Environment variables

Where the settings live

Create each app's file from the .env.example beside it, which documents every variable: cp .env.example .env. The examples work as they are for a local run, and the Docker Compose start needs no file at all.

Where the settings live

One file, .env in the website's folder, read when the website is built. Every value in it is public, so it never holds a secret. Create it from .env.example, which points at an API on http://localhost:8000: cp .env.example .env. With Docker, pass the same values as --build-arg.

Where the settings live

One file, .env in the dashboard's folder, read when the dashboard is built. Every value in it is public, so it never holds a secret: provider keys live in the API's .env. Create it from .env.example, which points at an API on http://localhost:8000: cp .env.example .env. With Docker, pass the same values as --build-arg.

Where the settings live

One file, .env in the API's folder, read by the API with yarn dev, and by a container when you add --env-file .env -e NODE_ENV=production to its docker run. It holds secrets: never commit it. Create it from .env.example, which documents every variable and works as it is for a local run: cp .env.example .env.

The Docker image sets its own defaults, so docker run works without a file: SQLite at /data/database.sqlite, uploads in /data/uploads, CORS_ORIGIN for the two local frontends, FRONTEND_URL=http://localhost:3031, PUBLIC_MEDIA_URL=http://localhost:8000/media and SEED_DEMO_DATA=false. Override any of them with -e.

API essentials

The API checks JWT_SECRET and, in production, CORS_ORIGIN before it starts. If one is missing or unusable, it stops with one line saying what to fix.

Generate your own JWT_SECRET with:

node -e "console.log(require('crypto').randomBytes(48).toString('hex'))"

Every optional feature below is off while its lines in .env.example stay commented out.

Use MySQL instead of SQLite

Create an empty database, then set the driver and the connection in the API's .env:

DB_TYPE=mysql
DB_HOST=localhost
DB_PORT=3306
DB_USERNAME=root
DB_PASSWORD=
DB_DATABASE=velra

Then run yarn seed for the demo agency, or yarn db:sync for the tables with no data. The running API only creates and updates the tables itself when NODE_ENV=development, so with NODE_ENV=production one of those commands runs before the first start (yarn seed:prod or yarn db:sync:prod after yarn build).

Photos and uploads

The API serves the seeded photos itself, from public/media/velra, at /media/velra/…. Uploads from the dashboard (property photos, room photos for the studio, staged previews, profile pictures) are stored on the API's disk under MEDIA_UPLOAD_DIR and served at /media/uploads/…, unless a bucket is set.

PUBLIC_MEDIA_URL=http://localhost:8000/media
MEDIA_UPLOAD_DIR=./public/media/uploads

PUBLIC_MEDIA_URL is the address /media is reached at from a browser. Every photo address is built from it, and the API moves the stored ones onto it when it starts, so moving the API keeps every photo. On a server, point MEDIA_UPLOAD_DIR at persistent storage; with Docker it is in the data volume.

To send uploads to Cloudflare R2, or any S3-compatible bucket, set all five variables. Give both frontends the bucket's public host through NEXT_PUBLIC_MEDIA_HOSTNAME (with Docker Compose, MEDIA_HOSTNAME) so Next.js resizes those photos.

R2_ACCESS_KEY_ID=your-r2-access-key-id
R2_SECRET_ACCESS_KEY=your-r2-secret-access-key
R2_ENDPOINT=https://your-account-id.r2.cloudflarestorage.com
R2_BUCKET_NAME=your-bucket-name
R2_PUBLIC_URL=https://your-public-url.r2.dev

Photos are re-encoded on upload, at most 1920 pixels wide, with a smaller copy for property cards. Videos are accepted as MP4, WebM, MOV or M4V, up to 150 MB.

Public website and agency dashboard

Every NEXT_PUBLIC_* value is compiled into the JavaScript the browser loads, and anyone who opens the page can read it. Never put a secret in these files, and rebuild after changing one.

The website's marketing tags are NEXT_PUBLIC_* values too: Google Tag Manager, GA4, Meta, TikTok, Snapchat and Pinterest, each switched on by one id.

• Analytics and tracking tags

Docker Compose options

Nothing has to be set for a local run. To change something, put it in a .env file beside docker-compose.yml and run docker compose up --build again: the frontends compile these values in.

Change a port when another program already uses it, such as ADMIN_PORT=3041. The API's CORS_ORIGIN, FRONTEND_URL and PUBLIC_MEDIA_URL, and the frontends' API and website addresses, are all built from the ports and the three addresses, so they follow by themselves.

The API container also reads back-end/.env when it exists, so the optional keys are set in one place for both yarn dev and Docker. The compose file wins for the values that differ inside a container: the database path, the upload folder, the port, NODE_ENV=production and the addresses above. The database and the uploads live in the velra-data volume.

AI features

The MCP server

Demo mode