Environment variables

This table is the source of truth. server/.env.template and client/.env.template are copies to start from; scripts/check-docs.sh fails when a variable used in the code is missing here. For the reasoning behind each group of settings, read Server configuration.

The server loads server/.env with dotenv at startup (server/src/env.ts). There is no schema validation: a missing variable takes its default, or throws when first used if it has none.

Server

Application

Variable	Default	Purpose
APP_NAME	Damvia - Open Source Digital Asset Management	Returned by the public env query; the client uses it as the document title.
APP_URL	http://localhost:5173	Public URL of the client. Every link in an email is built from it, and expired download links redirect to APP_URL/link-expired.
API_URL	http://localhost:3000	Public URL of this server. Download links are API_URL/v1/downloads/{id}.
APP_SECRET	Damvia App Secret	Secret used to sign JWT auth tokens (180-day lifetime). Change it: with the default, anyone can forge a token. Changing it later logs every user out.
PORT	3000	HTTP port the server listens on (0.0.0.0).
NODE_ENV	unset	production in deployments. npm start sets it.
ENABLE_WORKER	unset (worker off)	true starts the pg-boss worker inside this process. npm run dev sets it. See Worker and scaling.
ENABLE_PASSWORD_LESS_AUTH	false	true disables passwords entirely: sign-up stores none and login always emails a magic link.

Database

Variable	Default	Purpose
DATABASE_URL	postgresql://dam:dam@localhost/dam	Postgres connection string, used by TypeORM and by pg-boss (which creates a pgboss schema in the same database).

Object storage

Variable	Default	Purpose
MAIN_S3_URL	none, required	http(s)://ACCESS_KEY:SECRET_KEY@host:port/bucket. Bucket for collection and page thumbnails, page images and the login background.
ASSETS_S3_URL	none, required	Same syntax. Bucket for asset originals (asset-file/{id}), asset thumbnails and download archives (downloads/{id}).

The scheme sets useSSL; the port defaults to 443 for https and 80 for http. Details in Object storage.

Email

Variable	Default	Purpose
SMTP_HOST	localhost	SMTP server.
SMTP_PORT	1025	SMTP port. The defaults match MailHog from docker-compose.yml.
SMTP_USER	unset	SMTP login. Authentication is only enabled when both SMTP_USER and SMTP_PASS are set.
SMTP_PASS	unset	SMTP password.
MAILCONFIG	unset	Base64-encoded JSON of the mail templates. When unset, the server reads server/mailconfig.json and exits with an error if the file is unreadable. See Email templates.

Cloud storage sync

Variable	Default	Purpose
ASSET_UPDATER	none, required	dropbox or onedrive. Any other value stops the server at startup with Provide a valid asset updater.
DROPBOX_APP_KEY	unset	Dropbox app key (Dropbox only).
DROPBOX_APP_SECRET	unset	Dropbox app secret.
DROPBOX_REFRESH_TOKEN	unset	Long-lived refresh token obtained once through the OAuth flow. See Dropbox.
DROPBOX_USE_TEAM_ROOT	false	true lists the Dropbox Business team space instead of the member’s home folder.
ONEDRIVE_TENANT_ID	unset	Azure AD tenant (OneDrive only).
ONEDRIVE_CLIENT_ID	unset	Azure app registration client id.
ONEDRIVE_CLIENT_SECRET	unset	Azure app client secret.
ONEDRIVE_USER	unset	User principal name whose drive is synced, for example [email protected].
ONEDRIVE_DRIVE	unset	Path inside that drive, Graph syntax, for example root:/DAM. See OneDrive.

PIM linking

Variable	Default	Purpose
PRODUCT_MATCHING_REGEX	unset (job logs an error and skips)	Regex applied to each asset file name every 5 minutes. Capture group 1 is the product key, optional group 2 the product view. Example: ^(.{6}-\d{3})(?:\.(\d{2}))?.
PIM_PRODUCT_VIEW	unset	The product view code (group 2 above) whose thumbnail represents the product in the admin product list, for example 00.

See Products and PIM.

Client

Client variables are read by Vite at build time and baked into the bundle. Changing one means restarting npm run dev or rebuilding.

Variable	Default	Purpose
VITE_API_ENDPOINT	http://localhost:3000/trpc	Full URL of the server’s tRPC endpoint, that is API_URL plus /trpc.
VITE_BRAND_COLOR	sky-400	Accent colour. A Tailwind colour name (red-500) or any CSS colour (#e11d48).
VITE_BRAND_COLOR_HOVER	sky-500	Hover shade of the accent.
VITE_BRAND_COLOR_STRONG	sky-600	Strong shade of the accent, used for emphasis text.

The brand colours are resolved in client/tailwind.config.js, which loads client/.env itself. See Client configuration.