sharper.ly/apps/cms/.env.example

# ---------------------------------------------------------------------------
# SHARP-ER CMS (Strapi 5) - environment template
#
# Copy to .env and fill in real values:   cp .env.example .env
# Generate every secret/salt/key with:    openssl rand -base64 32
# Never commit .env, and never copy real secrets back into this file.
# ---------------------------------------------------------------------------

# Node environment: development | production | test. Drives the CORS defaults
# in config/middlewares.ts (localhost is only allowed outside production).
NODE_ENV=development

# --- Server (config/server.ts) ---------------------------------------------

# Address Strapi binds to. 0.0.0.0 listens on every interface.
HOST=0.0.0.0
# Port the API and admin panel are served on.
PORT=1337
# Public URL of the API, used to build absolute media/admin URLs.
# Leave commented out in local development; set it behind a proxy or a custom
# domain, e.g. PUBLIC_URL=https://cms.sharper.ly
PUBLIC_URL=https://cms.sharper.ly
# true when Strapi sits behind nginx / a load balancer, so X-Forwarded-* headers
# are trusted for the client IP and protocol.
IS_PROXIED=false
# Log verbosity: fatal | error | warn | info | http | debug | trace
LOG_LEVEL=info
# Enable the Strapi cron runner (config/server.ts -> cron.enabled).
# This also turns on the hourly event-reminder e-mails (see src/lib/event-mail).
# Needs SMTP below to be real - with no provider configured the job logs errors.
CRON_ENABLED=false
# Include relations in webhook payloads. Off by default: heavier payloads.
WEBHOOKS_POPULATE_RELATIONS=false

# --- Secrets (config/server.ts, config/admin.ts, config/plugins.ts) ---------
# All of these are per-environment. Rotating APP_KEYS invalidates sessions;
# rotating ENCRYPTION_KEY makes already-encrypted values unreadable.

# Comma-separated session signing keys (at least two, so keys can be rotated).
APP_KEYS="replace-with-random-key-1,replace-with-random-key-2"
# Salt used to hash API tokens.
API_TOKEN_SALT=replace-with-random-salt
# Signing secret for admin-panel sessions.
ADMIN_JWT_SECRET=replace-with-random-secret
# Signing secret for Content API (users-permissions) tokens.
JWT_SECRET=replace-with-random-secret
# Salt used to hash data-transfer tokens (strapi transfer / import / export).
TRANSFER_TOKEN_SALT=replace-with-random-salt
# Key used to encrypt secrets stored in the database (e.g. provider settings).
ENCRYPTION_KEY=replace-with-random-key

# --- Admin panel (config/admin.ts) -----------------------------------------

# Path (or absolute URL) the admin panel is served from.
ADMIN_URL=/admin
# Serve the admin panel from this process. false when it is hosted separately.
SERVE_ADMIN_PANEL=true
# Open a browser window on `strapi develop`. Keep false for headless runs.
ADMIN_AUTO_OPEN=false
# Admin panel UI flags: NPS survey, EE promotion, documentation links.
FLAG_NPS=true
FLAG_PROMOTE_EE=true
FLAG_DOC_LINKS=true

# --- CORS (config/middlewares.ts) ------------------------------------------

# Comma-separated list of browser origins allowed to call the API.
# In development http://localhost:5173 and http://127.0.0.1:5173 (the React
# Router dev server) are always allowed and need not be listed here.
# Example for production: https://sharper.ly,https://www.sharper.ly
CORS_ORIGINS=

# --- Database (config/database.ts) -----------------------------------------

# postgres | mysql | sqlite. This project runs on PostgreSQL 16.
DATABASE_CLIENT=postgres
# Full connection string. When set it takes precedence over the parts below,
# so leave it commented out to use DATABASE_HOST/PORT/NAME/USERNAME/PASSWORD.
# Example: postgres://user:password@host:5432/database
# DATABASE_URL=
# Database host.
DATABASE_HOST=127.0.0.1
# Database port (5432 for PostgreSQL, 3306 for MySQL).
DATABASE_PORT=5432
# Database name.
DATABASE_NAME=sharper_cms
# Database user.
DATABASE_USERNAME=postgres
# Database password.
DATABASE_PASSWORD=replace-with-your-database-password
# PostgreSQL schema Strapi writes its tables into.
DATABASE_SCHEMA=public
# Enable TLS for the database connection. Usually true on managed databases.
DATABASE_SSL=false
# Optional TLS material, only read when DATABASE_SSL=true.
# DATABASE_SSL_KEY=
# DATABASE_SSL_CERT=
# DATABASE_SSL_CA=
# DATABASE_SSL_CAPATH=
# DATABASE_SSL_CIPHER=
# Set to false only for a self-signed database certificate.
# DATABASE_SSL_REJECT_UNAUTHORIZED=true
# Connection pool bounds.
# DATABASE_POOL_MIN=2
# DATABASE_POOL_MAX=10
# Milliseconds to wait for a free connection before failing.
# DATABASE_CONNECTION_TIMEOUT=60000
# SQLite file, relative to apps/cms. Only used when DATABASE_CLIENT=sqlite.
# DATABASE_FILENAME=.tmp/data.db

# --- Authentication rate limit (config/plugins.ts) --------------------------

# Window in milliseconds for the users-permissions auth rate limit.
AUTH_RATE_LIMIT_INTERVAL=60000
# Maximum auth requests (login, forgot password, ...) per window per IP.
AUTH_RATE_LIMIT_MAX=5

# --- Public submission rate limit (src/middlewares/rate-limit.ts) -----------

# The three public POST endpoints (contact-submission, event-registration,
# application) are capped per client IP. The limiter is in-process, so with
# several Strapi instances the effective cap is this many PER INSTANCE - put a
# shared limiter in front of a multi-instance deployment.
# Window in milliseconds.
SUBMISSION_RATE_LIMIT_INTERVAL=60000
# Maximum submissions per window per IP, per endpoint.
SUBMISSION_RATE_LIMIT_MAX=5
# Set to false to switch the limiter off (load tests only - never in production).
# SUBMISSION_RATE_LIMIT_ENABLED=false

# --- Public account flows (src/bootstrap/auth-permissions.ts) ---------------

# This site has no end-user accounts, so every users-permissions auth endpoint
# is revoked from the Public role on each boot - `register` above all, which
# Strapi grants by default and which would let anyone create an API account.
# List here, comma-separated, only the actions that are DELIBERATELY public,
# e.g. PUBLIC_AUTH_ACTIONS=callback,forgotPassword. Empty means "none", which
# is the intended state.
# PUBLIC_AUTH_ACTIONS=

# --- Media / uploads (config/plugins.ts) ------------------------------------

# Maximum size of a single uploaded file, in bytes. Default 50 MB.
UPLOAD_MAX_FILE_SIZE=52428800
# Cache-Control max-age (ms) for files served by the local upload provider.
UPLOAD_LOCAL_MAX_AGE=300000

SMTP_HOST=smtp.example.com
SMTP_PORT=587
SMTP_USERNAME=your-username
SMTP_PASSWORD=your-password
# Optional comma-separated reviewer recipients. If empty, partner draft
# notifications are sent to all active Strapi Super Admin accounts.
PARTNER_REVIEW_NOTIFICATION_EMAILS=
DEFAULT_FROM=no-reply@yourdomain.com
DEFAULT_REPLY_TO=support@yourdomain.com
# The values above are also the from/reply-to for the registration
# confirmation, event-reminder and application-acknowledgement e-mails
# (src/lib/event-mail.ts, src/lib/application-mail.ts).
#
# The subject and body of those e-mails are editable in the CMS (the
# email-settings single type); the SHARP-ER / EU / partner logo header needs
# PUBLIC_URL (above) to build absolute image URLs - without it the mail falls
# back to a text wordmark.

# Production only - switching the upload provider to S3. Uncomment these after
# adding @strapi/provider-upload-aws-s3 and editing the upload block in
# config/plugins.ts (the switch is documented there step by step).
# AWS_ACCESS_KEY_ID=
# AWS_ACCESS_SECRET=
# AWS_REGION=
# AWS_BUCKET=
# AWS_ACL=private
# AWS_SIGNED_URL_EXPIRES=900
# S3_ROOT_PATH=
# CDN_URL=