Configuration reference (env vars, ports, URLs)

Prerequisites and authority

Use this reference with your installed release. Internal implementation routes and settings are not public integration contracts.

Configuration contract

Distinguish bootstrap environment from database-backed operator settings. The inspected app/core/settings.py intentionally contains a small bootstrap surface; payments, backup schedules and many operational choices are not assumed to be environment variables simply because older code used them that way.

The accompanying source-inventory tables list every field declared by that inspected Settings class, Compose interpolation inputs and settings-key constants. They are source candidates, with support/classification stated, not certification that every internal key is a customer-editable setting.

Public deployment inputs are API_PUBLIC_URL, ADMIN_PUBLIC_URL and CUSTOMER_PUBLIC_URL. Supply complete origins matching actual ingress. Internal container URLs such as http://api:8000/api/v1 are not public callback addresses.

Database credentials, JWT secret and router encryption key are sensitive. Preserve encryption keys across updates/recovery: replacing a key can make stored encrypted integration values unreadable. Never copy the installation .env into a public ticket.

Licensing bootstrap declares mode, verification URL/public key, interval, grace and timeout. Their source defaults are not automatically the packaged production defaults. Release manifest/installer configuration can supply different values.

Environment changes generally require recreating/restarting the affected process using the supported deployment route. UI/database settings may be read dynamically, but restart requirements must be verified per setting. Capture old values and change one related group at a time.

Customers control their installations and may inspect, troubleshoot and customize configuration or Docker independently, including beyond this manual. Support approval is not required to administer your own server. This reference distinguishes tested procedures from internal implementation details; it does not restrict ownership or self-service troubleshooting.

For database inspection, use the supplied read-only SQL account and the access procedure in MySQL Workbench support access. Read-only access does not permit data repair or schema changes. Do not publish database access to the Internet.

Before an advanced change, take and verify a backup, preserve the original configuration and record the modification. Changing credentials, encryption keys, schema, image versions or service wiring can break authentication, make stored secrets unreadable or interfere with future updates. Recheck health and the affected workflows afterward; request support if desired, not as a prerequisite for independent troubleshooting.

BRYANNET_INTERNAL_SERVICE_TOKEN and BRYANNET_UPDATE_VERIFICATION_MODE are internal inputs, not ordinary tuning controls. Update verification temporarily uses the latter to restrict normal application work. Do not leave it enabled during normal service or disable it during an active update.

The following table is a source-variable inventory, not a promise that changing every field is safe or that every source default is used by the installer. You may administer your installation independently; preserve a recovery point and verify affected workflows after advanced changes. Installer inputs and dashboard settings remain the clearest paths for routine configuration.

Advanced startup configuration

The installer supplies the effective startup values for your release. The examples below explain the settings; they are not replacement credentials or instructions to overwrite generated configuration. Back up configuration before changing it and keep secrets private.

Variable	Type	Source default	Classification
`APP_NAME`	`str`	`BryanNet API`	advanced bootstrap setting; preserve configuration before changing
`APP_VERSION`	`str`	`1.0.0`	advanced bootstrap setting; preserve configuration before changing
`DEBUG`	`bool`	`False`	advanced bootstrap setting; preserve configuration before changing
`ENVIRONMENT`	`str`	`development`	advanced bootstrap setting; preserve configuration before changing
`API_PREFIX`	`str`	`/api/v1`	advanced bootstrap setting; preserve configuration before changing
`API_PUBLIC_URL`	`str`	`http://localhost:8000`	advanced bootstrap setting; preserve configuration before changing
`ADMIN_PUBLIC_URL`	`str`	`http://localhost:5173`	advanced bootstrap setting; preserve configuration before changing
`CUSTOMER_PUBLIC_URL`	`str`	`http://localhost:5174`	advanced bootstrap setting; preserve configuration before changing
`DB_HOST`	`str`	`localhost`	advanced bootstrap setting; preserve configuration before changing
`DB_PORT`	`int`	`3306`	advanced bootstrap setting; preserve configuration before changing
`DB_NAME`	`str`	`bryannet`	advanced bootstrap setting; preserve configuration before changing
`DB_USER`	`str`	`root`	advanced bootstrap setting; preserve configuration before changing
`DB_PASSWORD`	`str`	`empty`	sensitive bootstrap
`JWT_SECRET`	`str`	`empty`	sensitive bootstrap
`JWT_ALGORITHM`	`str`	`HS256`	advanced bootstrap setting; preserve configuration before changing
`ROUTER_ENCRYPTION_KEY`	`str`	`empty`	sensitive bootstrap
`BRYANNET_INTERNAL_SERVICE_TOKEN`	`str \| None`	`None`	managed/internal
`PORTAL_BACKEND_HOST`	`str`	`localhost`	managed/internal
`PORTAL_BACKEND_PORT`	`int`	`8000`	managed/internal
`BRYANNET_UPDATE_VERIFICATION_MODE`	`bool`	`False`	managed/internal
`BRYANNET_RELEASE_MANIFEST_URL`	`str`	`https://updates.bryannet.online/stable/release-manifest.json`	advanced bootstrap setting; preserve configuration before changing
`LICENSE_VERIFICATION_MODE`	`str`	`offline`	advanced bootstrap setting; preserve configuration before changing
`LICENSE_VERIFICATION_URL`	`str`	`empty`	advanced bootstrap setting; preserve configuration before changing
`LICENSE_VERIFICATION_PUBLIC_KEY`	`str`	`empty`	advanced bootstrap setting; preserve configuration before changing
`LICENSE_VERIFICATION_INTERVAL_HOURS`	`int`	`24`	advanced bootstrap setting; preserve configuration before changing
`LICENSE_GRACE_PERIOD_DAYS`	`int`	`7`	advanced bootstrap setting; preserve configuration before changing
`LICENSE_VERIFICATION_TIMEOUT_SECONDS`	`int`	`15`	advanced bootstrap setting; preserve configuration before changing

Saved application settings

These keys identify saved application settings, not additional environment variables. Change supported settings through the appropriate Admin settings page; do not create or edit database values to bypass validation or licensing.

Constant	Stored key
`BACKUP_ENABLED`	`backup_enabled`
`BACKUP_LOCAL_ENABLED`	`backup_local_enabled`
`BACKUP_LOCAL_PATH`	`backup_local_path`
`BACKUP_LOCAL_RETENTION_COUNT`	`backup_local_retention_count`
`BACKUP_OFFSITE_ENABLED`	`backup_offsite_enabled`
`BACKUP_S3_ENDPOINT`	`backup_s3_endpoint`
`BACKUP_S3_REGION`	`backup_s3_region`
`BACKUP_S3_BUCKET`	`backup_s3_bucket`
`BACKUP_S3_PREFIX`	`backup_s3_prefix`
`BACKUP_S3_ACCESS_KEY`	`backup_s3_access_key`
`BACKUP_S3_SECRET_KEY`	`backup_s3_secret_key`
`BACKUP_S3_PATH_STYLE`	`backup_s3_path_style`
`BACKUP_OFFSITE_RETENTION_COUNT`	`backup_offsite_retention_count`
`BACKUP_SCHEDULE_ENABLED`	`backup_schedule_enabled`
`BACKUP_SCHEDULE_TIME`	`backup_schedule_time`
`BACKUP_RECOVERY_KEY`	`backup_recovery_key`
`COMPANY_NAME`	`company_name`
`COMPANY_EMAIL`	`company_email`
`COMPANY_PHONE`	`company_phone`
`COMPANY_ADDRESS`	`company_address`
`DEFAULT_TIMEZONE`	`default_timezone`
`DEFAULT_CURRENCY`	`default_currency`
`COUNTRY`	`country`
`THEME`	`theme`
`DATE_FORMAT`	`date_format`
`TIME_FORMAT`	`time_format`
`ORGANIZATION_PROFILE`	`organization_profile`
`ORGANIZATION_ENABLED_MODULES`	`organization_enabled_modules`
`ORGANIZATION_CONFIGURATION_VERSION`	`organization_configuration_version`
`REGISTRATION_ENABLED`	`registration_enabled`
`SESSION_TIMEOUT_MINUTES`	`session_timeout_minutes`
`JWT_EXPIRE_MINUTES`	`jwt_expire_minutes`
`REMEMBER_ME_EXPIRE_DAYS`	`remember_me_expire_days`
`TELEGRAM_SESSION_TIMEOUT_MINUTES`	`telegram_session_timeout_minutes`
`MAX_LOGIN_ATTEMPTS`	`max_login_attempts`
`PASSWORD_MIN_LENGTH`	`password_min_length`
`REQUIRE_SPECIAL_CHARACTERS`	`require_special_characters`
`REQUIRE_UPPERCASE`	`require_uppercase`
`REQUIRE_NUMBERS`	`require_numbers`
`TWO_FACTOR_AUTH_POLICY`	`two_factor_auth_policy`
`TWO_FACTOR_PROTECTED_ACTIONS`	`two_factor_protected_actions`
`LEGACY_TWO_FACTOR_AUTH_ENABLED`	`two_factor_auth_enabled`
`EMAIL_NOTIFICATIONS`	`email_notifications`
`SUBSCRIPTION_EXPIRY_REMINDERS`	`subscription_expiry_reminders`
`OUTAGE_ALERTS`	`outage_alerts`
`ROUTER_USERNAME_PREFIX`	`router_username_prefix`
`ADDITIONAL_FRONTEND_ORIGINS`	`additional_frontend_origins`
`PORTAL_DEFAULT_REDIRECT_URL`	`portal_default_redirect_url`
`PAYMENT_REFERENCE_PREFIX`	`payment_reference_prefix`
`PAYMENT_EXPIRY_MINUTES`	`payment_expiry_minutes`
`TELEGRAM_ENABLED`	`telegram_enabled`
`TELEGRAM_BOT_TOKEN`	`telegram_bot_token`
`TELEGRAM_BOT_USERNAME`	`telegram_bot_username`
`PAYSTACK_ENABLED`	`paystack_enabled`
`PAYSTACK_PUBLIC_KEY`	`paystack_public_key`
`PAYSTACK_SECRET_KEY`	`paystack_secret_key`
`FLUTTERWAVE_ENABLED`	`flutterwave_enabled`
`FLUTTERWAVE_SECRET_KEY`	`flutterwave_secret_key`
`FLUTTERWAVE_WEBHOOK_SECRET`	`flutterwave_webhook_secret`
`SMTP_ENABLED`	`smtp_enabled`
`SMTP_HOST`	`smtp_host`
`SMTP_PORT`	`smtp_port`
`SMTP_USERNAME`	`smtp_username`
`SMTP_PASSWORD`	`smtp_password`
`SMTP_FROM_EMAIL`	`smtp_from_email`
`SMTP_USE_TLS`	`smtp_use_tls`
`SMS_PROVIDER`	`sms_provider`
`SMS_API_KEY`	`sms_api_key`
`BRAND_NAME`	`brand_name`
`LOGO_URL`	`logo_url`
`PRIMARY_COLOR`	`primary_color`
`SECONDARY_COLOR`	`secondary_color`
`LOGIN_PAGE_TITLE`	`login_page_title`
`LOGIN_PAGE_SUBTITLE`	`login_page_subtitle`
`COMPANY_TAGLINE`	`company_tagline`
`FAVICON_URL`	`favicon_url`
`SUPPORT_EMAIL`	`support_email`
`SUPPORT_PHONE`	`support_phone`
`SUPPORT_WHATSAPP`	`support_whatsapp`
`SUPPORT_TELEGRAM`	`support_telegram`
`WEBSITE_URL`	`website_url`
`FACEBOOK_URL`	`facebook_url`
`INSTAGRAM_URL`	`instagram_url`
`X_URL`	`x_url`
`LINKEDIN_URL`	`linkedin_url`
`MOBILE_URL_SCHEME`	`mobile_url_scheme`
`SETUP_COMPLETED`	`setup_completed`
`MAINTENANCE_MODE`	`maintenance_mode`
`MAINTENANCE_SCHEDULED_AT`	`maintenance_scheduled_at`
`MAINTENANCE_SCHEDULE_MESSAGE`	`maintenance_schedule_message`
`DEBUG_MODE`	`debug_mode`
`AUDIT_LOG_RETENTION_DAYS`	`audit_log_retention_days`
`BACKUP_RETENTION_DAYS`	`backup_retention_days`

Inspected Compose interpolation inputs

ADMIN_PORT, API_PORT, BRYANNET_ADMIN_IMAGE, BRYANNET_API_IMAGE, BRYANNET_BACKUP_PATH, BRYANNET_BOT_IMAGE, BRYANNET_CUSTOMER_IMAGE, BRYANNET_UPDATE_VERIFICATION_MODE, CUSTOMER_PORT, DB_NAME, DB_PASSWORD, DB_USER, ENVIRONMENT, MYSQL_ROOT_PASSWORD

Image versions and verification inputs are release-managed. Passwords and tokens are sensitive. Follow the relevant setting's restart requirements and retain the previous configuration for recovery.

Bachs saved integration settings

Configure Bachs through Settings > Integrations. These are database-backed setting keys, not a claim that identically named environment variables bootstrap credentials:

Saved setting	Purpose
`bachs_enabled`	Enable Bachs payment availability after successful configuration/acceptance
`bachs_environment`	Select `sandbox` or `live`
`bachs_sandbox_organization_id` / `bachs_live_organization_id`	Merchant identity for the selected environment
`bachs_sandbox_secret_key` / `bachs_live_secret_key`	Server-only API credentials; must match the environment
`bachs_sandbox_webhook_secret` / `bachs_live_webhook_secret`	Verify raw webhook signatures for the selected environment

The internal bachs_eligible setting is not a second operator approval toggle. Use the configured provider/account checks and actual acceptance results rather than setting eligibility by hand.

Bachs webhook route: stable public HTTPS API origin plus /api/v1/payments/webhooks/bachs. The payment worker uses the API image and runs python -m app.workers.payment_maintenance_runner; it processes the shared durable inbox and payment recovery. Apply the release's additive migrations before starting the updated API and workers. Credential snapshots preserve the original transaction configuration during later verification; changing current settings does not rewrite historical payment credentials.