Environment variables

Where the settings live

Create each app's file from the .env.example beside it, which documents every variable: cp .env.example .env. The examples work as they are for a local run, and the Docker Compose start needs no file at all.

Where the settings live

One file, .env in the website's folder. The NEXT_PUBLIC_* values in it are read when the website is built and are public, so they never hold a secret. REVALIDATE_SECRET and API_INTERNAL_URL are read by the website's own server at run time and never reach the browser. Create it from .env.example, which points at an API on http://localhost:8000: cp .env.example .env. With Docker, pass the NEXT_PUBLIC_* values as --build-arg and the other two with -e.

Where the settings live

One file, .env in the dashboard's folder, read when the dashboard is built. Every value in it is public, so it never holds a secret: provider keys live in the API's .env. Create it from .env.example, which points at an API on http://localhost:8000: cp .env.example .env. With Docker, pass the same values as --build-arg.

Where the settings live

One file, .env in the API's folder, read by the API with yarn dev, and by a container when you add --env-file .env -e NODE_ENV=production to its docker run. It holds secrets: never commit it. Create it from .env.example, which documents every variable and works as it is for a local run: cp .env.example .env.

The Docker image sets its own defaults, so docker run works without a file: SQLite at /data/database.sqlite, uploads in /data/uploads, CSV exports in /data/exports, CORS_ORIGIN for the two local frontends, FRONTEND_URL=http://localhost:3031, STOREFRONT_URL=http://localhost:3030, PUBLIC_API_URL=http://localhost:8000, PUBLIC_MEDIA_URL=http://localhost:8000/media and SEED_DEMO_DATA=false. Override any of them with -e.

API essentials

The API checks JWT_SECRET and, in production, CORS_ORIGIN before it starts. If one is missing or unusable, it stops with one line saying what to fix.

Generate your own JWT_SECRET with:

node -e "console.log(require('crypto').randomBytes(48).toString('hex'))"

Every optional feature below is off while its lines in .env.example stay commented out.

Your own workspace and Owner

Read only on a database with no staff account and no workspace (the tables from yarn db:sync, or a Docker volume started with SEED_DEMO_DATA=false). The API's first start then creates the roles, the site settings, the event categories, one workspace and its Owner from them, once. As soon as any staff account exists they are ignored.

OWNER_EMAIL=you@your-domain.com
OWNER_PASSWORD=a-long-password-of-your-own
OWNER_NAME=Your Name
WORKSPACE_NAME=Your organisation

In the Full Stack's Docker Compose they can go in the .env beside docker-compose.yml, with SEED_DEMO_DATA=false: Compose passes that file to the API first and then back-end/.env, whose value wins where both set one. Without the variables, the API starts and says which ones to set.

• Going live with your own workspace

Payments

Checkout sends the buyer to Stripe's or PayPal's own page, so card details are never typed on your site. Each provider is offered once its keys are set. Use test keys first: they move no money.

STRIPE_SECRET_KEY=sk_test_your_key
STRIPE_WEBHOOK_SECRET=whsec_your_secret
PAYPAL_CLIENT_ID=your-client-id
PAYPAL_CLIENT_SECRET=your-client-secret
PAYPAL_WEBHOOK_ID=your-webhook-id
PAYPAL_ENV=sandbox

Free tickets need none of this: an order with nothing to pay is confirmed at checkout, with or without keys. Ticketory charges no tax by itself, so set up tax for your country before taking real payments.

• Orders, payments and refunds

Email

Tickets, sign-up codes, password resets, refund news and event reminders are sent through Resend once both variables are set. Until then every email is written to the API's log instead, which is where a sign-up code is read on a fresh install (with Docker: docker compose logs api).

RESEND_API_KEY=re_your_key
MAIL_FROM=Ticketory <tickets@your-domain.com>
EVENT_REMINDER_HOURS=24

EVENT_REMINDER_HOURS is how long before an event its reminder goes out: 24 when unset, at most 168 (a week), and 0 turns reminders off. Every email about an order (tickets, refunds, the cancellation notice and the reminder) is written in the language the order was placed in.

• Tickets, passes and emails

Use MySQL instead of SQLite

Create an empty database, then set the driver and the connection in the API's .env:

DB_TYPE=mysql
DB_HOST=localhost
DB_PORT=3306
DB_USERNAME=root
DB_PASSWORD=
DB_DATABASE=ticketory

Then run yarn seed for the sample data, or yarn db:sync for the tables with no data. The running API only creates and updates the tables itself when NODE_ENV=development, so with NODE_ENV=production one of those commands runs before the first start (yarn seed:prod or yarn db:sync:prod after yarn build). The Docker image does this by itself on SQLite only: on MySQL, run it once yourself.

Pictures and uploads

The API serves the seeded pictures itself, from public/media/ticketory (the category symbols, the brand marks, the assistant's emblem and the studio's sample photos), at /media/ticketory/…. Uploads from the dashboard (the empty venue photos for the studio, the photos attached to an assistant question) and the studio's finished concepts are stored on the API's disk under MEDIA_UPLOAD_DIR and served at /media/uploads/…, unless a bucket is set.

PUBLIC_MEDIA_URL=http://localhost:8000/media
MEDIA_UPLOAD_DIR=./public/media/uploads

PUBLIC_MEDIA_URL is the address /media is reached at from a browser. Every picture address is built from it, and the API moves the stored ones onto it when it starts, so moving the API keeps every picture. On a server, point MEDIA_UPLOAD_DIR at persistent storage; with Docker it is in the data volume.

To send uploads to Cloudflare R2, or any S3-compatible bucket, set all five variables. Give both frontends the bucket's public host through NEXT_PUBLIC_MEDIA_HOSTNAME (with Docker Compose, MEDIA_HOSTNAME) so Next.js resizes those pictures.

R2_ACCESS_KEY_ID=your-r2-access-key-id
R2_SECRET_ACCESS_KEY=your-r2-secret-access-key
R2_ENDPOINT=https://your-account-id.r2.cloudflarestorage.com
R2_BUCKET_NAME=your-bucket-name
R2_PUBLIC_URL=https://your-public-url.r2.dev

Pictures are re-encoded as JPEG on upload, at most 1920 pixels wide. Videos are accepted as MP4, WebM, MOV or M4V, up to 150 MB.

Website and organiser dashboard

Every NEXT_PUBLIC_* value is compiled into the JavaScript the browser loads, and anyone who opens the page can read it. Never put a secret in one, and rebuild (or restart yarn dev) after changing one.

The website's marketing tags are NEXT_PUBLIC_* values too: Google Tag Manager (NEXT_PUBLIC_GTM_ID), GA4 (NEXT_PUBLIC_GA4_MEASUREMENT_ID), Meta, TikTok, Snapchat and Pinterest, each switched on by one id; a blank id loads no script. NEXT_PUBLIC_ANALYTICS_CURRENCY (USD by default) is the currency sent with ticket prices, and NEXT_PUBLIC_ANALYTICS_DEBUG=true logs every tracked event to the browser console.

• The website

Docker Compose options

Nothing has to be set for a local run. To change something, put it in a .env file beside docker-compose.yml and run docker compose up --build again: the frontends compile these values in.

Change a port when another program already uses it, such as ADMIN_PORT=3041. The API's CORS_ORIGIN, FRONTEND_URL, STOREFRONT_URL, PUBLIC_API_URL and PUBLIC_MEDIA_URL, and the frontends' API, website and dashboard addresses, are all built from the ports and the three addresses, so they follow by themselves.

• A port is already in use

The API container reads this .env first and then back-end/.env when it exists, whose value wins where both set one, so the optional keys are set in one place for both yarn dev and Docker. The compose file wins for the values that differ inside a container: the database path, the upload and export folders, the port, NODE_ENV=production and the addresses above. The database, the uploads and the CSV exports live in the ticketory-data volume.

AI features

The MCP server

Demo mode