Environment Configuration
All sensitive values must be set before deploying. Do not commit .env files to version control.
PostgreSQL — infra/db/.env.postgres
Copy from: infra/db/.env.postgres.example
| Variable | Example | Description |
|---|---|---|
POSTGRES_USER | makerlab | Database superuser name |
POSTGRES_PASSWORD | (strong password) | Database superuser password |
POSTGRES_DB | makerlab | Database name |
Snipe-IT — infra/snipeit/.env.snipeit
Copy from: infra/snipeit/.env.snipeit.example
| Variable | Example | Description |
|---|---|---|
APP_URL | https://deti-makerlab.ua.pt/snipe-it | Snipe-IT public URL (must match SNIPEIT_PUBLIC_URL) |
DB_CONNECTION | mysql | Database driver (always mysql for MariaDB) |
MYSQL_DATABASE | snipeit | MariaDB database name |
MYSQL_USER | snipeit | MariaDB user |
MYSQL_PASSWORD | (strong password) | MariaDB user password |
MYSQL_ROOT_PASSWORD | (strong password) | MariaDB root password |
APP_KEY | (generated) | Laravel application key (auto-generated on first start) |
MAIL_ENV | (optional) | Mail server settings for Snipe-IT emails |
The APP_KEY is generated automatically by Snipe-IT on first start. Do not set it manually unless restoring from a backup.
API — apps/api/.env
Copy from: apps/api/.env.example
Database
| Variable | Example | Description |
|---|---|---|
DATABASE_URL | postgresql+psycopg://makerlab_app:password@postgres:5432/makerlab | PostgreSQL connection URL |
POSTGRES_USER | makerlab | PostgreSQL user (used for Docker healthcheck) |
POSTGRES_PASSWORD | (strong password) | PostgreSQL password |
POSTGRES_SERVER | postgres | PostgreSQL Docker service name |
POSTGRES_PORT | 5432 | PostgreSQL port |
POSTGRES_DB | makerlab | Database name |
Snipe-IT integration
| Variable | Example | Description |
|---|---|---|
SNIPEIT_BASE_URL | http://snipeit | Internal Docker URL for API calls |
SNIPEIT_API_TOKEN | (generated by bootstrap script) | Snipe-IT personal access token |
SNIPEIT_RESERVED_STATUS_ID | 4 | Numeric ID of the "Reserved" status label in Snipe-IT |
SNIPEIT_PUBLIC_URL | https://deti-makerlab.ua.pt/snipe-it | Browser-facing Snipe-IT URL |
Public URLs
| Variable | Example | Description |
|---|---|---|
FRONTEND_URL | https://deti-makerlab.ua.pt | Public MakerLab frontend URL |
SSO (University of Aveiro OAuth1)
| Variable | Description |
|---|---|
SSO_CALLBACK_URL | OAuth1 callback URL registered with identity.ua.pt. Must match exactly. Does not include path prefix. Example: https://deti-makerlab.ua.pt/auth/auth |
DML_AUTH_KEY | University OAuth1 client key |
DML_AUTH_SECRET | University OAuth1 client secret |
SSO_CALLBACK_URL must match exactly what is registered with the University identity provider. It is always at /auth/auth regardless of any base path prefix.
JWT
| Variable | Example | Description |
|---|---|---|
JWT_SECRET_KEY | (strong random string) | JWT signing secret. Use a cryptographically random value. |
JWT_ALGORITHM | HS256 | JWT algorithm. Do not change. |
JWT_EXPIRE_MINUTES | 60 | Token expiry in minutes |
Access control
| Variable | Example | Description |
|---|---|---|
LAB_TECHNICIANS | tech@ua.pt,another@ua.pt | Comma-separated list of technician university emails |
Application mode
| Variable | Example | Description |
|---|---|---|
APP_ENV | production | Application environment |
APP_DEBUG | false | Debug mode. Always false in production. |
Deployment URL parameters — docker-compose.yml
These are set in the x-deployment anchor block and are merged into containers at runtime (and build time for web):
| Variable | Description |
|---|---|
MAKERLAB_DOMAIN | Public domain (no protocol, no trailing slash) |
NEXT_PUBLIC_BASE_PATH | Base path prefix (e.g., /new or "") |
FRONTEND_URL | Full public frontend URL |
NEXT_PUBLIC_API_URL | Browser-facing API path prefix |
API_PUBLIC_URL | Full public API URL |
SNIPEIT_PATH | Snipe-IT path prefix |
NEXT_PUBLIC_SNIPEIT_URL | Full public Snipe-IT URL |
APP_URL | Snipe-IT self-URL (same as SNIPEIT_PUBLIC_URL) |
SNIPEIT_PUBLIC_URL | Full public Snipe-IT URL for backend |
TLS certificates
Place TLS certificate and key files at:
infra/nginx/certs/selfsigned.crt
infra/nginx/certs/selfsigned.key
For production, replace these with valid certificates from a trusted Certificate Authority (e.g., Let's Encrypt).
To generate a self-signed certificate for testing:
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
-keyout infra/nginx/certs/selfsigned.key \
-out infra/nginx/certs/selfsigned.crt \
-subj "/CN=deti-makerlab.ua.pt"
Self-signed certificates will show a browser warning. Never use self-signed certificates in production.