Configuration
Environment variables
All configuration is done via environment variables. Copy .env.example and customize:
cp .env.example .env
Required
| Variable | Description |
|---|---|
JWT_SECRET | JWT access token signing secret |
REFRESH_SECRET | JWT refresh token signing secret |
CSRF_SECRET | CSRF protection secret |
Database
| Variable | Default | Description |
|---|---|---|
DATABASE_URL | postgres://servasec:servasec@db:5432/servasec-db?sslmode=disable | Full connection string |
POSTGRES_USER | servasec | PostgreSQL user |
POSTGRES_PASSWORD | (required) | PostgreSQL password |
POSTGRES_DB | servasec-db | Database name |
POSTGRES_VERSION | 17 | PostgreSQL image version |
SSC_SEED_DATABASE | true | Seed database with default data |
Application
| Variable | Default | Description |
|---|---|---|
SSC_SITE_NAME | servasec | Site name shown in UI |
SSC_PUBLIC_URL | https://servasec.local | Public-facing URL |
SSC_PUBLIC_DOMAIN | servasec.local | Public domain (used by Caddy) |
SSC_REGISTRATION_ENABLED | true | Allow self-registration |
SSC_DEBUG_ENABLED | false | Enable debug mode |
SSC_ADMIN_PASSWORD | (auto-generated) | Initial admin password |
SSC_API_PREFIX | /api | API path prefix |
Security
| Variable | Default | Description |
|---|---|---|
TRUSTED_PROXIES_CIDR | 172.70.1.0/24 | Trusted proxy CIDR range |
SSC_FEATURES_ENCRYPTION_KEY | (auto-generated) | AES-256-GCM key for encrypting tokens (GitHub App keys, etc.) |
Pro features
| Variable | Description |
|---|---|
SSC_LICENSE_KEY | License key to unlock Pro features |
SSO_GITHUB_CLIENT_ID | GitHub OAuth App client ID |
SSO_GITHUB_CLIENT_SECRET | GitHub OAuth App secret |
SSO_GITLAB_CLIENT_ID | GitLab OAuth App client ID |
SSO_GITLAB_CLIENT_SECRET | GitLab OAuth App secret |
SSO_GITLAB_BASE_URL | Self-hosted GitLab base URL (optional) |
SSO_OIDC_CLIENT_ID | OIDC client ID |
SSO_OIDC_CLIENT_SECRET | OIDC client secret |
SSO_OIDC_ISSUER_URL | OIDC issuer URL |
SSO_OIDC_SCOPES | OIDC scopes (default: openid profile email) |