FiloraFS-Prov2
FiloraFS-Pro configuration
Configure FiloraFS-Pro v2 persistence, JWT, LOCAL files, validation, workbench access, and encrypted runtime S3 settings.
Updated
Runnable local defaults
| Area | Default |
|---|---|
| Port | 8080 |
| Metadata database | In-memory H2 in MySQL mode |
| Schema | Flyway enabled; Hibernate validate |
| Active storage | LOCAL at ./uploads |
| JWT secret | Generated for the local process |
| Demo data | Disabled |
| API workbench | Enabled |
Database and JWT
| Variable | Default / purpose |
|---|---|
| DB_URL | In-memory H2; set a MySQL JDBC URL for persistence |
| DB_USERNAME | sa for H2 |
| DB_PASSWORD | Empty for H2 |
| JWT_SECRET | Generated locally; use a stable 32+ character production secret |
| JWT_ACCESS_TOKEN_TTL | 15m |
| JWT_REFRESH_TOKEN_TTL | 14d |
| JWT_ISSUER | filorafs |
| JWT_AUDIENCE | filorafs-api |
LOCAL files, validation, and thumbnails
| Variable | Default / purpose |
|---|---|
| FILORAFS_LOCAL_PATH | ./uploads; relative path inside the project directory |
| FILORAFS_MAX_SIZE_BYTES | 52428800 (50 MiB) |
| FILORAFS_ALLOWED_TYPES | image/png,image/jpeg,application/pdf,video/mp4 |
| FILORAFS_THUMBNAILS_DIR | thumbs |
| FILORAFS_THUMBNAILS_WIDTH | 300 |
Developer facilities
| Variable | Default / purpose |
|---|---|
| FILORAFS_DEMO_DATA_ENABLED | false; optionally seed local demo users on an empty database |
| FILORAFS_API_TEST_ENABLED | true; serve /api-test |
| FILORAFS_CORS_ALLOWED_ORIGINS | Exact localhost origins for the default server and port 3000 |
S3-compatible runtime configuration
S3 endpoint, bucket, region, access key, and secret key are saved through the ROLE_ADMIN /api/storage endpoints or the workbench. They are not S3 .env variables. Saving settings does not activate S3.
- Set FILORAFS_STORAGE_MASTER_KEY to Base64 text that decodes to exactly 32 random bytes before saving or using S3 credentials.
- The access and secret keys are encrypted with AES-256-GCM before database persistence.
- Keep the master key outside the database and stable anywhere stored credentials must remain readable.
- Configuration responses return endpoint, bucket, region, and credential-presence flags; they never return credential values.
- Use the MinIO S3 API endpoint, such as http://localhost:9000, not its console endpoint.
Before deployment
- Use persistent MySQL with backups and restricted credentials.
- Provide stable JWT and storage master keys through managed secret configuration.
- Use persistent LOCAL storage or a tested S3-compatible service.
- Disable demo data and the public API workbench.
- Apply HTTPS, rate limits, monitoring, retention, and malware controls required by the application.