Backend configuration lives in backend/.env.production. Start from backend/.env.production.example, which lists every supported key with a safe default. The variables below are the ones you must set or are most likely to change.
Application
| Variable | Purpose |
|---|
| APP_KEY | Encryption key. Generate with php artisan key:generate. |
| APP_URL | Public URL of the API, e.g. https://api.example.com. |
| PORTAL_URL | Public URL of the admin portal. Also determines the WebAuthn relying party for passkeys. |
| MARKETING_URL | Public URL of the marketing site, if separate. |
| APP_DEBUG | Must be false in production. |
| TRUSTED_PROXIES | Set to * behind a reverse proxy so client IPs and HTTPS detection are correct. |
Database, cache and queue
| Variable | Purpose |
|---|
| DB_CONNECTION, DB_HOST, DB_PORT, DB_DATABASE, DB_USERNAME, DB_PASSWORD | PostgreSQL connection. |
| REDIS_HOST, REDIS_PORT, REDIS_PASSWORD | Redis for cache, sessions and queues. |
| QUEUE_CONNECTION | Use redis in production. |
| QUEUE_TIER_CRITICAL / DEFAULT / LOW | Queue names per tier. Workers are sized separately with QUEUE_WORKER_*_PROCS. |
| SESSION_DRIVER, SESSION_DOMAIN, SESSION_SECURE_COOKIE | Session storage and cookie scope. Set the domain so the portal and API share a session. |
Cross-origin and stateful auth
| Variable | Purpose |
|---|
| SANCTUM_STATEFUL_DOMAINS | Comma-separated portal hostnames allowed to hold a session. |
| CORS_ALLOWED_ORIGINS | Origins permitted to call the API. |
تنبيهIf the portal and API are on different subdomains, both must appear in SANCTUM_STATEFUL_DOMAINS and CORS_ALLOWED_ORIGINS, and SESSION_DOMAIN must be the shared parent domain — otherwise sign-in appears to succeed and then immediately drops.
Mail
- MAIL_MAILER, MAIL_HOST, MAIL_PORT, MAIL_USERNAME, MAIL_PASSWORD, MAIL_ENCRYPTION
- MAIL_FROM_ADDRESS and MAIL_FROM_NAME — the sender your clients see.
Provisioning panels
| Variable | Purpose |
|---|
| HOSTINVO_PANEL_DRIVERS | Enabled drivers, e.g. cpanel,plesk. |
| HOSTINVO_CPANEL_DEFAULT_PORT, HOSTINVO_CPANEL_TIMEOUT, HOSTINVO_CPANEL_RETRY_TIMES | cPanel/WHM API behaviour. |
| HOSTINVO_PLESK_DEFAULT_PORT, HOSTINVO_PLESK_TIMEOUT, HOSTINVO_PLESK_RETRY_TIMES | Plesk API behaviour. |
| HOSTINVO_PROVISIONING_QUEUE | Queue that provisioning jobs are dispatched to. |
Payments
| Variable | Purpose |
|---|
| PAYMENTS_STRIPE_ENABLED, STRIPE_SECRET_KEY, STRIPE_PUBLISHABLE_KEY, STRIPE_WEBHOOK_SECRET | Stripe gateway. |
| PAYMENTS_PAYPAL_ENABLED, PAYPAL_CLIENT_ID, PAYPAL_CLIENT_SECRET, PAYPAL_WEBHOOK_ID, PAYPAL_MODE | PayPal gateway. PAYPAL_MODE is sandbox or live. |
| PAYMENT_WEBHOOK_TOLERANCE_SECONDS | How much clock skew a signed webhook may have. |
Licensing
| Variable | Purpose |
|---|
| LICENSING_VERIFICATION_URL | Licence authority endpoint. |
| LICENSING_ALLOW_LOCAL_VALIDATION | Permit offline validation. Leave disabled unless you operate the authority. |
| LICENSING_AUTHORITY_PUBLIC_KEY | Ed25519 public key used to verify signed authority responses. |
Security and monitoring
| Variable | Purpose |
|---|
| PASSKEY_RP_ID | WebAuthn relying party. Defaults to the portal host; set the shared parent domain if you serve the portal on more than one hostname. |
| TURNSTILE_VERIFY_URL, TURNSTILE_TIMEOUT_SECONDS | Cloudflare Turnstile verification. Keys are stored in the database, not here. |
| MONITORING_METRICS_TOKEN | Bearer token guarding the metrics endpoint. |
| MONITORING_ALERT_WEBHOOK_URL | Where alerts are POSTed. |
| BACKUP_ROOT, BACKUP_RETENTION_DAYS | Backup destination and retention. |
Frontend
| Variable | Purpose |
|---|
| NEXT_PUBLIC_API_BASE_URL | API base URL used by the browser, e.g. https://api.example.com/api/v1. |
| INTERNAL_API_BASE_URL | API base URL used for server-side rendering. Can be an internal address. |
نصيحةAfter changing any backend variable, run php artisan config:cache and restart the app, queue worker and scheduler containers. Cached config is not re-read on its own.
