Configuration

Environment Variables Reference

MariaDB

Variable	Required	Default	Description
MARIADB_ROOT_PASSWORD	Yes	—	Root password for the database
MARIADB_DATABASE	Yes	—	Database name used by the backend

Backend (ghcr.io/alleslockr/alleslocker-backend)

Variable	Required	Default	Description
SPRING_DATASOURCE_URL	Yes	—	JDBC connection string pointing to MariaDB. Format: jdbc:mariadb://<host>:3306/<db>
SPRING_DATASOURCE_USERNAME	Yes	root	Database user
SPRING_DATASOURCE_PASSWORD	Yes	—	Database password (must match MARIADB_ROOT_PASSWORD)
SPRING_JPA_HIBERNATE_DDL_AUTO	No	update	Schema generation strategy. Use update for dev, validate for production
SECURITY_JWT_SECRET	Yes	—	HMAC-SHA key for signing JWT tokens. Use a random 64-character hex string. Generate: openssl rand -hex 32
SECURITY_JWT_EXPIRATION	No	86400000	JWT token lifetime in milliseconds (24h default)
APP_SECURITY_MASTER_KEY	Yes	—	AES-256 key for en- and decrypting sensitive data at rest. Must be 32 bytes base64-encoded. Generate: openssl rand -base64 32
APP_CORS_ALLOWED_ORIGINS	Yes	—	Comma-separated list of allowed origins. Example: http://localhost:5173,https://app.mydomain.com

Frontend (ghcr.io/alleslockr/alleslocker-frontend)

Variable	Required	Default	Description
VITE_API_URL	Yes	—	Backend API base URL the frontend connects to. Example: http://localhost:8080 or https://api.mydomain.com

---

Persistence

Database data is stored in a Docker volume named mariadb_data. It persists across container restarts and is only deleted when you run docker compose down -v.

To back up the database:

docker compose exec mariadb mysqldump -u root -p$MARIADB_ROOT_PASSWORD $MARIADB_DATABASE > backup.sql

---

Security Considerations

• Change all default secrets. Never use placeholder values in production.
• Keep SECURITY_JWT_SECRET and APP_SECURITY_MASTER_KEY private — if compromised, an attacker could forge tokens or decrypt stored vendor credentials.
• Use environment-specific .env files (gitignored) instead of hardcoding values in docker-compose.yml.
• The backend runs on port 8080; the frontend on port 5173. Do not expose the backend port directly to the internet — use a reverse proxy (e.g., nginx, Caddy) if needed.
• The frontend is a static SPA served by nginx inside the container. It does not store secrets.

---

Generating Secure Values

Secret	Command
JWT secret (64 hex chars)	openssl rand -hex 32
Master key (32 base64 chars)	openssl rand -base64 32
Database password	openssl rand -base64 16