Documentation

Configuration (Server)

Server reads settings from environment variables (or a corexar.conf file). Home needs none. This is the short list; the complete, generated one lives in docs/CONFIGURATION.md in the platform repository.

Variable	Default	What it does
`ADMIN_EMAIL` Application	`—`	The account with this e-mail becomes the administrator when it registers.
`SERVER_PORT` Application	`8080`	HTTP port of the API.
`JWT_SECRET` Sign-in	`—`	Signs session tokens. Replace the default on a server.
`AUTH_TOKEN_TTL_HOURS` Sign-in	`720`	How long a sign-in lasts, in hours.
`COREXAR_AUTH_REQUIRE_EMAIL_VERIFICATION` Sign-in	`false`	New accounts must confirm their e-mail before signing in (needs the mail settings).
`ENCRYPTION_MODE` Encryption	`server_envelope`	How encrypted collections are protected.
`ENCRYPTION_PEPPER` Encryption	`—`	Server-side addition to encryption keys. Never change it after data is encrypted.
`ENCRYPTED_SEARCH_STRATEGY` Encryption	`isolated_encrypted`	How search works inside encrypted collections.
`MEDIA_DELIVERY_MODE` Files	`server`	server: files pass through the API; presigned: the browser goes to S3 directly.
`MEDIA_S3_ENDPOINT` Files	`http://localhost:9010`	Address of the S3-compatible storage (MinIO, AWS S3, Cloudflare R2).
`MEDIA_S3_PUBLIC_ENDPOINT` Files	`—`	The storage address as the browser sees it. Required when you open Corexar from another device.
`PUBLIC_API_URL` Files	`—`	Public address of the API for file links. Empty: relative links.
`DB_URL` Services	`jdbc:postgresql://localhost:5433/collection_tracker`	PostgreSQL connection address.
`ELASTICSEARCH_URL` Services	`http://localhost:9200`	Elasticsearch address, used for search.
`KAFKA_BOOTSTRAP_SERVERS` Services	`localhost:9094`	Kafka brokers, used to keep the search index in step.
`REDIS_URL` Services	`—`	Optional Redis for state shared between several instances. Empty: in memory.
`COREXAR_CORS_ALLOWED_ORIGINS` Access	`—`	Websites allowed to call the API from a browser. Empty: none.
`COREXAR_API_KEYS_ENABLED` Access	`false`	Let users issue API keys for scripts. Off by default.
`COREXAR_INVITES_ENABLED` Access	`true`	Allow invitation links to workspaces.
`AUDIT_RETENTION_DAYS` Access	`365`	How long the activity log is kept (0: forever).
`PLATFORM_LICENSE_KEY` License	`—`	License key. Empty: Community edition. Checked with our server; works offline for 7 days.

A starting .env

.env

# Corexar Server — settings (.env next to docker-compose.yml)
# The full list of settings: docs/CONFIGURATION.md in the platform repository.

# ── Administration ─────────────────────────────────────────
# The account registered with this e-mail becomes the administrator.
ADMIN_EMAIL=admin@example.com
SERVER_PORT=8080

# ── Secrets: replace every value below with your own ───────
JWT_SECRET=change-me-to-a-long-random-string
DB_PASSWORD=change-me
MEDIA_HMAC_SECRET=change-me-to-a-random-string
# Mixed into the keys of encrypted collections. Do NOT change it afterwards:
# encrypted data would become unreadable.
ENCRYPTION_PEPPER=change-me-to-a-random-string-of-32-or-more-characters

# ── Files ──────────────────────────────────────────────────
# server: files are streamed through the API (access is checked on every request)
# presigned: the browser fetches files straight from S3/MinIO
MEDIA_DELIVERY_MODE=server
MEDIA_S3_ENDPOINT=http://minio:9000
# The address of MinIO as the BROWSER sees it (upload and download links are signed for it)
MEDIA_S3_PUBLIC_ENDPOINT=http://localhost:9010
MEDIA_S3_ACCESS_KEY=change-me
MEDIA_S3_SECRET_KEY=change-me-too
MEDIA_S3_BUCKET=collection-tracker-media

# ── License (optional) ─────────────────────────────────────
# Empty: the free Community edition. A Pro or Enterprise key unlocks the larger limits and
# encrypted collections; the key is checked with the license server and works offline for 7 days.
PLATFORM_LICENSE_KEY=