Skip to content
Laju Go logoLaju Go
DocsBlog

Configuration

Env is read once, at startup, in app/config/config.go, which loads .env via godotenv and falls back to environment variables. Copy .env.example → .env and adjust before deploying.

Variable Default Notes
APP_PORT 8080 Port the Fiber server listens on
APP_ENV development production enables secure session cookies and JSON logs
APP_URL http://localhost:8080 Absolute base URL (email links, OAuth redirects)
DB_PATH ./data/app.db SQLite database path; keep inside a persistent volume in Docker
SESSION_SECRET change-this-in-production Secret for signing session cookies — change in production
SESSION_TTL 24h Session lifetime (Go duration string: 24h, 8h, 30m)
ALLOWED_ORIGINS http://localhost:5173 Comma-separated CORS origins; set to your domain in production
FRONTEND_URL http://localhost:5173 Vite dev server URL (dev only)
GOOGLE_CLIENT_ID — enable Google OAuth (set both ID and secret, or leave both empty)
GOOGLE_CLIENT_SECRET — enable Google OAuth
GOOGLE_REDIRECT_URL — OAuth callback URL (e.g. https://your-domain.com/auth/google/callback)
SMTP_HOST smtp.gmail.com SMTP server hostname (leave SMTP_USER empty to disable email)
SMTP_PORT 587 SMTP server port
SMTP_USER — SMTP username; empty disables email sending
SMTP_PASS — SMTP password
FROM_EMAIL noreply@example.com From address for outgoing email
FROM_NAME Laju From display name for outgoing email

Notes

Section titled “Notes”
  • SESSION_SECRET must be changed in production. Generate a strong one with openssl rand -hex 32.
  • ALLOWED_ORIGINS controls CORS. In production, set it to your exact domain (e.g. https://your-domain.com). The default http://localhost:5173 is for Vite dev only.
  • APP_ENV=production enables secure session cookies (requires HTTPS) and switches logs to JSON format. In development, logs are text and the Vite dev server is expected.
  • Google OAuth is optional. Set both GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET to enable it, or leave both empty to disable. GOOGLE_REDIRECT_URL must match the authorized redirect URI in your Google Cloud Console.
  • Email is optional. Leave SMTP_USER empty to disable email sending (password reset will log the link instead of sending it).
  • DB_PATH in Docker must point inside the persistent volume (/app/data/app.db) so the SQLite file survives container restarts.