Configuration

Everything is read from environment variables (.env locally, never committed). .env.example lists every variable. Restart npm run dev after changing .env. Quote values that contain spaces or < >.

Required

Variable	What it is
DJANGO_SECRET_KEY	long random string
FIELD_ENCRYPTION_KEYS	Fernet key(s), comma-separated, newest first. Encrypts two-factor and webhook secrets. Keep a copy outside the server: without it those secrets can't be read
MYSQL_*, REDIS_URL	database and cache; the Docker defaults work locally

Optional services

Each stays off while its keys are empty.

Variable	Turns on
EMAIL_BACKEND, RESEND_API_KEY, DEFAULT_FROM_EMAIL	real email through Resend
RECAPTCHA_V3_SITE_KEY, RECAPTCHA_V3_SECRET_KEY, RECAPTCHA_V2_SITE_KEY, RECAPTCHA_V2_SECRET_KEY	the bot check on sign-up and password reset (the honeypot always runs)
GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET	"Continue with Google"
MICROSOFT_CLIENT_ID, MICROSOFT_CLIENT_SECRET	"Continue with Microsoft"
PLAN_PRO_PRICE	the Pro price on /pricing/ (default 19)

Resend (email)

1. Add your domain at resend.com/domains and create its DNS records (SPF, DKIM).
2. Create an API key.
3. Set:

EMAIL_BACKEND=apps.notifications.resend.ResendEmailBackend
RESEND_API_KEY=re_...
DEFAULT_FROM_EMAIL="HolidayOps <support@your-domain>"

Google reCAPTCHA

At https://www.google.com/recaptcha/admin create two keys: one "Score based (v3)" and one "Challenge (v2), I'm not a robot checkbox". Add localhost and your live domain to both. v3 is invisible; the v2 checkbox only appears when v3 isn't sure the visitor is a person.

To try the checkbox locally, use Google's test keys from the reCAPTCHA FAQ. Never use them in production.

Sign in with Google

In Google Cloud Console, create an OAuth client of type "Web application" and add every address the app runs on under Authorized redirect URIs, exactly, with the trailing slash:

http://localhost:5173/sso/google/callback/
https://<your-domain>/sso/google/callback/

The address is APP_URL + /sso/google/callback/. While the consent screen is in "Testing", add yourself under Test users.

Production only

DJANGO_ALLOWED_HOSTS, DJANGO_CSRF_TRUSTED_ORIGINS, APP_URL, MYSQL_SSL_MODE, NUM_PROXIES and more: see Self Hosting.