Backend
Backend configuration#
cp .env.example .envRequired#
| Variable | What it is |
|---|---|
DATABASE_URL | PostgreSQL connection string |
CRYPTO_SECRET | Signs sessions — openssl rand -hex 32 |
CRYPTO_SECRET is generated once and kept. Changing it signs every user out.
Optional#
| Variable | Default | What it does |
|---|---|---|
PORT | 3000 | Port to listen on. |
META_NAME | P-Stream: Backend | Name shown to people who add this backend. |
META_DESCRIPTION | a short tagline | Description shown next to the name. |
DB_PROVIDER | plain postgres | Set to supabase to use DATABASE_URL_SUPABASE instead. |
DATABASE_URL_SUPABASE | — | Only read when DB_PROVIDER=supabase. |
CAPTCHA | false | true puts Cloudflare Turnstile on sign up. |
CAPTCHA_CLIENT_KEY | — | Turnstile site key. Required when CAPTCHA is on. |
CAPTCHA_SECRET | — | Turnstile secret key. Required when CAPTCHA is on. |
Metrics#
Counters survive restarts on their own — they are written to a metrics
table in the same Postgres database, so there is nothing extra to mount.
/metrics/daily, /metrics/weekly and /metrics/monthly show the same
counters as /metrics, counted over the last 24 hours, 7 days or 30 days.
Keep Postgres off the internet#
Docker writes its own iptables rules and goes straight through ufw, so a
published 5432 is your database on the public internet regardless of what
your firewall says. Use expose rather than ports, and let the backend
reach it by service name.