RenewCMS/docs/configuration.md

Configuration

RenewCMS reads its configuration from environment variables. On startup it also loads a .env file from the working directory (or its parent) if one exists. Real environment variables take precedence over .env.

Copy .env.example to .env to get started. When a required variable is missing, the server refuses to start and names the variable.

Variables

Required

Name	Description	Example
PUBLIC_URL	Public base URL of the site, including scheme and no trailing slash. Used for links in emails and in the startup log.	https://cms.example.com
JWT_SECRET	Secret used to sign the auth JWT. Use a long random value; changing it logs everyone out.	openssl rand -hex 32
SMTP_LOGIN	SMTP username used to authenticate with the server. Some providers (e.g. Brevo) issue a login distinct from the sender address.	noreply@example.com
SMTP_SENDER	Sender address used in the From header. Must be an address/domain the SMTP provider allows that login to send as.	noreply@example.com
SMTP_PASSWORD	SMTP password.
SMTP_HOST	SMTP server host.	smtp.example.com
SMTP_PORT	SMTP server port.	465

Optional

Name	Default	Description
ENVIRONMENT	production	production or development. In production the auth cookie is Secure, so it is only sent over HTTPS. development turns on HTTP request logging.
PORT	8080	Port the HTTP server listens on (all interfaces).
DB_FILE	./data/renewcms.db	Path to the SQLite database file. Missing parent directories are created. The schema is migrated automatically at startup.
UPLOAD_DIR	./data/uploads	Directory where uploaded images are stored.
CORS_ALLOWED_ORIGINS	(empty)	Semicolon-separated list of origins allowed to call the API. When empty, no CORS headers are sent. That is the right setting whenever the SPA is served by RenewCMS itself (production) or through the Vite proxy (development).
AUTH_RATE_LIMIT_MAX_ATTEMPTS	5	Maximum number of requests a single client IP may send to POST /v1/auth/login or POST /v1/auth/password-reset within the window, tracked independently per route.
AUTH_RATE_LIMIT_WINDOW_SECONDS	60	Length, in seconds, of the fixed rate-limit window for the two routes above.
TRUSTED_PROXIES	(empty)	Semicolon-separated list of exact IP addresses (no CIDR) of reverse proxies allowed to supply the client IP via X-Real-IP for POST /v1/auth/login and POST /v1/auth/password-reset rate limiting. When a request's connection address is not in this list, any X-Real-IP or X-Forwarded-For header it sends is ignored and the connection address is used instead. See deployment.md.

Relative paths are resolved against the process's working directory. In production, use absolute paths (see deployment.md).

Adding a variable

1. Read it in the code where it is needed (infrastructure or api/, never internal/domain).
2. Register it in cmd/server/main.go: add it to requiredEnvVars if it is required, or to envDefaults if it has a default.
3. Add it to .env.example and to the tables above.

Never hardcode a secret, and never commit .env.