dillard
fa89f4312d
When API_SECRET is set, Invoice Ninja requires the X-API-SECRET header on ALL API calls including /api/v1/login. The web UI (React SPA) never sends this header, so browser login silently fails with "Invalid secret" while the mobile app (which can be configured with the secret) continues to work. UPDATE_SECRET serves a different purpose (protecting the /update endpoint) and is kept. API_SECRET should remain unset for self-hosted YunoHost installs. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
69 lines
1.4 KiB
Bash
69 lines
1.4 KiB
Bash
APP_ENV=production
|
|
APP_DEBUG=false
|
|
APP_NAME="Invoice Ninja"
|
|
APP_URL=https://__DOMAIN__
|
|
APP_KEY=__APP_KEY__
|
|
APP_CIPHER=AES-256-CBC
|
|
APP_LOCALE=__LANGUAGE__
|
|
|
|
EXPANDED_LOGGING=false
|
|
|
|
DB_CONNECTION=mysql
|
|
DB_STRICT=false
|
|
DB_HOST=localhost
|
|
DB_DATABASE=__DB_NAME__
|
|
DB_USERNAME=__DB_USER__
|
|
DB_PASSWORD=__DB_PWD__
|
|
DB_PORT=3306
|
|
|
|
# https://invoiceninja.github.io/docs/self-host-installation/#final-setup-steps
|
|
QUEUE_CONNECTION=database
|
|
|
|
MAIL_MAILER=sendmail
|
|
MAIL_HOST=localhost
|
|
MAIL_PORT=25
|
|
MAIL_USERNAME=null
|
|
MAIL_PASSWORD=null
|
|
MAIL_ENCRYPTION=null
|
|
MAIL_FROM_ADDRESS='__DEFAULT_FROM_EMAIL_ADDRESS__'
|
|
MAIL_FROM_NAME='__DEFAULT_FROM_EMAIL_NAME__'
|
|
|
|
DEMO_MODE=false
|
|
|
|
BROADCAST_DRIVER=log
|
|
LOG_CHANNEL=stack
|
|
CACHE_DRIVER=file
|
|
SESSION_DRIVER=file
|
|
SESSION_LIFETIME=120
|
|
|
|
#REDIS_HOST=127.0.0.1
|
|
#REDIS_PASSWORD=null
|
|
#REDIS_PORT=6379
|
|
|
|
#POSTMARK_API_TOKEN=
|
|
REQUIRE_HTTPS=false
|
|
|
|
GOOGLE_MAPS_API_KEY=
|
|
ERROR_EMAIL=
|
|
TRUSTED_PROXIES=*
|
|
|
|
NINJA_ENVIRONMENT=selfhost
|
|
|
|
#options - snappdf / phantom / hosted_ninja
|
|
PDF_GENERATOR=snappdf
|
|
SNAPPDF_CHROMIUM_PATH=/usr/bin/chromium
|
|
|
|
PHANTOMJS_KEY='__PHANTOMJS_KEY__'
|
|
PHANTOMJS_SECRET=__APP_KEY__
|
|
|
|
UPDATE_SECRET=__API_SECRET__
|
|
# API_SECRET is intentionally not set: when set, it requires the X-API-SECRET header
|
|
# on ALL API calls including the web UI login (React SPA), which breaks browser login.
|
|
|
|
PRECONFIGURED_INSTALL=true
|
|
|
|
NORDIGEN_SECRET_ID=
|
|
NORDIGEN_SECRET_KEY=
|
|
|
|
OPENEXCHANGE_APP_ID=
|