Configuration
Every environment variable that Justflows reads: app, database, storage, cache, gzip, and package trust.
8 min read
Copy .env.example to .env. The install wizard also writes STATE=INSTALLED — do not set that by hand before you have a database.
Application
| Variable | Notes |
|---|---|
APP_SECRET | ≥ 32 random characters. Session HMAC key. Generate with Node crypto.randomBytes. |
APP_URL | Public URL, no trailing slash. |
NODE_ENV | development | test | production. |
PORT / HOST | Listen address. Schema default port is 3000; some examples use 3001 for a split admin port. APP_URL must match what browsers use. |
LOG_LEVEL | debug | info | warn | error. |
Database
DB_DRIVER / DATABASE_DRIVER: postgres | mysql | mariadb. Either discrete DB_* fields or DATABASE_URL matching the driver scheme. Optional DATABASE_POOL_MIN (2), DATABASE_POOL_MAX (10), DATABASE_SSL.
Storage
STORAGE_DRIVER=local (default) with STORAGE_LOCAL_PATH=./uploads. S3-compatible: STORAGE_DRIVER=s3 plus S3_BUCKET, S3_REGION, S3_ENDPOINT, S3_ACCESS_KEY_ID, S3_SECRET_ACCESS_KEY (aliases STORAGE_S3_* exist in the config loader). The @justflows/media package implements local and S3 adapters with Sharp derivatives; the current admin upload route writes the local filesystem under uploads/{siteId}/.
Cache and performance
| Variable | Default | Purpose |
|---|---|---|
CACHE_ENABLED | 1 | Global kill switch (0/false/off disables). |
CACHE_DRIVER | filesystem | memory | filesystem | redis (Redis not implemented yet). |
CACHE_TTL_SECONDS | 300 | Default TTL. |
CACHE_DIR | ./.cache | Filesystem driver directory. |
CACHE_REDIS_URL | — | Reserved for Redis. |
CACHE_REVALIDATE_ENABLED | 1 | Selective invalidation when content/menus/theme/settings change. |
CACHE_REVALIDATE_OBJECTS | pages,content,menus,theme,cssProviders,site | Which layers to drop on revalidate. |
JF_GZIP_ENABLED | 1 | Gzip HTML/JSON/CSS/JS. |
JF_GZIP_LEVEL | 6 | 1–9. |
JF_GZIP_MIN_BYTES | 1024 | Skip tiny responses. |
JF_BROWSER_CACHE_ENABLED | 1 | Cache-Control on public HTML and static assets. |
JF_BROWSER_CACHE_HTML_MAX_AGE | 60 | Seconds. |
JF_BROWSER_CACHE_STATIC_MAX_AGE | 86400 | Seconds. |
JF_BROWSER_CACHE_SWR | 300 | stale-while-revalidate seconds. |
Restart the Node process after cache or gzip env changes (or save from Tools → Performance suite, which writes .env and touches tmp/restart.txt on Passenger).
Package and update hardening
JUSTFLOWS_REQUIRE_SIGNED_PACKAGES=1— reject plugin/theme/CSS uploads unless trusted or signed.JUSTFLOWS_TRUSTED_PACKAGE_DIGESTS— comma-separatedid:sha256allow-list.JUSTFLOWS_UPDATE_DIGEST— expected SHA-256 of a core update zip.JUSTFLOWS_UPDATE_SIGNING_KEY— HMAC-SHA256 for update uploads (X-Justflows-Update-Signature).
CLI
ADMIN_URL (default http://localhost:3001) is the base URL the CLI uses to call admin APIs.
Tip
The Zod schema in @justflows/core validates env, port, host, url, secret, database, storage, cache, and logLevel. Gzip, browser cache, revalidate, and package trust are extra runtime keys documented in .env.example.