Дакументацыя пакуль толькі на англійскай мове. Астатняя частка сайта адпавядае вашай мове.

Configuration

Every environment variable that Justflows reads: app, database, storage, cache, gzip, and package trust.

9 хв чытання

Copy .env.example to .env. The install wizard also writes STATE=INSTALLED — do not set that by hand before you have a database.

Application

Variable	Notes
`APP_SECRET`	≥ 32 random characters. Session HMAC key. Generate with Node `crypto.randomBytes`.
`APP_URL`	Public URL, no trailing slash.
`NODE_ENV`	`development` \| `test` \| `production`.
`PORT` / `HOSTNAME`	Listen address. Schema default port is 3000; some examples use 3001 for a split admin port. `APP_URL` must match what browsers use.
`LOG_LEVEL`	`debug` \| `info` \| `warn` \| `error`.

DB_DRIVER: postgres | mysql | mariadb. Set the discrete DB_HOST, DB_PORT, DB_NAME, DB_USER, and DB_PASSWORD fields and a matching DATABASE_URL; core-backed subsystems read that URL. DB_SSL defaults on for non-local database hosts, and DB_SSL_REJECT_UNAUTHORIZED=0 permits a self-signed certificate.

Storage

STORAGE_DRIVER=local (default) with STORAGE_LOCAL_PATH=./uploads. S3-compatible: STORAGE_DRIVER=s3 plus S3_BUCKET, S3_REGION, S3_ENDPOINT, S3_ACCESS_KEY_ID, S3_SECRET_ACCESS_KEY (aliases STORAGE_S3_* exist in the config loader). The @justflows/media package implements local and S3 adapters with Sharp derivatives; the current admin upload route writes the local filesystem under uploads/{siteId}/.

Cache and performance

Variable	Default	Purpose
`CACHE_ENABLED`	`1`	Global kill switch (`0`/`false`/`off` disables).
`CACHE_DRIVER`	`filesystem`	`memory` \| `filesystem` \| `redis` (Redis not implemented yet).
`CACHE_TTL_SECONDS`	`300`	Default TTL.
`CACHE_DIR`	`./.cache`	Filesystem driver directory.
`CACHE_REDIS_URL`	—	Reserved for Redis.
`CACHE_REVALIDATE_ENABLED`	`1`	Selective invalidation when content/menus/theme/settings change.
`CACHE_REVALIDATE_OBJECTS`	`pages,content,menus,theme,cssProviders,site`	Which layers to drop on revalidate.
`JF_GZIP_ENABLED`	`1`	Gzip HTML/JSON/CSS/JS.
`JF_GZIP_LEVEL`	`6`	1–9.
`JF_GZIP_MIN_BYTES`	`1024`	Skip tiny responses.
`JF_BROWSER_CACHE_ENABLED`	`1`	Cache-Control on public HTML and static assets.
`JF_BROWSER_CACHE_HTML_MAX_AGE`	`60`	Seconds.
`JF_BROWSER_CACHE_STATIC_MAX_AGE`	`86400`	Seconds.
`JF_BROWSER_CACHE_SWR`	`300`	stale-while-revalidate seconds.

Restart the Node process after cache or gzip env changes (or save from Tools → Performance suite, which writes .env and touches tmp/restart.txt on Passenger).

Static / edge export

STATIC_EXPORT_ENABLED (default 1) — master switch for static export; 0 refuses the Run actions and auto-rebuild.
STATIC_EXPORT_DIR (default ./static-export) — output directory, relative to the install root.
STATIC_EXPORT_BASE_URL (default APP_URL) — public origin recorded in the manifest and used for same-origin link detection.
STATIC_EXPORT_CRAWL_URL — origin the crawler fetches from; set it to the public domain behind Passenger / Plesk where a loopback port is unreachable.
STATIC_EXPORT_ORIGIN_URL — still-running origin for form / comment POST; when set, <form action> in the output is rewritten to absolute URLs against it.
STATIC_EXPORT_ALLOWED_ORIGINS — extra comma-separated origins allowed to cross-origin fetch() the submit endpoints (CORS).
STATIC_EXPORT_AUTO (default 0) — incremental re-export after content / menu / theme / settings changes (needs CACHE_REVALIDATE_ENABLED=1); STATIC_EXPORT_DEBOUNCE_MS (default 5000) coalesces bursts.
STATIC_EXPORT_MAX_PAGES (default 2000) and STATIC_EXPORT_CONCURRENCY (default 4) — crawl ceiling and parallel fetches.
PLUGIN_ASSETS_BUNDLE (default 1) — set 0 to emit one <script> / <link> per plugin asset file instead of the combined content-hashed /jf-plugins.<hash> bundle.

Tip

All STATIC_EXPORT_* values are also editable from Admin → System → Tools → “Static site export” → Configuration, which writes .env and applies them in place with no restart.

Mail and network

Outgoing mail defaults to local sendmail. Configure MAIL_TRANSPORT, MAIL_SENDMAIL_PATH, or SMTP with SMTP_HOST, SMTP_PORT, SMTP_SECURE, SMTP_USER, and SMTP_PASS. TRUST_PROXY controls which Express proxy hops are trusted and defaults to loopback. Sender identities (From, Reply-To, envelope sender), provider transports, delivery limits, and per-type suppression are configured in Admin → Settings → Outgoing mail; transport secrets are encrypted at rest.

Installation, uploads, and retention

JUSTFLOWS_INSTALL_TOKEN supplies a setup key for automated provisioning; normal installs read the generated key from install-token/TOKEN.txt.
JF_MAX_UPLOAD_MB defaults to 100 MB per file; JF_MAX_LIBRARY_MB defaults to 5120 MB per site.
JF_AUDIT_RETENTION_DAYS defaults to 365 days because audit entries contain personal data such as IP addresses.
JF_SUBMISSION_RETENTION_DAYS defaults to 0 (no automatic deletion); set a positive retention window when your form-data policy requires it.
JF_PASSWORD_RESET_TTL_MINUTES defaults to 60 and bounds the lifetime of a self-service password-reset link.
JF_ADMIN_PATH_RECOVERY restores admin access at /admin when a custom admin URL is unreachable behind a proxy or cache.

Package and update hardening

Package authenticity is required by default: plugin, theme, and CSS-provider uploads need a valid Marketplace signature or a trusted SHA-256 digest.
JUSTFLOWS_TRUSTED_PACKAGE_DIGESTS — comma-separated SHA-256 allow-list for packages you trust directly.
JUSTFLOWS_ALLOW_UNSIGNED_PACKAGES=1 — explicitly restore unsigned-package installation for local or legacy workflows.
JUSTFLOWS_UPDATE_DIGEST — expected SHA-256 of a core update zip.
JUSTFLOWS_UPDATE_SIGNING_KEY — HMAC-SHA256 for update uploads (X-Justflows-Update-Signature).
JUSTFLOWS_DISABLE_AUTO_UPDATE — server-wide override that disables the daily automatic-update job regardless of the admin toggle.

CLI

ADMIN_URL (default http://localhost:3001) is the base URL the CLI uses to call admin APIs.

Tip

The Zod schema in @justflows/core validates env, port, host, url, secret, database, storage, cache, and logLevel. Gzip, browser cache, revalidate, and package trust are extra runtime keys documented in .env.example.