演示

环境变量

Base 后端进程环境变量，来自 base/backend/.env（见 .env.sample）。这是主机基础设施配置，不是插件 @InjectEnv。

概述

将 base/backend/.env.sample 复制为 .env（或在 Compose 中设置相同键）。插件级运行时键见 PluginEnv。切勿将真实密钥提交到 git。

主题说明
Filebase/backend/.env（模板：base/backend/.env.sample）
Compose也可在 Compose backend service environment 中设置
PluginEnv插件级可编辑键 — 与本页不同
Secrets示例值仅用于本地 / 开发，上线前务必轮换

运行时与标识

Variable说明Example
NODE_ENVNode runtime modeproduction
MODEApp mode (template often uses dev)dev
BASE_VERSIONBase platform version — keep aligned with @quan-erp/* and image tags1.0.0
ORGANIZATION_IDOrganization identifier for this deploymentquan-erp
DEBUG_LOGOptional debug scopeplugin-manager

服务 URL

Variable说明Example
FRONTEND_URLPublic frontend originhttp://localhost
BACKEND_URLBackend API basehttp://localhost:8080
DEV_TOOL_URLBase dev toolshttp://localhost:8081
PLUGIN_SERVER_URLPlugin serverhttp://localhost:8082
CORS_ALLOWED_ORIGINSComma-separated browser origins allowed to call the APIhttp://localhost:3000,...

认证令牌

在共享或生产环境部署前，请轮换所有 token 密钥。

Variable说明Example
ACCESS_TOKEN_SECRETJWT access-token signing secretchange-me
ACCESS_TOKEN_SECRET_EXPIRATION_TIMEAccess token TTL15m
REFRESH_TOKEN_SECRETJWT refresh-token signing secretchange-me
REFRESH_TOKEN_SECRET_EXPIRATION_TIMERefresh token TTL30d

OpenAI 兼容 AI

Variable说明Example
OPENAI_BASE_URLAPI base URLhttps://api.deepseek.com
OPENAI_API_KEYProvider API key (leave empty if unused)—

数据库

在 Compose 内主机名通常是服务名（pgbouncer / db）。经 PgBouncer 时 DB_PORT 多为 6432。

Variable说明Example
DATABASE_HOSTPostgres or PgBouncer host (alias used by some entrypoints)pgbouncer
DB_HOSTPostgres or PgBouncer hostpgbouncer
DB_PORTDatabase port (6432 via PgBouncer, 5432 direct)6432
DB_USERNAMEDatabase usernamepostgres
DB_PASSWORDDatabase passwordchange-me
DB_SCHEMASchema namequan-erp
DB_SYNCTypeORM synchronize — local/dev only; use migrations in staging/productiontrue

Redis

Variable说明Example
REDIS_HOSTRedis service nameredis
REDIS_PORTRedis port6379
REDIS_PASSWORDRedis auth passwordchange-me

集群

Variable说明Example
CLUSTER_MODEEnable multi-process clusterfalse
CLUSTER_MAX_COUNTMax worker processes when cluster is on2

加密与 Firebase

不要把生产私钥贴进 git、Doc 或聊天 — 只从密钥库或本地 .env 加载。

Variable说明Example
ENV_ENCRYPTION_KEYKey used to encrypt sensitive env values at restchange-me-…
FIREBASE_CONFIGSingle-line JSON string for the Firebase Admin service account (push / auth){"type":"service_account",…}

目录与文件

Variable说明Example
AVAILABLE_PLUGINS_FOLDERStaged plugin builds/app/available-plugins
INSTALLED_PLUGINS_FOLDERActive installed plugins/app/installed-plugins
APP_DATA_FOLDERPersistent app data root/app/data/data/
UPLOAD_FILE_TEMP_FOLDERTemporary upload staging/app/data/temp
UPLOAD_FILE_FOLDERPersisted uploads/app/data/data/
PLUGINS_ENV_FILEPlugin env JSON file path/app/data/data/plugin.env.json
RUNNER_FLOW_FILEWorkflow definitions directory/app/data/data/workflows/

管理员、限额与订阅

Variable说明Example
ROOT_ADMIN_USERNAMEBootstrap root admin usernameadmin
ROOT_ADMIN_PASSWORDBootstrap root admin password — change outside local templatechange-me
MAX_USER_LIMITMax users for the org5
MAX_ACTIVE_USER_LIMITMax concurrently active users5
MAX_USER_SESSION_LIMIT_PER_USERSessions per user1
MAX_ORGANIZATION_BRANCHMax branches1
MAX_ROLE_LIMITMax roles5
MAX_SUBSCRIPTION_GRACE_PERIOD_DAYSGrace days after subscription end14
DEVELOPER_CONFIG_PASSWORDPassword gate for developer config UI / APIschange-me
SUBSCRIPTION_END_DATESubscription end date2026-01-01

示例（.env.sample 结构）

与 base/backend/.env.sample 结构一致。请替换所有 change-me。下列密钥仅为占位符。

TSbase/backend/.env
1NODE_ENV=production 2 3MODE=dev 4BASE_VERSION=1.0.0 5ORGANIZATION_ID=quan-erp 6 7FRONTEND_URL=http://localhost 8BACKEND_URL=http://localhost:8080 9DEV_TOOL_URL=http://localhost:8081 10PLUGIN_SERVER_URL=http://localhost:8082 11 12DEBUG_LOG=plugin-manager 13 14ACCESS_TOKEN_SECRET=change-me 15ACCESS_TOKEN_SECRET_EXPIRATION_TIME=15m 16REFRESH_TOKEN_SECRET=change-me 17REFRESH_TOKEN_SECRET_EXPIRATION_TIME=30d 18 19OPENAI_BASE_URL=https://api.deepseek.com 20OPENAI_API_KEY= 21 22# database 23DATABASE_HOST=pgbouncer 24DB_HOST=pgbouncer 25DB_USERNAME=postgres 26DB_PASSWORD=change-me 27DB_PORT=6432 28DB_SCHEMA=quan-erp 29DB_SYNC=true 30 31# redis 32REDIS_HOST=redis 33REDIS_PORT=6379 34REDIS_PASSWORD=change-me 35 36CLUSTER_MODE=false 37CLUSTER_MAX_COUNT=2 38 39ENV_ENCRYPTION_KEY=change-me-32-char-hex-or-secret 40 41CORS_ALLOWED_ORIGINS=http://localhost:3000,http://127.0.0.1:3000,http://localhost,https://localhost 42 43AVAILABLE_PLUGINS_FOLDER=/app/available-plugins 44INSTALLED_PLUGINS_FOLDER=/app/installed-plugins 45 46APP_DATA_FOLDER=/app/data/data/ 47UPLOAD_FILE_TEMP_FOLDER=/app/data/temp 48UPLOAD_FILE_FOLDER=/app/data/data/ 49PLUGINS_ENV_FILE=/app/data/data/plugin.env.json 50RUNNER_FLOW_FILE=/app/data/data/workflows/ 51 52FIREBASE_CONFIG={"type":"service_account","project_id":"your-project",...} 53 54ROOT_ADMIN_USERNAME=admin 55ROOT_ADMIN_PASSWORD=change-me 56 57MAX_USER_LIMIT=5 58MAX_ACTIVE_USER_LIMIT=5 59MAX_USER_SESSION_LIMIT_PER_USER=1 60MAX_ORGANIZATION_BRANCH=1 61MAX_ROLE_LIMIT=5 62MAX_SUBSCRIPTION_GRACE_PERIOD_DAYS=14 63DEVELOPER_CONFIG_PASSWORD=change-me 64SUBSCRIPTION_END_DATE=2026-01-01

关键规则

规则说明
Start from sample从 .env.sample 起步
No secrets in git不要提交真实 .env 或 Firebase 私钥
Version alignmentBASE_VERSION 与镜像 / @quan-erp/* 对齐
Production harden上线前关闭 DB_SYNC 并轮换密钥
Two layers插件配置 → PluginEnv；主机基础设施 → 本文件