Skip to main content

Environment Configuration

Environment Configuration​

NuSaaS requires two files: /opt/nusaas/.env for Laravel and Compose, and /opt/nusaas/web/.env.frontend for runtime frontend configuration. The interactive installer creates both. Manual installers should download the maintained templates instead of assembling variables from snippets:

mkdir -p /opt/nusaas/web && cd /opt/nusaas
curl -fsSL https://get.nusaas.com/.env.selfhosted -o .env
curl -fsSL https://get.nusaas.com/.env.frontend -o web/.env.frontend

Required backend values​

Set all CHANGE_ME values. In particular:

  • APP_KEY, JWT_SECRET, and the three REVERB_APP_* values must be unique random secrets.
  • DB_USERNAME must be a non-root MySQL user. Set different strong values for DB_PASSWORD and DB_ROOT_PASSWORD.
  • Keep the Docker service names DB_HOST=db, REDIS_HOST=cache, MEILISEARCH_HOST=http://search:7700, and REVERB_HOST=ws.
  • Keep CORS_ALLOWED_ORIGIN_PATTERNS quoted. Its leading # is part of the regex; without quotes dotenv treats it as a comment.
  • Set INITIAL_ADMIN_EMAIL and INITIAL_ADMIN_PASSWORD before running migrate --seed; the seeder creates the first system administrator.
  • For SMTP on port 587, keep MAIL_SCHEME=null unless your provider requires another scheme. Use smtps for implicit TLS providers.

Generate secrets with:

printf 'base64:' && openssl rand -base64 32
openssl rand -hex 32
openssl rand -hex 8
openssl rand -hex 10
openssl rand -hex 32

Required frontend values​

  • Set both VITE_API_URL and VITE_API_BASE_URL to the API origin, for example https://api.yourdomain.com. Do not append /api.
  • Keep VITE_DEPLOYMENT=self-hosted and VITE_BILLING_ENABLED=false.
  • VITE_REVERB_APP_KEY must exactly match backend REVERB_APP_KEY.
  • When Nginx exposes Reverb through the API hostname, use VITE_REVERB_HOST=api.yourdomain.com, port 443, and scheme wss.
  • Point VITE_DOCS_URL and the support/legal variables at your own installation.
  • Leave Google, Firebase, Sentry, SMS, and other integration credentials blank until you configure those services.

Validate file paths and required Compose variables without printing the resolved configuration:

docker compose config --quiet