Environment Variables¶

Each instance reads its settings from .env in its instance folder (/opt/strawly/instances/<name>/.env). The installer writes every value, including the secrets. This page describes each variable for when you need to change one, or for a manual install.

After changing .env, apply it with strawly apply.

Keep .env private

.env holds the database password and the keys that protect sessions and stored credentials. The installer creates it with permissions 600. Never commit it to version control.

Versions¶

Variable	Description	Example
`STRAWLY_VERSION`	Core version. The frontend and backend both run it.	`1.0.0`
`OPTIMIZATIONS_AZURE_VERSION`	Azure Optimizations module version. It must support the core version (see Updating).	`1.0.0`
`STRAWLY_REGISTRY`	Where the images come from. Change it only when you mirror the images.	`git.strawly.app/strawly`

Instance¶

Variable	Description	Example
`COMPOSE_PROJECT_NAME`	Docker name of the instance. Must be unique on the machine.	`strawly-acme`
`COMPOSE_PROFILES`	Modules to run, comma-separated. `none` runs no modules.	`azure`
`STRAWLY_MODE`	`local`, `lan` or `domain`	`domain`
`STRAWLY_PUBLIC_URL`	The address people type. Strawly accepts browser requests from this address only.	`https://strawly.example.com`
`STRAWLY_HTTP_PORT`	Port of the instance proxy, which serves both the web interface and the API	`8080`
`STRAWLY_BIND`	Interface the port listens on. `127.0.0.1` for this machine only, `0.0.0.0` for the network.	`127.0.0.1`
`STRAWLY_DOMAIN`	Domain, in domain mode	`strawly.example.com`
`STRAWLY_APP_DIR`	Folder with `docker-compose.yml` and `Caddyfile`. Set by the CLI.	`/opt/strawly/app`
`STRAWLY_ALLOW_DEMO`	`1` allows demo data, whose accounts have public passwords. Local instances only.	`0`

First admin account¶

Variable	Description
`ADMIN_EMAIL`	Email of the first admin account, created when the database is new
`ADMIN_PASSWORD`	Its first password: at least 8 characters with an upper-case letter, a digit and a special character
`ADMIN_PASSWORD_TEMPORARY`	`1` makes the admin choose a new password at first sign-in

The account is created only on a new database. The installer removes ADMIN_PASSWORD from .env once the account exists. Changing these values later has no effect on the existing account. Change the password in Strawly instead.

Secrets¶

Variable	Description	Generate with
`POSTGRES_PASSWORD`	Database password	`openssl rand -hex 24`
`JWT_SECRET`	Signs login sessions	`openssl rand -hex 48`
`CREDENTIALS_ENCRYPTION_KEY`	Encrypts stored cloud credentials and the SMTP password. Exactly 64 hex characters.	`openssl rand -hex 32`
`INTERNAL_API_TOKEN`	Authenticates calls between the backend and the modules. At least 32 characters.	`openssl rand -hex 32`

POSTGRES_DB and POSTGRES_USER default to strawly.

Set inside the images¶

These are fixed by docker-compose.yml and normally need no change:

Variable	Service	Value
`BACKUP_DIR`	backend	`/var/lib/strawly/backups`, a Docker volume holding uploaded backups and the copies saved before each restore
`BACKUP_MAX_UPLOAD_BYTES`	backend	Largest backup file accepted by Restore from backup. Default 5 GiB.
`STRAWLY_API_URL`	frontend	Empty, so the browser calls `/api` on the same address. Set it only when the backend has its own address.
`BACKEND_INTERNAL_URL`	modules	`http://backend:3001`
`APP_VERSION`	all	Set when the image is built. Reported in `/health` and Settings > About.

Cloud credentials such as the Azure service principal are not environment variables. Enter them under Settings > Credentials, where they are encrypted with CREDENTIALS_ENCRYPTION_KEY.

Rotating secrets¶

Rotate a secret straight away if it may have been exposed.

`JWT_SECRET`¶

Signs everyone out.

# 1. Put a new value from `openssl rand -hex 48` in .env, then:
strawly apply

`INTERNAL_API_TOKEN`¶

The backend and modules read it from the same .env, so one change covers both.

# 1. Put a new value from `openssl rand -hex 32` in .env, then:
strawly apply

`CREDENTIALS_ENCRYPTION_KEY`¶

Stored cloud credentials and the SMTP password become unreadable with a new key, so you enter them again after the change.

Put a new value from openssl rand -hex 32 in .env, then run strawly apply.
Enter the cloud credentials again under Settings > Credentials, and the SMTP password under Settings > Notifications.

Collector runs fail with a decryption error between the two steps, so do both in one sitting.

`POSTGRES_PASSWORD`¶

# 1. Change the password inside PostgreSQL
strawly compose exec postgres psql -U strawly -c "ALTER USER strawly PASSWORD 'new-password-here';"

# 2. Put the same value in .env as POSTGRES_PASSWORD, then:
strawly apply