# Configuration

Every environment variable read by the server crates. Defaults come from `pelty-core/src/config.rs`. Variables read elsewhere show the file that reads them.

| Variable | Default | Description | Read in |
|---|---|---|---|
| `DATABASE_URL` |  | PostgreSQL connection URL (`postgres://…`). Required. | `crates/pelty-core/src/config.rs` |
| `PELTY_ADDONS_DIR` |  | Default `data/addons`; an existing `./addons` (the pre-restructure default) keeps working so older installs are not orphaned. | `crates/pelty-api/src/addons.rs` |
| `PELTY_ADDONS_DIST` | `"extensions/addons/dist"` | Directory with the bundled first-party addon zips (default `extensions/addons/dist`). | `crates/pelty-api/src/wasm_addons.rs` |
| `PELTY_ADDON_DATA_DIR` | `"data/addons"` | Root of per-addon data directories (default `data/addons`), one `<root>/<id>` each. | `crates/pelty-wasm/src/runtime.rs` |
| `PELTY_ADDON_MAX_FUEL` |  | Admin caps for addon limits: memory MiB, timeout seconds, fuel (defaults: the built-in maxima). | `crates/pelty-wasm/src/lib.rs` |
| `PELTY_ADDON_MAX_MEMORY_MIB` |  | Admin caps for addon limits: memory MiB, timeout seconds, fuel (defaults: the built-in maxima). | `crates/pelty-wasm/src/lib.rs` |
| `PELTY_ADDON_MAX_TIMEOUT_SECS` |  | Admin caps for addon limits: memory MiB, timeout seconds, fuel (defaults: the built-in maxima). | `crates/pelty-wasm/src/lib.rs` |
| `PELTY_ADMIN_PASSWORD` |  | Password for `admin create` (otherwise the first line of stdin). | `crates/pelty-server/src/main.rs` |
| `PELTY_AUTH_RATE_PER_MINUTE` | `10` | Max auth attempts per IP per minute. | `crates/pelty-core/src/config.rs` |
| `PELTY_BACKUP_DIR` | `"backups"` | Where database backups are written (default `backups`). | `crates/pelty-api/src/backup.rs` |
| `PELTY_BIND` | `"0.0.0.0:8080"` | Listen address. | `crates/pelty-core/src/config.rs` |
| `PELTY_COOKIE_SECURE` | `true` | Set the `Secure` flag on cookies. Must be true behind HTTPS. | `crates/pelty-core/src/config.rs` |
| `PELTY_DB_MAX_CONNECTIONS` | `10` | Database pool size. | `crates/pelty-core/src/config.rs` |
| `PELTY_DEFAULT_LOCALE` | `"en"` | Language for visitors without a preference. | `crates/pelty-core/src/config.rs` |
| `PELTY_DOCKER` |  | `PELTY_DOCKER=1` marks a container: addon exec is disabled. | `crates/pelty-wasm/src/runtime.rs` |
| `PELTY_DOCS_DIR` | `"target/docs"` | Folder written by `make docs` (default `target/docs`). | `crates/pelty-api/src/dev_docs.rs` |
| `PELTY_DOCS_PUBLIC` |  | `true`/`1` makes `/docs` readable without signing in (default: staff only). | `crates/pelty-api/src/dev_docs.rs` |
| `PELTY_ENCRYPTION_KEY` |  | Base64 32-byte key for secrets at rest (TOTP). No default: 2FA enrolment is refused while unset. | `crates/pelty-core/src/config.rs` |
| `PELTY_FRONTEND_DIR` | `"frontend/dist"` | Built frontend served as the SPA. | `crates/pelty-core/src/config.rs` |
| `PELTY_LOCALES_DIR` | `"locales"` | Translation JSON files. | `crates/pelty-core/src/config.rs` |
| `PELTY_LOG_JSON` | `false` | Log as JSON lines instead of text. | `crates/pelty-core/src/config.rs` |
| `PELTY_MAIL_FROM` | `"PeltyCMS <no-reply@localhost>".to_string` | From address for outgoing mail. | `crates/pelty-core/src/config.rs` |
| `PELTY_PG_DUMP` | `"pg_dump"` | `pg_dump` binary used for backups (default `pg_dump` on PATH). | `crates/pelty-api/src/backup.rs` |
| `PELTY_PLUGINS_DIR` | `"extensions/plugins"` | Webhook plugin manifests. | `crates/pelty-core/src/config.rs` |
| `PELTY_PROVISION_ALLOW_LINK_LOCAL` |  | `1`/`true` lets provisioning modules reach link-local addresses (off by default). | `crates/pelty-provisioning/src/http.rs` |
| `PELTY_PUBLIC_URL` | `"http://localhost:8080"` | Absolute base URL used in email links, e.g. `https://billing.example.com`. | `crates/pelty-core/src/config.rs` `crates/pelty-api/src/routes/billing.rs` |
| `PELTY_SESSION_ABSOLUTE_HOURS` | `24 * 30` | Sessions end after this many hours regardless of activity. | `crates/pelty-core/src/config.rs` |
| `PELTY_SESSION_IDLE_MINUTES` | `60 * 24` | Sign out after this many idle minutes. | `crates/pelty-core/src/config.rs` |
| `PELTY_SMTP_URL` |  | SMTP URL (`smtps://user:pass@host:465`). Unset: mail is logged, not sent. | `crates/pelty-core/src/config.rs` |
| `PELTY_THEMES_DIR` | `"extensions/themes"` | Theme folders (`theme.json`). | `crates/pelty-core/src/config.rs` |
| `PELTY_VIES_URL` |  | EU VIES VAT check API base URL (default: the public EU endpoint). | `crates/pelty-api/src/vies.rs` |
| `PELTY_WASM_CACHE_DIR` |  | Compiled-module cache directory (default `<tmp>/pelty-wasm-cache`). | `crates/pelty-wasm/src/runtime.rs` |