The kernel includes a configuration service and shared configuration contracts. Feature packages may read their own settings through that service or through environment variables. The accepted keys are package-specific; do not assume every environment variable is automatically loaded into ConfigService without verifying your application's configuration provider.
Environment variables#
Use environment variables for deployment-specific values such as database URLs, mail credentials, and file storage paths. Keep secrets out of source control and do not expose server environment variables through public Next.js environment prefixes.
Database configuration#
The database provider checks an explicitly passed databaseUrl, the kernel ConfigService value DATABASE_URL, process.env.DATABASE_URL, and process.env.DATABASE_FILE. If none is set, it defaults to dev.sqlite. Production deployments should configure a persistent database intentionally.
PostgreSQL TLS behavior depends on the database URL, production mode, and the optional DATABASE_SSL_REJECT_UNAUTHORIZED and DATABASE_SSL_CA settings. Never disable certificate validation simply to make a connection succeed; configure the correct CA and hostname instead.
Authentication configuration#
The authentication provider reads AUTH_BCRYPT_ROUNDS and AUTH_PASSWORD_MIN_LENGTH from ConfigService when it is available. Use environment-specific values and test the performance/security trade-off of your password hashing configuration.
Mail configuration#
The mail package documents MAIL_TRANSPORT, MAIL_SERVICE, MAIL_USERNAME, MAIL_PASSWORD, GOOGLE_SMTP_APP_USERNAME, GOOGLE_SMTP_APP_PASSWORD, and MAIL_FROM_ADDRESS. The actual transport selected depends on provider configuration and available credentials. Confirm the effective transport at startup and do not treat console output as successful delivery.
Storage configuration#
The local storage provider documents FILE_STORAGE_FOLDER, defaulting to public/uploads. Ensure the destination is writable and that public exposure is appropriate for the files being stored.
Validate at startup#
Fail fast when required production values are missing. Validate URLs, secret lengths, allowed origins, mail sender addresses, storage paths, and database driver availability before serving requests.
