La documentation est uniquement en anglais pour le moment. Le reste du site suit votre langue.

Configuration

Every environment variable that Justflows reads: app, database, storage (local or S3), cache, CDN, gzip, and package trust.

9 minutes de lecture

Copy .env.example to .env. The install wizard also writes STATE=INSTALLED — do not set that by hand before you have a database.

Application

Variable	Notes
`APP_SECRET`	≥ 32 random characters. Session HMAC key. Generate with Node `crypto.randomBytes`.
`APP_URL`	Public URL, no trailing slash.
`NODE_ENV`	`development` \| `test` \| `production`.
`PORT` / `HOSTNAME`	Listen address. Schema default port is 3000; some examples use 3001 for a split admin port. `APP_URL` must match what browsers use.
`LOG_LEVEL`	`debug` \| `info` \| `warn` \| `error`.

DB_DRIVER: postgres | mysql | mariadb. Set the discrete DB_HOST, DB_PORT, DB_NAME, DB_USER, and DB_PASSWORD fields and a matching DATABASE_URL; core-backed subsystems read that URL. DB_SSL defaults on for non-local database hosts, and DB_SSL_REJECT_UNAUTHORIZED=0 permits a self-signed certificate.

Storage

STORAGE_DRIVER=local (default) writes uploads to STORAGE_LOCAL_PATH (./uploads). STORAGE_DRIVER=s3 stores them in an S3-compatible bucket (AWS S3, Cloudflare R2, MinIO), signed with AWS Signature V4: set STORAGE_S3_BUCKET, STORAGE_S3_REGION (auto for R2), STORAGE_S3_ACCESS_KEY_ID, STORAGE_S3_SECRET_ACCESS_KEY, and STORAGE_S3_ENDPOINT for anything other than AWS. STORAGE_S3_PREFIX lets several installs share one bucket, and STORAGE_S3_PUBLIC_URL redirects /uploads to a public bucket or CDN instead of streaming through Justflows. The older S3_* names are still read. See Media for switching an existing install with pnpm storage:sync.

Cache and performance

Variable	Default	Purpose
`CACHE_ENABLED`	`1`	Global kill switch (`0`/`false`/`off` disables).
`CACHE_DRIVER`	`filesystem`	`memory` \| `filesystem` \| `plugin:<pluginId>.<storeId>` (a plugin cache store). An unknown value falls back to `filesystem`.
`CACHE_TTL_SECONDS`	`300`	Default TTL.
`CACHE_DIR`	`./.cache`	Filesystem driver directory.
`CACHE_REVALIDATE_ENABLED`	`1`	Selective invalidation when content/menus/theme/settings change.
`CACHE_REVALIDATE_OBJECTS`	`pages,content,menus,theme,cssProviders,site`	Which layers to drop on revalidate.
`JF_GZIP_ENABLED`	`1`	Gzip HTML/JSON/CSS/JS.
`JF_GZIP_LEVEL`	`6`	1–9.
`JF_GZIP_MIN_BYTES`	`1024`	Skip tiny responses.
`JF_BROWSER_CACHE_ENABLED`	`0` (fresh install)	Cache-Control on public HTML and static assets.
`JF_BROWSER_CACHE_HTML_MAX_AGE`	`60`	Seconds.
`JF_BROWSER_CACHE_STATIC_MAX_AGE`	`86400`	Seconds.
`JF_BROWSER_CACHE_SWR`	`300`	stale-while-revalidate seconds.
`BUNNY_API_KEY`	—	Bunny.net account API key, used to purge every site at the CDN when the platform site has no CDN connection turned on.
`BUNNY_PULL_ZONE_ID`	—	Pull zone cleared when the whole zone has to be purged.

Restart the Node process after cache or gzip env changes (or save from Tools → Performance suite, which writes .env and touches tmp/restart.txt on Passenger).

Static / edge export

STATIC_EXPORT_ENABLED (default 1) — master switch for static export; 0 refuses the Run actions and auto-rebuild.
STATIC_EXPORT_DIR (default ./static-export) — output directory, relative to the install root.
STATIC_EXPORT_BASE_URL (default APP_URL) — public origin recorded in the manifest and used for same-origin link detection.
STATIC_EXPORT_CRAWL_URL — origin the crawler fetches from; set it to the public domain behind Passenger / Plesk where a loopback port is unreachable.
STATIC_EXPORT_ORIGIN_URL — still-running origin for form / comment POST; when set, <form action> in the output is rewritten to absolute URLs against it.
STATIC_EXPORT_ALLOWED_ORIGINS — extra comma-separated origins allowed to cross-origin fetch() the submit endpoints (CORS).
STATIC_EXPORT_AUTO (default 0) — incremental re-export after content / menu / theme / settings changes (needs CACHE_REVALIDATE_ENABLED=1); STATIC_EXPORT_DEBOUNCE_MS (default 5000) coalesces bursts.
STATIC_EXPORT_MAX_PAGES (default 2000) and STATIC_EXPORT_CONCURRENCY (default 4) — crawl ceiling and parallel fetches.
PLUGIN_ASSETS_BUNDLE (default 1) — set 0 to emit one <script> / <link> per plugin asset file instead of the combined content-hashed /jf-plugins.<hash> bundle.

Tip

All STATIC_EXPORT_* values are also editable from Admin → System → Tools → “Static site export” → Configuration, which writes .env and applies them in place with no restart.

Mail and network

Outgoing mail defaults to local sendmail. Configure MAIL_TRANSPORT, MAIL_SENDMAIL_PATH, or SMTP with SMTP_HOST, SMTP_PORT, SMTP_SECURE, SMTP_USER, and SMTP_PASS. TRUST_PROXY names the proxies whose forwarded client address is trusted and defaults to loopback. It accepts false, named ranges (loopback, linklocal, uniquelocal), and explicit addresses or subnets. true and hop counts are ignored with a warning, because they can be spoofed when request paths differ in length. Passkeys also read the forwarded host and protocol only from these addresses. Sender identities (From, Reply-To, envelope sender), provider transports, delivery limits, and per-type suppression are configured in Admin → Settings → Outgoing mail; transport secrets are encrypted at rest.

Installation, uploads, and retention

JUSTFLOWS_INSTALL_TOKEN supplies a setup key for automated provisioning; normal installs read the generated key from install-token/TOKEN.txt.
JF_MAX_UPLOAD_MB defaults to 100 MB per file; JF_MAX_LIBRARY_MB defaults to 5120 MB per site.
JF_AUDIT_RETENTION_DAYS defaults to 365 days because audit entries contain personal data such as IP addresses. JF_AUDIT_MAX_ROWS_PER_SITE (default 100,000, between 1,000 and 1,000,000) caps each site's audit rows; the oldest go first.
JF_SUBMISSION_RETENTION_DAYS defaults to 0 (no automatic deletion); set a positive retention window when your form-data policy requires it.
JF_PASSWORD_RESET_TTL_MINUTES defaults to 60 and bounds the lifetime of a self-service password-reset link.
JF_ADMIN_PATH_RECOVERY restores admin access at /admin when a custom admin URL is unreachable behind a proxy or cache.

Package and update hardening

Package authenticity is required by default: plugin, theme, and CSS-provider uploads need a valid Marketplace signature or a trusted SHA-256 digest.
JUSTFLOWS_TRUSTED_PACKAGE_DIGESTS — comma-separated SHA-256 allow-list for packages you trust directly.
JUSTFLOWS_ALLOW_UNSIGNED_PACKAGES=1 — explicitly restore unsigned-package installation for local or legacy workflows.
JUSTFLOWS_UPDATE_DIGEST — expected SHA-256 of a core update zip.
JUSTFLOWS_UPDATE_SIGNING_KEY — HMAC-SHA256 for update uploads (X-Justflows-Update-Signature).
JUSTFLOWS_DISABLE_AUTO_UPDATE=1 — server-wide override that turns off automatic core updates and plugin and theme auto-updates, whatever the admin switches say. Manual updates still work.

CLI

ADMIN_URL (default http://localhost:3001) is the base URL the CLI uses to call admin APIs.

Tip

The Zod schema in @justflows/core validates env, port, host, url, secret, database, storage, cache, and logLevel. Gzip, browser cache, revalidate, and package trust are extra runtime keys documented in .env.example.