFRESH_INTERVAL
LICENSE_REQUEST_TIMEOUT

The application contains no licence issuer, private signing key or configurable issuer public key. Licence creation remains external in the Universal License Platform.

Bulk

BULK_MAX_ITEMS
BULK_MAX_BODY_BYTES
BULK_REQUIRE_API_KEY
BULK_API_KEY
BULK_API_KEY_FILE

The bulk_items licence limit can further reduce the effective item count. A configured BULK_API_KEY_FILE has priority over BULK_API_KEY.

2.9 KiB Raw Permalink Blame History