Configuration and the .env file
Asif Mughal
3 min read
Basehim keeps install-specific settings and secrets in a .env file at the site root. The installer writes it for you. Everything else (site title, timezone, permalinks, SEO, mail) is set in the admin under Settings and stored in the database. This page lists every key Basehim reads from .env.
How .env works
- Plain
KEY=valuelines. Quote values that contain spaces:APP_NAME="My Site". trueandfalseare read as booleans..envis denied to browsers by the bundled.htaccess. Never commit it, and never put it in a public folder on nginx (see Installation).- Changes take effect on the next request. There is nothing to restart.
.env.example in the repository is a template with the common keys.
Application
| Key | Default | What it does |
|---|---|---|
APP_NAME | Basehim | Informational; the site title is set in Settings → General |
APP_ENV | production | Informational; use production on live sites |
APP_DEBUG | false | true shows errors with file and line. Development only: it can reveal paths and SQL |
APP_URL | http://localhost | The site's canonical address, e.g. https://example.com. Used for absolute links, mail, the JWT issuer and trusted origins |
APP_KEY | (generated) | Secret for signing internal values. At least 16 characters |
APP_TIMEZONE | UTC | Fallback only. The site timezone is set in Settings → General |
APP_LOCALE | en | Informational |
INSTALLED | true after install | Locks the installer. Don't remove it from a live site |
Database
| Key | Default | What it does |
|---|---|---|
DB_HOST | 127.0.0.1 | Database server |
DB_PORT | 3306 | Port |
DB_SOCKET | (none) | Unix socket, instead of host and port |
DB_DATABASE | basehim | Database name |
DB_USERNAME, DB_PASSWORD | root, empty | Credentials |
DB_CHARSET, DB_COLLATION | utf8mb4, utf8mb4_unicode_ci | Leave as they are |
DB_PREFIX | empty | Prefix for every table, including app tables, so several sites can share one database. Set before installing; never change it later |
Security and tokens
| Key | Default | What it does |
|---|---|---|
JWT_SECRET | (generated) | Signs API access tokens (JWT, HS256). Use 32+ random bytes. Changing it signs everyone out of the API |
CORS_ALLOWED_ORIGINS | empty | Comma-separated origins (e.g. https://app.example.com) allowed to call the API from a browser. They are also accepted as same-site by the AJAX gateway |
TRUSTED_PROXIES | empty | Comma-separated IPs or CIDR ranges whose X-Forwarded-For is believed. Set this behind Cloudflare or a load balancer; otherwise the AJAX gateway counts every visitor as the proxy's address for its rate limits |
HTTP_TLS_VERIFY | true | false turns off certificate checks for outgoing requests. A last resort for broken hosts, and only for a short time |
Generate secrets with PHP:
php -r "echo 'APP_KEY=' . bin2hex(random_bytes(16)) . PHP_EOL;"
php -r "echo 'JWT_SECRET=' . bin2hex(random_bytes(32)) . PHP_EOL;"Note: If
.envever leaks, rotate the database password,APP_KEYandJWT_SECRETtogether, and revoke API keys under API → Keys.
AJAX gateway
These tune POST /ajax, which the admin and apps use (see AJAX actions).
| Key | Default | What it does |
|---|---|---|
AJAX_MAX_BODY | 65536 | Largest request body in bytes. One action can set its own, up to 1 MB |
AJAX_RATE_LIMIT | 300 | Requests per minute per client address, across all actions |
AJAX_RATE_LIMIT_FAIL | open | If the rate-limit store is down: open lets requests through, closed answers 503 |
Updates
| Key | Default | What it does |
|---|---|---|
UPDATE_HUB_URL | https://www.cloudhim.com | Where the site checks for core, app and theme updates. Only change it if you run your own hub |
Site defaults
SITE_TITLE, SITE_TAGLINE and ADMIN_EMAIL seed the first values at install time. After that, the values in Settings are what count.
Reading configuration in code
Apps read config files with $this->config('app.url') (dot notation over the files in config/). They should not read .env directly. The static scanner flags direct .env reads in apps, and the site owner sees the warning on the Apps screen.
$siteUrl = $this->config('app.url'); // from APP_URL
$debug = (bool) $this->config('app.debug'); // from APP_DEBUGSite settings (the ones edited under Settings) come from the settings service. A theme uses bh_setting($group, $key, $default), for example bh_setting('general', 'timezone', 'UTC').
Leave a comment