Skip to content

Configuration

Jump to bottom
Luca edited this page Jun 17, 2026 · 2 revisions

Environment Variables Reference

MariaDB

Variable Required Default Description
MARIADB_ROOT_PASSWORD Yes — Root password for the database
MARIADB_DATABASE Yes — Database name used by the backend

Backend (ghcr.io/alleslockr/alleslocker-backend)

Variable Required Default Description
SPRING_DATASOURCE_URL Yes — JDBC connection string pointing to MariaDB. Format: jdbc:mariadb://<host>:3306/<db>
SPRING_DATASOURCE_USERNAME Yes root Database user
SPRING_DATASOURCE_PASSWORD Yes — Database password (must match MARIADB_ROOT_PASSWORD)
SPRING_JPA_HIBERNATE_DDL_AUTO No update Schema generation strategy. Use update for dev, validate for production
SECURITY_JWT_SECRET Yes — HMAC-SHA key for signing JWT tokens. Use a random 64-character hex string. Generate: openssl rand -hex 32
SECURITY_JWT_EXPIRATION No 86400000 JWT token lifetime in milliseconds (24h default)
APP_SECURITY_MASTER_KEY Yes — AES-256 key for encrypting vendor API credentials at rest. Must be 32 bytes base64-encoded. Generate: openssl rand -base64 32
APP_CORS_ALLOWED_ORIGINS Yes — Comma-separated list of allowed origins. Example: http://localhost:5173,https://app.mydomain.com

Frontend (ghcr.io/alleslockr/alleslocker-frontend)

Variable Required Default Description
VITE_API_URL Yes — Backend API base URL the frontend connects to. Example: http://localhost:8080 or https://api.mydomain.com

Persistence

Database data is stored in a Docker volume named mariadb_data. It persists across container restarts and is only deleted when you run docker compose down -v.

To back up the database:

docker compose exec mariadb mysqldump -u root -p$MARIADB_ROOT_PASSWORD $MARIADB_DATABASE > backup.sql

Security Considerations

  • Change all default secrets. Never use placeholder values in production.
  • Keep SECURITY_JWT_SECRET and APP_SECURITY_MASTER_KEY private — if compromised, an attacker could forge tokens or decrypt stored vendor credentials.
  • Use environment-specific .env files (gitignored) instead of hardcoding values in docker-compose.yml.
  • The backend runs on port 8080; the frontend on port 5173. Do not expose the backend port directly to the internet — use a reverse proxy (e.g., nginx, Caddy) if needed.
  • The frontend is a static SPA served by nginx inside the container. It does not store secrets.

Generating Secure Values

Secret Command
JWT secret (64 hex chars) openssl rand -hex 32
Master key (32 base64 chars) openssl rand -base64 32
Database password openssl rand -base64 16

Clone this wiki locally