Configuration.
Three places, one rule.
Process settings live in server/.env, everything an operator changes lives in the console, and the app takes its server address and Firebase values at build time. Every switch that earns or spends money ships off.
01Where settings live
| Place | What goes there | Changed by |
|---|---|---|
server/.env | Keys and process options the server needs before the console exists | You, on the server, then restart |
Console (/admin) | Brand, prices, payments, ads, AI, push, CDN, community and every other product setting | Owner and managers, live, with audit log and history |
App build (--dart-define) | Server address and Firebase values | You, when you build the app |
02Server environment variables
From server/.env.example and the server code. Copy the template to .env; never commit .env.
| Variable | Purpose | Where to get the value |
|---|---|---|
PORT | Port the server listens on. Default 8080. | Your choice |
ADMIN_SECRET_KEY set it | Encrypts the console's stored secrets. Back it up. | openssl rand -hex 32 |
ADMIN_SETUP_TOKEN | Optional secret (24+ characters) for creating the first owner at /admin. Empty = a one-time setup code is printed to the log. Remove it once the owner exists. | openssl rand -hex 24 |
MEDIA_SIGNING_KEY set it | Signs playback addresses. Changing it invalidates links already handed out. | openssl rand -hex 32 |
DATA_DIR | Where the databases, uploads and HLS files live. Default server/data. | A path on a persistent disk |
TRUST_PROXY_HOPS | Number of reverse proxies in front of the server (nginx or Caddy = 1; a CDN in front of that = 2). Default 0. | Your setup |
CORS_ORIGINS | Comma-separated browser origins allowed to call the API from another domain, for example https://watch.example.com. | Your domains |
COUNTRY_HEADER | Header your CDN or proxy fills with the viewer's country (Cloudflare: cf-ipcountry). Needed for Access → Blocked countries. Only set it when every request reaches the server through that proxy, otherwise a client could send the header itself. | Your CDN's documentation |
ORIGIN_PULL_SECRET | BunnyCDN token mode only: the secret Bunny sends as the x-origin-secret header when it pulls from /media/origin. | openssl rand -hex 32, then the same value in a Bunny edge rule (how) |
FFMPEG_PATH, FFPROBE_PATH | Paths to ffmpeg and ffprobe if they are not on the PATH. | which ffmpeg |
MAGICK_PATH | Path to ImageMagick 7 for the sample generator only. | which magick |
DEMO_MODE | Never in production. true simulates ads and store purchases for a public demo. No money moves. | Leave false |
ADMIN_DEMO_PASSWORD | Public read-only demo console only: password of the published demo account. Optional ADMIN_DEMO_EMAIL and ADMIN_DEMO_NOTICE override the demo e-mail and banner. | Leave empty on a real service |
WEB_DIR, STUDIO_DIR, PAGES_DIR | Advanced: other folders for the built web player, the studio and the console's product pages. Defaults point at the package folders. | Normally unset |
03What this costs you
The environment variables cost nothing. The services the console connects (hosting, CDN, Stripe, PayPal, AdMob, Firebase, AI providers) are billed by each provider to your own account; see Costs not included and each provider's pricing page.
04Console settings
Everything else is set in the console at /admin. Each section and page is described on Operator console. Secrets (API keys, service accounts) are write-only: you can replace or test them, never read them back.
05Pinning a console field from the environment
Any console field can be fixed from .env. A set variable locks the field (read-only in the console). The name is RL_ + the field key with dots turned into underscores, words split and upper case:
| Console field key | Environment variable |
|---|---|
payments.stripeEnabled | RL_PAYMENTS_STRIPE_ENABLED=true |
brand.name | RL_BRAND_NAME=My Brand |
economy.signupBonus | RL_ECONOMY_SIGNUP_BONUS=100 |
missions.enabled | RL_MISSIONS_ENABLED=true |
Nothing is pinned unless you set a variable. server/demo.env.example shows a full example for a public demo host.
06App build values
| Define | Purpose |
|---|---|
API_BASE_URL | Your server's https address, for example https://api.example.com. Without it the app talks to a server on your computer. |
FIREBASE_API_KEY, FIREBASE_APP_ID, FIREBASE_SENDER_ID, FIREBASE_PROJECT_ID, FIREBASE_IOS_BUNDLE_ID | Push notifications. Push stays off unless the first four are set (iOS also uses the bundle id). |
Details on App setup.