.env file or export them directly.
Environment Variables
| Variable | Description | Default |
|---|---|---|
PORT | Server listen port | 8080 |
HOSTNAME | Public base URL (used for OAuth redirect) | http://localhost:$PORT |
DATABASE_URL | Database connection string | file:stashy.db |
STORAGE_BACKEND | memory, local, gcs, or s3 | memory |
LOCAL_STORAGE_DIR | Directory for local file storage | ./storage |
GCS_BUCKET | GCS bucket name (required when backend is gcs) | — |
S3_BUCKET | S3 bucket name (required when backend is s3) | — |
SESSION_SECRET | HMAC key for signing session cookies | required |
GOOGLE_CLIENT_ID | Google OAuth 2.0 client ID | required |
GOOGLE_CLIENT_SECRET | Google OAuth 2.0 client secret | required |
ALLOWED_DOMAINS | Comma-separated list of allowed email domains | all allowed |
Example .env
HOSTNAME=https://stashy.example.com
SESSION_SECRET=change-me-to-a-random-string
GOOGLE_CLIENT_ID=123456789.apps.googleusercontent.com
GOOGLE_CLIENT_SECRET=GOCSPX-xxxxx
STORAGE_BACKEND=local
LOCAL_STORAGE_DIR=/var/lib/stashy/storage
DATABASE_URL=file:/var/lib/stashy/stashy.db
ALLOWED_DOMAINS=example.com,mycompany.org
Always set
SESSION_SECRET to a strong random value in production. Never use the default.