Configuration
SecuFile — Configuration
Configuration is entirely managed through environment variables. In production, secrets are injected via Kubernetes Secrets.
| Variable | Description | Default |
|---|
SERVER_PORT | Listening port | 8080 |
SERVER_HOST | Listening address | 0.0.0.0 |
ENVIRONMENT | Mode (dev/staging/prod) | dev |
CORS_ORIGINS | Allowed origins (comma-separated) | "" (required in prod) |
LOG_LEVEL | Log level (debug/info/warn/error) | info |
MAX_BODY_SIZE | Max request body size (bytes) | 1048576 (1MB) |
SERVER_READ_TIMEOUT | Read timeout (seconds) | 30 |
SERVER_WRITE_TIMEOUT | Write timeout (seconds) | 30 |
| Variable | Description | Default |
|---|
DB_HOST | PostgreSQL host | localhost |
DB_PORT | Port | 5432 |
DB_USER | Username | filesecure |
DB_PASSWORD | Password | - |
DB_NAME | Database name | filesecure |
DB_SSLMODE | SSL mode | disable |
DB_MAX_OPEN_CONNS | Max open connections | 25 |
DB_MAX_IDLE_CONNS | Max idle connections | 5 |
| Variable | Description | Default |
|---|
REDIS_HOST | Redis host | - |
REDIS_PORT | Port | 6379 |
REDIS_PASSWORD | Password | - |
REDIS_DB | Database number | 0 |
| Variable | Description | Default |
|---|
S3_ENDPOINT | OVH S3 endpoint | s3.bhs.cloud.ovh.net |
S3_REGION | Region | bhs |
S3_ACCESS_KEY_ID | Access key | - |
S3_SECRET_ACCESS_KEY | Secret key | - |
S3_BUCKET | Default bucket | filesecure |
S3_USE_SSL | Use HTTPS | true |
| Variable | Description | Default |
|---|
JWT_SECRET | JWT secret key (min 32 chars) | - |
JWT_ACCESS_TTL_MINUTES | Access token duration | 15 |
JWT_REFRESH_TTL_HOURS | Refresh token duration | 168 (7 days) |
JWT_ISSUER | JWT issuer | filesecure |
| Variable | Description | Default |
|---|
KMS_PROVIDER | Provider type (local or ovh) | local |
KMS_ENDPOINT | OVH KMS endpoint | - |
KMS_REGION | OVH KMS region | eu-west-rbx |
KMS_KEY_ID | Master key UUID in KMS | - |
KMS_CERT_PATH | Client certificate path (PEM) | - |
KMS_KEY_PATH | Client private key path (PEM) | - |
KMS_CA_PATH | CA certificate path (PEM) | - |
KMS_LOCAL_MASTER_KEY | Base64-encoded 32-byte key | - |
| Variable | Description | Default |
|---|
RATE_LIMIT_AUTH | Auth endpoint limit (req/min) | 20 |
RATE_LIMIT_PUBLIC | Public endpoint limit (req/min) | 60 |
RATE_LIMIT_API | Protected API limit (req/min) | 120 |
| Variable | Description | Default |
|---|
ACCOUNT_LOCKOUT_ENABLED | Enable lockout | true |
ACCOUNT_LOCKOUT_MAX_ATTEMPTS | Max failed attempts | 5 |
ACCOUNT_LOCKOUT_DURATION_MINUTES | Lockout duration (minutes) | 15 |
| Variable | Description | Default |
|---|
STRIPE_ENABLED | Enable Stripe integration | false |
STRIPE_TEST_PUBLISHABLE_KEY | Test publishable key | - |
STRIPE_TEST_SECRET_KEY | Test secret key | - |
STRIPE_TEST_WEBHOOK_SECRET | Test webhook secret | - |
STRIPE_PROD_PUBLISHABLE_KEY | Production publishable key | - |
STRIPE_PROD_SECRET_KEY | Production secret key | - |
STRIPE_PROD_WEBHOOK_SECRET | Production webhook secret | - |
| Variable | Description | Default |
|---|
CLAMAV_ENABLED | Enable antivirus scanning | true |
CLAMAV_HOST | ClamAV daemon host | clamav |
CLAMAV_PORT | Port | 3310 |
CLAMAV_TIMEOUT | Scan timeout (seconds) | 30 |
| Variable | Description | Default |
|---|
OVH_STORAGE_ENABLED | Enable per-org provisioning | false |
OVH_STORAGE_ENDPOINT | OVH API endpoint | ovh-ca |
OVH_APPLICATION_KEY | OVH application key | - |
OVH_APPLICATION_SECRET | OVH application secret | - |
OVH_CONSUMER_KEY | OVH consumer key | - |
OVH_STORAGE_PROJECT_ID | OVH Cloud project ID | - |
OVH_STORAGE_USE_MOCK | Use mock client (dev/test) | false |
| Variable | Description | Default |
|---|
FILE_UPLOAD_MAX_SIZE | Max file size (bytes) | 26214400 (25 MB) |
| Variable | Description | Default |
|---|
CLEANUP_ENABLED | Enable cleanup job | true |
CLEANUP_INTERVAL_MINUTES | Run interval (minutes) | 5 |
CLEANUP_BATCH_SIZE | Max folders per run | 100 |
| Variable | Description |
|---|
EXTERNAL_API_URL | Go API URL (e.g., https://api.secufile.secuaas.dev) |
DEBUG | Debug mode (true/false) |
POSTGRES_HOST | PostgreSQL host |
POSTGRES_PORT | PostgreSQL port |
POSTGRES_DB | Database name |
POSTGRES_USER | Username |
POSTGRES_PASSWORD | Password |
SERVICE_ACCOUNT_TOKEN | Go API service account token |
RESEND_API_KEY | Resend API key (emails) |
SENDER_EMAIL | Sender email address |
ZITADEL_CLIENT_ID | Zitadel client ID (SSO) |
ZITADEL_CLIENT_SECRET | Zitadel secret |
ZITADEL_ISSUER | Zitadel issuer (e.g., https://auth.secuaas.com) |
OVH_APPLICATION_KEY | OVH API key (billing) |
OVH_APPLICATION_SECRET | OVH API secret |
OVH_CONSUMER_KEY | OVH consumer key |
OVH_STORAGE_PROJECT_ID | OVH Cloud project ID |
In production, no secret is stored in plaintext in the code. All secrets are managed via:
- Kubernetes Secrets: Injected via
envFrom.secretRef in deployments
- OVH Secret Manager: The Go backend uses
pkg/secretsloader to load secrets from OVH Secret Manager with automatic fallback to environment variables
- secuops CLI: Secret management via the command line
The Kubernetes secret secufile-secrets contains 32+ keys covering all services.
The Go backend validates critical configuration at startup. In production mode (ENVIRONMENT=prod), the following checks are enforced:
JWT_SECRET must be at least 32 charactersDB_PASSWORD must be setCORS_ORIGINS must be explicitly configured (not * or empty)DB_SSLMODE must not be disable
Failure to meet these requirements causes the application to exit immediately.